Malware

Malware.AI.2116149984 removal guide

Malware Removal

The Malware.AI.2116149984 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.2116149984 virus can do?

  • Reads data out of its own binary image
  • Drops a binary and executes it
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Malware.AI.2116149984?


File Info:

name: 2ED37427DDD68451D7FE.mlw
path: /opt/CAPEv2/storage/binaries/e985e4fc7dd86bca16be68d375d9f57cc27f158c3b3cbe413d4a5341734f455e
crc32: E292A11A
md5: 2ed37427ddd68451d7fe35275aca9713
sha1: e3c52d73867e13f96467519ac8d9561c9c9210f1
sha256: e985e4fc7dd86bca16be68d375d9f57cc27f158c3b3cbe413d4a5341734f455e
sha512: c93c32b1579f2b6564dbf3cbc75300c4e4171f6e9f8e4879b92249c2941fbdf53499e151077719dce1e709e64c760ce27cfa5c8e54fd5beb94785ae3ce619470
ssdeep: 24576:FFe4R41Y3Xqpv3yQ64xUHRqbWqakQ1PZXouRIRIZwXv:FZ44Xqpvi74egbP41oXv
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A445125EEA9083F2E45504B06669CFEB2CA93C7496538EC733C3221C9DB05D56632B7B
sha3_384: c3ac6111736d67593938a63138b34e8f1680f9ec53fbfef6068962850c045cf39de77e2e3960276817983b24baede07a
ep_bytes: e8563e0000e97ffeffff3b0d601f5200
timestamp: 2005-05-10 20:43:10

Version Info:

CompanyName: Microsoft Corporation
FileDescription: Microsoft Office Word
FileVersion: 12.0.4518.1014
InternalName: WinWord
LegalCopyright: © 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1: Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2: Windows® is a registered trademark of Microsoft Corporation.
OriginalFilename: WinWord.exe
ProductName: 2007 Microsoft Office system
ProductVersion: 12.0.4518.1014
Translation: 0x0000 0x04e4

Malware.AI.2116149984 also known as:

BkavW32.AIDetectMalware
tehtrisGeneric.Malware
MicroWorld-eScanTrojan.GenericKDZ.95091
ClamAVWin.Malware.Bskd-9753126-0
CAT-QuickHealTrojan.Mauvaise.SL1
McAfeeGenericR-ECU!2ED37427DDD6
Cylanceunsafe
ZillyaDropper.Agent.Win32.211497
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 004e144e1 )
K7GWTrojan ( 004e144e1 )
Cybereasonmalicious.7ddd68
CyrenW32/S-33a5b664!Eldorado
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/TrojanDropper.Agent.RHG
APEXMalicious
CynetMalicious (score: 100)
KasperskyVHO:Backdoor.Win32.Salgorea.gen
BitDefenderTrojan.GenericKDZ.95091
NANO-AntivirusTrojan.Win32.Agent.dviino
SUPERAntiSpywareTrojan.Agent/Gen-Lethic
AvastWin32:Trojan-gen
TencentTrojan-Dropper.Win32.Agent.kga
EmsisoftTrojan.GenericKDZ.95091 (B)
F-SecureHeuristic.HEUR/AGEN.1313004
DrWebTrojan.Rent.439
VIPRETrojan.GenericKDZ.95091
TrendMicroTrojan.Win32.SALGOREA.SMAL01
McAfee-GW-EditionBehavesLike.Win32.Generic.tc
Trapminemalicious.high.ml.score
FireEyeGeneric.mg.2ed37427ddd68451
SophosTroj/Agent-BAII
SentinelOneStatic AI – Malicious PE
GDataTrojan.GenericKDZ.95091
JiangminBackdoor.Generic.awat
AviraHEUR/AGEN.1313004
MAXmalware (ai score=80)
Antiy-AVLTrojan/Win32.TSGeneric
XcitiumTrojWare.Win32.Salgorea.RHG@7yqza3
ArcabitTrojan.Generic.D17373
ZoneAlarmHEUR:Backdoor.Win32.Generic
MicrosoftTrojan:Win32/Salgorea.C!dha
GoogleDetected
AhnLab-V3Trojan/Win32.Dynamer.R162866
BitDefenderThetaGen:NN.ZexaF.36250.mr0@aumSwjji
ALYacTrojan.GenericKDZ.95091
TACHYONTrojan/W32.Agent.1250816.Y
VBA32Trojan.Rent
MalwarebytesMalware.AI.2116149984
PandaTrj/Genetic.gen
TrendMicro-HouseCallTrojan.Win32.SALGOREA.SMAL01
RisingTrojan.Agent!1.B332 (CLASSIC)
YandexTrojan.Agent!VmFegsRtJZg
IkarusTrojan.Win32.Salgorea
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Agent.RHG!tr
AVGWin32:Trojan-gen
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (D)

How to remove Malware.AI.2116149984?

Malware.AI.2116149984 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment