Malware

How to remove “Malware.AI.232029424”?

Malware Removal

The Malware.AI.232029424 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.232029424 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine Malware.AI.232029424?


File Info:

name: 09C31DAC16202EADBABB.mlw
path: /opt/CAPEv2/storage/binaries/8e1954f7e7a1f714efbf345123d8d47345da649223d08963b39b428388746347
crc32: 17F6748F
md5: 09c31dac16202eadbabb75a531f91309
sha1: dd2a03f934e05c8f66cce544b3037d2f0c180c02
sha256: 8e1954f7e7a1f714efbf345123d8d47345da649223d08963b39b428388746347
sha512: de150f36ea9dd89631b97d8a5d19c9bcaaff209babced90a114a47dbc91c0bfaeabf3ecfc21858719081c72b97351862169eb0d767fd93c1ae35eefac89a7df6
ssdeep: 12288:f0yR+m1eR80rEdvfzggx/COECD/ck7QP:TAEhrx6Vy/ck7
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T10E945B78A614348CF53B7E3838D9F9B3B99CE66323169052ACBFD94902ACF5E4364447
sha3_384: 5e12192427a191f932e0881f251396751b0a98d5cfdae68593a4eed1c6ecad4c1d1d403ad88da5cff3483642177f9461
ep_bytes: 5150528d0d18000000648b0101c801c8
timestamp: 2009-09-22 22:50:44

Version Info:

CompanyName: Microsoft Corporation
FileDescription: x86 Performance Counter Host
FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
InternalName: perfhost.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: perfhost.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.1.7600.16385
Translation: 0x0409 0x04b0

Malware.AI.232029424 also known as:

BkavW32.Expiro2NHc.PE
Elasticmalicious (high confidence)
MicroWorld-eScanWin32.Expiro.Gen.6
FireEyeGeneric.mg.09c31dac16202ead
ALYacWin32.Expiro.Gen.6
CylanceUnsafe
VIPREVirus.Win32.Expiro.dp (v)
SangforTrojan.Win32.Save.a
Cybereasonmalicious.c16202
VirITWin32.Expiro.CV
CyrenW32/S-4367e7a0!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Expiro.NDG
APEXMalicious
ClamAVWin.Trojan.Generic-9919281-0
KasperskyHEUR:Trojan.Win32.Expiro.gen
BitDefenderWin32.Expiro.Gen.6
NANO-AntivirusVirus.Win32.Gen.ccmw
AvastWin32:Xpirat-C [Inf]
Ad-AwareWin32.Expiro.Gen.6
SophosML/PE-A + Mal/EncPk-MK
DrWebWin32.Expiro.150
TrendMicroVirus.Win32.EXPIRO.AD
EmsisoftWin32.Expiro.Gen.6 (B)
SentinelOneStatic AI – Malicious PE
GDataWin32.Expiro.Gen.6
JiangminTrojan.PSW.Stealer.abj
AviraTR/Patched.Gen
Antiy-AVLTrojan/Generic.ASVirus.315
ArcabitWin32.Expiro.Gen.6
MicrosoftTrojan:Win32/Raccoon.EC!MTB
CynetMalicious (score: 100)
Acronissuspicious
MAXmalware (ai score=81)
VBA32BScope.Trojan.Wacatac
MalwarebytesMalware.AI.232029424
TrendMicro-HouseCallVirus.Win32.EXPIRO.AD
IkarusVirus.Win32.Expiro
FortinetW32/Expiro.NDG
AVGWin32:Xpirat-C [Inf]
CrowdStrikewin/malicious_confidence_100% (D)

How to remove Malware.AI.232029424?

Malware.AI.232029424 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment