Malware

Malware.AI.3771715820 removal tips

Malware Removal

The Malware.AI.3771715820 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.3771715820 virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Guard pages use detected – possible anti-debugging.
  • Dynamic (imported) function loading detected
  • Unconventionial language used in binary resources: Korean
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Queries information on disks, possibly for anti-virtualization
  • Created a process from a suspicious location
  • Installs itself for autorun at Windows startup
  • Attempted to write directly to a physical drive
  • Uses suspicious command line tools or Windows utilities

How to determine Malware.AI.3771715820?


File Info:

name: 5EA63B5A4E6B108880BE.mlw
path: /opt/CAPEv2/storage/binaries/47cfaeef3d426d51661445f9a28eab8cef57a531d9cbf7162554d3de150a2938
crc32: F1440103
md5: 5ea63b5a4e6b108880be13e4d3482c83
sha1: a5b808bb660ef588e536666eca5cd0259ad937c3
sha256: 47cfaeef3d426d51661445f9a28eab8cef57a531d9cbf7162554d3de150a2938
sha512: a350d0fae3c1402c4e8ba0d9de2a6095ddb0076a3674edfb780c4db2d67502af0ec06a9f2e052690a32e71b87d4aec031c7706201ef880b0c3f0410eee75c0e0
ssdeep: 768:5E4sOGo21c491pHKeMSMp/WvmktNZU9QZU9m7B6Q:58H1T1oeM+PtNzZ7B6
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E32429126600C46AF3590B718A85F9F04A5A9D3C8BE4E5CFE578BD3A79721C31A3724F
sha3_384: e255553a3a9b8d25dc21da2bd2c88d4917e5213f95c477f9b54b1cbd2d88d0a4cd256c92ac389ba834fc81bc40c136d3
ep_bytes: e9d7090000e985780000e9fe780000e9
timestamp: 2012-07-27 04:34:49

Version Info:

CompanyName: gffgajkup
FileDescription: gffgajkup
FileVersion: 1, 0, 0, 941
InternalName: gffgajkup
LegalCopyright: Copyright (c)
OriginalFilename: gffgajkup.exe
ProductName: gffgajkup
ProductVersion: 1, 0, 0, 941
Translation: 0x0412 0x04b0

Malware.AI.3771715820 also known as:

BkavW32.AIDetect.malware2
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Symmi.6600
FireEyeGeneric.mg.5ea63b5a4e6b1088
ALYacGen:Variant.Symmi.6600
CylanceUnsafe
ZillyaTrojan.KillProc.Win32.7761
SangforTrojan.Win32.KillProc.8
K7AntiVirusTrojan ( 003c84a11 )
AlibabaTrojan:Win32/KillProc.16df4d49
K7GWTrojan ( 003c84a11 )
Cybereasonmalicious.a4e6b1
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/KillProc.NBK
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Trojan.Dapato-963
KasperskyVHO:Trojan-Dropper.Win32.Dapato.gen
BitDefenderGen:Variant.Symmi.6600
NANO-AntivirusTrojan.Win32.Dapato.wlihg
AvastWin32:Trojan-gen
RisingTrojan.Generic@ML.98 (RDML:cgmHSid9X6tvawUu6/z0gQ)
Ad-AwareGen:Variant.Symmi.6600
SophosMal/Generic-S
DrWebTrojan.Siggen7.31098
VIPRETrojan.Win32.Generic!BT
TrendMicroTROJ_GEN.R002C0PLA21
McAfee-GW-EditionGenericR-CVC!5EA63B5A4E6B
EmsisoftGen:Variant.Symmi.6600 (B)
SentinelOneStatic AI – Malicious PE
GDataGen:Variant.Symmi.6600
JiangminTrojanDropper.Dapato.kdg
AviraHEUR/AGEN.1127250
Antiy-AVLTrojan/Generic.ASMalwS.96693
KingsoftWin32.Troj.Generic_a.a.(kcloud)
ViRobotTrojan.Win32.Z.Dapato.217600
MicrosoftTrojan:Win32/Wacatac.B!ml
CynetMalicious (score: 100)
McAfeeGenericR-CVC!5EA63B5A4E6B
MAXmalware (ai score=100)
VBA32BScope.Backdoor.Poison
MalwarebytesMalware.AI.3771715820
TrendMicro-HouseCallTROJ_GEN.R002C0PLA21
TencentWin32.Trojan.Symmi1.Szvq
YandexTrojan.GenAsa!Vd8LEAy17b0
MaxSecureTrojan.Malware.12210707.susgen
FortinetW32/KillProc.NBK!tr
BitDefenderThetaGen:NN.ZexaF.34084.ny3@aSfPLKiG
AVGWin32:Trojan-gen
PandaTrj/CI.A
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Malware.AI.3771715820?

Malware.AI.3771715820 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment