Malware

Malware.AI.1839356346 malicious file

Malware Removal

The Malware.AI.1839356346 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.1839356346 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Dynamic (imported) function loading detected
  • Performs HTTP requests potentially not found in PCAP.
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Behavioural detection: Injection (Process Hollowing)
  • Executed a process and injected code into it, probably while unpacking
  • Behavioural detection: Injection (inter-process)
  • Attempts to modify proxy settings

How to determine Malware.AI.1839356346?


File Info:

name: AA0E26B9B05C7D8C2FB2.mlw
path: /opt/CAPEv2/storage/binaries/b0c8234ca5049be898eadd0c7d0110730fb880f88f63159a7528abf4deeb1def
crc32: 6FAFC00B
md5: aa0e26b9b05c7d8c2fb2abcbde4d88d4
sha1: 8a4db80edf8b1db40bbe71174088a2cb51f13781
sha256: b0c8234ca5049be898eadd0c7d0110730fb880f88f63159a7528abf4deeb1def
sha512: b50999c8ebc8554756b3d1b8bf9baa0cab7673cff4d3d2243b2720cb478a26cf612ecf817e070348c63bd4699310533ac2d9f8e284f63c2f5255507e60f417ee
ssdeep: 1536:XYTWpQuVR5qdbilS6kKXSzBRKR7Jebmx44nzNVd/c0gl0yRfEJ4:4WpvQnRKR7JeC44zNPAWasJ4
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15E835A0A1C574817E090CD31C7E217D55BBDB8A37AC2A92FDF80DC9CD6B7418A942EB9
sha3_384: b04d5ad911162981f17c131be18860bd7ad11672cf667c80b9942f7fcd470fac623b8868de7794d297d69d3fee673696
ep_bytes: 558bec6a90682063400068fe42400064
timestamp: 2014-07-06 17:17:44

Version Info:

CompanyName: Google Inc.
FileDescription: Google Chrome
FileVersion: 34.0.1847.131
InternalName: chrome_exe
LegalCopyright: Copyright 2012 Google Inc. All rights reserved.
OriginalFilename: chrome.exe
ProductName: Google Chrome
ProductVersion: 34.0.1847.131
CompanyShortName: Google
ProductShortName: Chrome
LastChange: 265687
Official Build: 1
Translation: 0x0409 0x04b0

Malware.AI.1839356346 also known as:

BkavW32.AIDetect.malware1
LionicTrojan.Win32.Inject.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKDZ.25466
FireEyeGeneric.mg.aa0e26b9b05c7d8c
CAT-QuickHealTrojan.CeeInject.WR
McAfeePWSZbot-FXE!AA0E26B9B05C
CylanceUnsafe
ZillyaTrojan.Zbot.Win32.161449
SangforBackdoor.Win32.Hlux.ztioenc
K7AntiVirusTrojan ( 0055e3991 )
K7GWTrojan ( 0055e3991 )
Cybereasonmalicious.9b05c7
VirITTrojan.Win32.Generic.CIAZ
CyrenW32/Zbot.WS.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Injector.BHLI
APEXMalicious
KasperskyTrojan.Win32.Inject.nzsy
BitDefenderTrojan.GenericKDZ.25466
NANO-AntivirusTrojan.Win32.Blocker.dcbhra
SUPERAntiSpywareTrojan.Agent/Gen-Zemot
AvastWin32:CeeInject-AQ [Trj]
TencentWin32.Trojan.Inject.Llhe
ComodoBackdoor.Win32.Kelihos.ARJ@5j5dbu
F-SecureBackdoor.BDS/Hlux.ztioenc
DrWebTrojan.DownLoad3.33737
VIPRETrojan.Win32.Generic!BT
TrendMicroTROJ_MALKRYP.SM4
McAfee-GW-EditionBehavesLike.Win32.Downloader.mh
EmsisoftTrojan.GenericKDZ.25466 (B)
IkarusBackdoor.Win32.Hlux
JiangminTrojan.Inject.asim
WebrootTrojan.Dropper.Gen
AviraBDS/Hlux.ztioenc
Antiy-AVLTrojan[Backdoor]/Win32.Hlux
KingsoftWin32.Troj.Inject.nz.(kcloud)
MicrosoftTrojanDownloader:Win32/Zemot.A
ZoneAlarmTrojan.Win32.Inject.nzsy
GDataTrojan.GenericKDZ.25466
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.FakeAV.R111857
BitDefenderThetaGen:NN.ZexaF.34182.fq1@aKBdjrdj
ALYacTrojan.GenericKDZ.25466
MAXmalware (ai score=86)
VBA32BScope.Trojan.Download
MalwarebytesMalware.AI.1839356346
TrendMicro-HouseCallTROJ_MALKRYP.SM4
RisingDownloader.Zemot!8.417 (RDMK:cmRtazoCz1JmUJQLaenK1gvxinKk)
YandexTrojan.Injector!6qITT40lsGA
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Injector.BHSP!tr
AVGWin32:CeeInject-AQ [Trj]
PandaTrj/CI.A
CrowdStrikewin/malicious_confidence_100% (D)

How to remove Malware.AI.1839356346?

Malware.AI.1839356346 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment