About “Malware.AI.4005879177” infection

The Malware.AI.4005879177 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Malware.AI.4005879177 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Performs HTTP requests potentially not found in PCAP.
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Attempts to modify proxy settings
• Anomalous binary characteristics

How to determine Malware.AI.4005879177?

File Info:
name: 668DB2DEF2D3C65EB8F5.mlw
path: /opt/CAPEv2/storage/binaries/b2e5c78a0c2c54ff523416ef63a4a64fcbf74efbbe8571527f558ee31cfe05c9
crc32: 938B9FCE
md5: 668db2def2d3c65eb8f52876bc1e1ab3
sha1: 0d60989fffc90621c8a3334914fa6e8d4dc62056
sha256: b2e5c78a0c2c54ff523416ef63a4a64fcbf74efbbe8571527f558ee31cfe05c9
sha512: daaed68648927115aa471eb07768566af3f6d085b81da86e312cfd300daf29157f18e3fb77363ff877b0851f61acf172a6d947025c67853ef8a025154f7c5162
ssdeep: 49152:VIxzLHIIaGZ+EJTkQiona2Lxxa5+lSWjOkG3Q47UuWKk/FTs:dIaW+YTkQiona2LbplSWjwg4IuWKk/hs
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T189759E303AA1D4B6C23B3631969D92BAB7B9D5304D35064766E18E3C6F34683993C36F
sha3_384: cee58296ee4e74fd2ea7c8d4f0fa0c8328c403bedf6098147c3055bae3efeacab23d3959d66c16c294ecb1e4e9ae98f2
ep_bytes: e8076c0000e989feffff3b0d80855600
timestamp: 2014-09-26 08:16:55

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Windows Media Player
FileVersion: 12.0.7601.18150 (win7sp1_gdr.130509-1534)
InternalName: wmplayer.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: wmplayer.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 12.0.7601.18150
Translation: 0x0409 0x04b0

Malware.AI.4005879177 also known as:

How to remove Malware.AI.4005879177?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.