Malware

Malware.AI.1956737308 removal guide

Malware Removal

The Malware.AI.1956737308 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.1956737308 virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Behavioural detection: Executable code extraction – unpacking
  • Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Guard pages use detected – possible anti-debugging.
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • A process created a hidden window
  • CAPE extracted potentially suspicious content
  • Executed a very long command line or script command which may be indicative of chained commands or obfuscation
  • Drops a binary and executes it
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • A scripting utility was executed
  • A ping command was executed with the -n argument possibly to delay analysis
  • Uses Windows utilities for basic functionality
  • Uses Windows utilities for basic functionality
  • Detects VirtualBox using WNetGetProviderName trick
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Checks the version of Bios, possibly for anti-virtualization
  • Appears to use command line obfuscation
  • A script or command line contains a long continuous string indicative of obfuscation
  • Attempts to disable Windows Defender
  • Attempts to execute suspicious powershell command arguments
  • Uses suspicious command line tools or Windows utilities

How to determine Malware.AI.1956737308?


File Info:

name: 84B1B92D39A15A9A910F.mlw
path: /opt/CAPEv2/storage/binaries/0259927b968e8922f7f668f71478598118e39ff3b303865f8fcbd410e24efcf5
crc32: 575A4590
md5: 84b1b92d39a15a9a910fc966593228cd
sha1: 9d2031094c4cadc6f8c69e379421fb05f47dcae6
sha256: 0259927b968e8922f7f668f71478598118e39ff3b303865f8fcbd410e24efcf5
sha512: fcc4e5dfe5aa71824ecb04bbecbfd84ea61496298fbf7bd79ec20b150478baba81df9ad5b1d7203f63cb739a2fbf2713340da4e11f48a9810f9eedb698849894
ssdeep: 196608:91ONNbLF0BDzFO00iypINbWFvDa+gRuKAzon3O:3ONNi3H01pgbWF5GuK6OO
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1957633213191CCFBD09B0832CD556FDA6BD8CA5C9911AEB323DE846C7E3C8436665BD8
sha3_384: c67f3131008663d055c80f6bb7a8e137e74ccc8637729bab87bb8f56e7ba78756f89a29b8aee3c035475d37b0ee53992
ep_bytes: 558bec6aff68e0b94100682c4a410064
timestamp: 2010-11-18 16:27:35

Version Info:

CompanyName: Igor Pavlov
FileDescription: 7z Setup SFX
FileVersion: 9.20
InternalName: 7zS.sfx
LegalCopyright: Copyright (c) 1999-2010 Igor Pavlov
OriginalFilename: 7zS.sfx.exe
ProductName: 7-Zip
ProductVersion: 9.20
Translation: 0x0409 0x04b0

Malware.AI.1956737308 also known as:

LionicAdware.Win32.Agent.2!c
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Jaik.48175
FireEyeGen:Variant.Jaik.48175
CAT-QuickHealTrojan.Agent
McAfeeArtemis!84B1B92D39A1
CylanceUnsafe
AlibabaAdWare:Win32/Neoreklami.6df8860f
SymantecTrojan.Gen.MBT
ESET-NOD32a variant of Win32/Adware.Neoreklami.LI
APEXMalicious
Paloaltogeneric.ml
Kasperskynot-a-virus:UDS:AdWare.Win32.Agent.gen
BitDefenderGen:Variant.Jaik.48175
AvastWin32:Adware-gen [Adw]
TencentWin32.Adware.Neoreklami.Ebgr
Ad-AwareGen:Variant.Jaik.48175
SophosMal/Generic-R
DrWebTrojan.MulDrop19.10760
TrendMicroTROJ_GEN.R002C0PL321
McAfee-GW-EditionPUP-XQW-DG
EmsisoftGen:Variant.Jaik.48175 (B)
IkarusPUA.Neoreklami
GDataGen:Variant.Jaik.48175
JiangminAdware.Agent.atow
AviraHEUR/AGEN.1145066
Antiy-AVLTrojan/Generic.ASMalwS.34E0C7C
GridinsoftRansom.Win32.Sabsik.sa
ViRobotAdware.Neoreklami.7601838
MicrosoftTrojan:Script/Phonzy.B!ml
CynetMalicious (score: 100)
BitDefenderThetaGen:NN.ZexaF.34084.@JW@aiSe5ek
ALYacGen:Variant.Jaik.48175
MAXmalware (ai score=87)
VBA32Adware.Agent
MalwarebytesMalware.AI.1956737308
TrendMicro-HouseCallTROJ_GEN.R002C0PL321
RisingMalware.Heuristic!ET#87% (RDMK:cmRtazqBy85N2XCbLnAPF92AeKuH)
YandexPUA.Agent!dU7s72dKIyA
SentinelOneStatic AI – Malicious SFX
FortinetAdware/Neoreklami
AVGWin32:Adware-gen [Adw]
PandaTrj/CI.A

How to remove Malware.AI.1956737308?

Malware.AI.1956737308 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment