Malware

Malware.AI.2616525052 malicious file

Malware Removal

The Malware.AI.2616525052 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.2616525052 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • Unconventionial language used in binary resources: Arabic (Qatar)
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Touches a file containing cookies, possibly for information gathering
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Malware.AI.2616525052?


File Info:

name: 82B0AF1B627D1DB431E0.mlw
path: /opt/CAPEv2/storage/binaries/30145ca205a35af48a9c6eda04df83d13eca84afe1af7bbc57e2bffec5f2094e
crc32: 4DB1518F
md5: 82b0af1b627d1db431e090df2444fa39
sha1: edb2547cd3598925f1b47242d59c2b9827cf2144
sha256: 30145ca205a35af48a9c6eda04df83d13eca84afe1af7bbc57e2bffec5f2094e
sha512: cae8fd502560d363321949be9d47d6a50ab3a50fd50c4c7370dbdc1f4df4077c54e2c6af0660cf6f8fac1339229bf77fb7403e3d0622f96b0de57d7f61bafce8
ssdeep: 6144:hOFL60VpmF4LfWwvXY0LhcS5C3FZkQhBGutkf0N+X7OdruX9HGfoha4D9KKr1aY7:8JmrwvY0Fh5cZkQJtkf0gCpp4DgKr1O
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T10C94AC643A99CF72C15F3174C96C9AB6812BED359F5403D3A3D0BEA974742CE2932923
sha3_384: 8c950fd98860eaaa66e77b61f24ca356507915f29a838db7c8824b6a65c2cfde8ead788965e398bbf7bfc6f60379179a
ep_bytes: e8f30b0000e968feffff8b4df464890d
timestamp: 2021-02-15 01:28:43

Version Info:

CompanyName: Adobe Systems Inc.
FileDescription: Adobe Create PDF plug-in listener for Chrome
FileVersion: 21.1.20138.422477
LegalCopyright: Copyright 1984-2021 Adobe Systems Incorporated
OriginalFilename: WCChromeNativeMessagingHost.exe
ProductName: Adobe Create PDF
ProductVersion: 21.1.20138.422477
Translation: 0x0409 0x04b0

Malware.AI.2616525052 also known as:

BkavW32.AIDetectMalware
LionicVirus.Win32.Senoval.n!c
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Lazy.386542
FireEyeGeneric.mg.82b0af1b627d1db4
SkyhighBehavesLike.Win32.Generic.gc
ALYacGen:Variant.Lazy.386542
MalwarebytesMalware.AI.2616525052
VIPREGen:Variant.Lazy.386542
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 005ab4bf1 )
BitDefenderGen:Variant.Lazy.386542
K7GWTrojan ( 005ab4bf1 )
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Patched.NKM
CynetMalicious (score: 100)
KasperskyVirus.Win32.Senoval.a
AlibabaTrojan:Win32/Senoval.6008a0a1
NANO-AntivirusVirus.Win32.Gen-Crypt.ccnc
RisingTrojan.Generic@AI.100 (RDML:J5nytgbGvLefvUr5yqxStQ)
SophosW32/Patched-CE
DrWebWin32.Beetle.2
ZillyaTrojan.Patched.Win32.176630
TrendMicroTROJ_GEN.R002C0DJ623
Trapminemalicious.moderate.ml.score
EmsisoftGen:Variant.Lazy.386542 (B)
IkarusTrojan.Win32.Patched
JiangminTrojan.Gen.byg
VaristW32/Patched.GQ1.gen!Eldorado
Antiy-AVLTrojan/Win32.Patched
MicrosoftTrojan:Win32/Doina.RPX!MTB
ArcabitTrojan.Lazy.D5E5EE
ZoneAlarmVirus.Win32.Senoval.a
GDataWin32.Trojan.PSE.1088MD3
GoogleDetected
AhnLab-V3Trojan/Win.KP.C5481370
McAfeeGenericRXEB-KP!82B0AF1B627D
MAXmalware (ai score=89)
DeepInstinctMALICIOUS
VBA32BScope.Trojan.Meterpreter
Cylanceunsafe
PandaTrj/Chgt.AC
TrendMicro-HouseCallTROJ_GEN.R002C0DJ623
TencentTrojan.Win32.Pathced_ya.16001052
SentinelOneStatic AI – Suspicious PE
MaxSecureTrojan.Malware.102517524.susgen
FortinetW32/Patched.IP!tr
AVGWin32:Patched-AWW [Trj]
AvastWin32:Patched-AWW [Trj]
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Malware.AI.2616525052?

Malware.AI.2616525052 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment