Malware.AI.1878513275 (file analysis)

The Malware.AI.1878513275 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Malware.AI.1878513275 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Presents an Authenticode digital signature
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Enumerates running processes
• Expresses interest in specific running processes
• Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Attempts to modify proxy settings

How to determine Malware.AI.1878513275?

File Info:
name: 36CE4E4774D0DC2514C9.mlw
path: /opt/CAPEv2/storage/binaries/dce43d9e15e38ab6d86fb6299371548f7588a8bb8865005b4f3662e6d02eade9
crc32: FAF963B2
md5: 36ce4e4774d0dc2514c9feb55bdef6fc
sha1: d68f6d4a08633b63116b80975843074fe9398619
sha256: dce43d9e15e38ab6d86fb6299371548f7588a8bb8865005b4f3662e6d02eade9
sha512: fa0a7cca9308e07bdba839a9c761834d3b346704c098cda02b75746366085f5e7eea4d50ea29a4bbf8103725bcf27cd1902055f95da084fa3376f7992225b641
ssdeep: 24576:CanQrhBdIEii/7qW+8C9/JU8u2w7SnVPuOMEnL0VMg8WTci5+s5lVubJhOzMRk5i:3OBUnWlfF7yPu0w6gHTj53Kt8zDjAh4i
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T155D53866A2808430DA6115B1AECA8F7B75ED5C1113106C9772BFB309C7BC7E1E9353AE
sha3_384: d9a0efce1abd42cddb1d2e776659fad1844d97ef18a07fb93b3827a1f7d5962d05074d7d09c864bda065b4ca906c11b2
ep_bytes: e8f03b0100e989feffff8bff558bec51
timestamp: 2019-11-28 04:53:45

Version Info:
CompanyName: 趣探科技有限公司
FileDescription: 易简日历主程序
FileVersion: 1, 0, 0, 1
InternalName: 易简日历
LegalCopyright: Copyright (C) 2020
OriginalFilename: Calendar.exe
ProductName: 易简日历
ProductVersion: 1, 0, 0, 1
Translation: 0x0804 0x04b0

Malware.AI.1878513275 also known as:

How to remove Malware.AI.1878513275?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.