Malware.AI.2154107899 (file analysis)

The Malware.AI.2154107899 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Malware.AI.2154107899 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• HTTPS urls from behavior.
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial binary language: Russian
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The executable is compressed using UPX
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Attempts to modify proxy settings
• CAPE detected injection into a browser process, likely for Man-In-Browser (MITB) infostealing
• Creates a copy of itself
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Malware.AI.2154107899?

File Info:
name: 3CCBD5283EEFF9B2CC3A.mlw
path: /opt/CAPEv2/storage/binaries/fe3af640ac8e991b9b0bc64df74f8bcd5bf3325340db422f651768bf8c8fc85f
crc32: E8C885EC
md5: 3ccbd5283eeff9b2cc3ac072adb16067
sha1: bf0a6a9ab5f7b0ada88c97393041c2235ad8c2e5
sha256: fe3af640ac8e991b9b0bc64df74f8bcd5bf3325340db422f651768bf8c8fc85f
sha512: 64314641fba779fa7def62817465bd18b4b78ec2df68ca12690a0db5257a7b9b44f617541474f349b0e58bd95c2e237aba51b497f305b334f6738d801712be28
ssdeep: 768:AIvx2UWOtkd7V1luj8t3v6qvr9PeuQPF1zgHgO:A4zWKm7V1lRPfuzg
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T102935E07EE2B1971FC16A5FF090279961D30FD0217F5CAA6A5DA3B0A6CFC1772920279
sha3_384: 433c43681734df0b55edf0f2cae4ff7ce6c637ef4a06d31a27dd4fb359643d51ec418f9cdd9abcd95c0ecff4632c6bed
ep_bytes: 558bec8bc08bc08bc5a358744000a158
timestamp: 2012-12-29 14:03:57

Version Info:
CompanyName: Корпорация Майкрософт
FileDescription: Мастер создания общих ресурсов
FileVersion: 5.1.2600.5512 (xpsp.080413-2108)
InternalName: SHRWIZ
LegalCopyright: © Корпорация Майкрософт. Все права защищены.
OriginalFilename: shrpubw.exe
ProductName: Операционная система Microsoft® Windows®
ProductVersion: 5.1.2600.5512
Translation: 0x0419 0x04b0

Malware.AI.2154107899 also known as:

How to remove Malware.AI.2154107899?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.