Malware

Malware.AI.3843757946 (file analysis)

Malware Removal

The Malware.AI.3843757946 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.3843757946 virus can do?

  • Creates RWX memory
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Anomalous binary characteristics
  • Binary compilation timestomping detected

How to determine Malware.AI.3843757946?


File Info:

name: F31F3D560C3C945A648E.mlw
path: /opt/CAPEv2/storage/binaries/0685bb2f0c39cb9cc6cc550a4b8048133edf46d5db2468b6a1cfa46dfe4f5d0d
crc32: 65F732BD
md5: f31f3d560c3c945a648e6c7deafba074
sha1: 6f0fa0e68f292f3928c0e1f2ede1f87919b61a7b
sha256: 0685bb2f0c39cb9cc6cc550a4b8048133edf46d5db2468b6a1cfa46dfe4f5d0d
sha512: 345bee82945b621198c6e56fd5e7720b4dab2676a26b41ea4b7b7a677a46908bfdc7b4305bfd5a8ce81f7b8211795125ede14723ae910daebc09ee60bbe2f7b9
ssdeep: 49152:llOVDTtQY6SoNtaUJ6kUnHpclbwbWAaJiwmqTjconNargK:qqJUHxqPFqr
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T152857B03A29D31D8D0E9C278C74595F2EA61B847172BB9EF0650B21F1F6BAE05B397C1
sha3_384: 83ded830d15238841a346deb61b869411235ce20bb3fde94fdc578c5349e721d25e2260fe6ff515f1e1ab2a832a97859
ep_bytes: 475150455243b96000000065498b0145
timestamp: 2022-01-26 12:34:27

Version Info:

CompanyName: Google LLC
FileDescription: Google Chrome
FileVersion: 92.0.4515.131
InternalName: elevation_service_exe
LegalCopyright: Copyright 2021 Google LLC. All rights reserved.
OriginalFilename: elevation_service.exe
ProductName: Google Chrome
ProductVersion: 92.0.4515.131
CompanyShortName: Google
ProductShortName: Chrome
LastChange: 6b8d6c56ce21e38a72f7c4becb5abc1fa5134f29-refs/branch-heads/4515@#1933
Official Build: 1
Translation: 0x0409 0x04b0

Malware.AI.3843757946 also known as:

Elasticmalicious (high confidence)
DrWebWin64.Expiro.132
MicroWorld-eScanWin64.Expiro.Gen.6
FireEyeGeneric.mg.f31f3d560c3c945a
ALYacWin64.Expiro.Gen.6
MalwarebytesMalware.AI.3843757946
K7AntiVirusVirus ( 00535e4a1 )
K7GWVirus ( 00535e4a1 )
CyrenW64/Expiro.AH.gen!Eldorado
ESET-NOD32a variant of Win64/Expiro.CO
TrendMicro-HouseCallVirus.Win64.EXPIRO.MR
KasperskyHEUR:Virus.Win64.Expiro.gen
BitDefenderWin64.Expiro.Gen.6
NANO-AntivirusVirus.Win64.Expiro.clnvwd
AvastWin64:Xpirat [Inf]
Ad-AwareWin64.Expiro.Gen.6
EmsisoftWin64.Expiro.Gen.6 (B)
TrendMicroVirus.Win64.EXPIRO.MR
SophosML/PE-A + W64/Expiro-AX
SentinelOneStatic AI – Suspicious PE
JiangminTrojan.Bingoml.akq
AviraW64/Infector.Gen
MAXmalware (ai score=84)
Antiy-AVLTrojan/Generic.ASVirus.30B
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
GDataWin64.Expiro.Gen.6
CynetMalicious (score: 100)
Acronissuspicious
APEXMalicious
IkarusVirus.Win64.Expiro
MaxSecurevirus.win64.expiro.gen
FortinetW64/Expiro.BS
AVGWin64:Xpirat [Inf]

How to remove Malware.AI.3843757946?

Malware.AI.3843757946 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment