Malware

What is “Malware.AI.3703440112”?

Malware Removal

The Malware.AI.3703440112 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.3703440112 virus can do?

  • Sample contains Overlay data
  • Reads data out of its own binary image
  • The binary contains an unknown PE section name indicative of packing
  • Executable file is packed/obfuscated with ASPack
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Harvests cookies for information gathering
  • Anomalous binary characteristics
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Malware.AI.3703440112?


File Info:

name: 916B5299B307E8E43025.mlw
path: /opt/CAPEv2/storage/binaries/2cabc935fa87a424952f4ddecbc67cd07e7b2be53ec2210867091b2c72ef0c4b
crc32: EA0952DF
md5: 916b5299b307e8e430250ff0a9f87a75
sha1: 0f06a7338f0b619c9a425038773c7a5cf274a7e0
sha256: 2cabc935fa87a424952f4ddecbc67cd07e7b2be53ec2210867091b2c72ef0c4b
sha512: 2e740185ed07430dc91a8919ea7d547a8235baa619c4ee13b708786cc1bc75c68a5a84a5552706e5d46b5c0732a0709c5e41cc5b2af4ff091ab5a6975339eadf
ssdeep: 12288:5L97TcXZUIF+IYt8rSlfEpk++DmVMDdqHgNrcpxNNqrFA8:5B7wXZUICt8rS9EpTCygyv2Fp
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T130A423E3ADF6018EF4E392F326D939D57728508FA637ABA37A053115FE71904C21835A
sha3_384: c2db5f1702ac1c05dbc2f1001fd2095d15614580bf499a067f3be71b0baf4bb8f85a7505daf713c0a3267c08731ccc63
ep_bytes: 60e872050000eb3387db900010490008
timestamp: 1992-06-19 22:22:17

Version Info:

CompanyName: Oakley Data Services
FileDescription: WebCompiler
FileVersion: 1.35.0.2
InternalName: WebCompiler
LegalCopyright: © 1998 Oakley Data Services
LegalTrademarks: WebCompiler is a Trademark of Oakley Data Services
OriginalFilename:
ProductName: WebCompiler
ProductVersion: 1.35
Comments:
Translation: 0x0809 0x04e4

Malware.AI.3703440112 also known as:

BkavW32.AIDetectMalware
LionicTrojan.Win32.Generic.4!c
Elasticmalicious (high confidence)
ClamAVWin.Trojan.Tufik-12
FireEyeGeneric.mg.916b5299b307e8e4
McAfeeArtemis!916B5299B307
MalwarebytesMalware.AI.3703440112
SangforTrojan.Win32.Agent.Vmfm
AlibabaRootkit:Win32/Vetor.2000864b
VirITTrojan.Win32.Agent.BCMD
CyrenW32/A-237cbbf6!Eldorado
SymantecML.Attribute.HighConfidence
APEXMalicious
CynetMalicious (score: 100)
SUPERAntiSpywareTrojan.Agent/Gen-Symmi
AvastWin32:Malware-gen
McAfee-GW-EditionBehavesLike.Win32.Ramnit.gc
Trapminemalicious.moderate.ml.score
SophosGeneric ML PUA (PUA)
SentinelOneStatic AI – Suspicious PE
WebrootW32.Trojan.Genkdv
Antiy-AVLTrojan/Win32.SGeneric
GoogleDetected
VBA32Rootkit.Agent
Cylanceunsafe
TrendMicro-HouseCallTROJ_GEN.R002H0CCE23
IkarusW32.Vetor
FortinetW32/Agent.BBF6!tr
AVGWin32:Malware-gen
DeepInstinctMALICIOUS
CrowdStrikewin/grayware_confidence_60% (D)

How to remove Malware.AI.3703440112?

Malware.AI.3703440112 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment