Malware

Malware.AI.4087395032 (file analysis)

Malware Removal

The Malware.AI.4087395032 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.4087395032 virus can do?

  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Anomalous binary characteristics
  • Binary compilation timestomping detected

How to determine Malware.AI.4087395032?


File Info:

name: BFD9441B109241B0B65D.mlw
path: /opt/CAPEv2/storage/binaries/a3e4a092ff21a60d98393fb3f8e77993f29d07c419e88effae16d31fb3e97147
crc32: CCFE9C85
md5: bfd9441b109241b0b65d8491d9679d61
sha1: 8f5a89d5bad96e6b909e9ac16c910542b47d5420
sha256: a3e4a092ff21a60d98393fb3f8e77993f29d07c419e88effae16d31fb3e97147
sha512: 3d51e56606cf1904e8ebbc1b15254e0a258ddfbf9538a3cfc2aec7daf6889ca14f16e65c14941ec2a484085658629c0a685a6c842a5ce354ca41013a62e866fe
ssdeep: 24576:HgcyGLbMMHMMMvMMZMMMKzb6XmMMMiMMMz8JMMHMMM6MMZMMMeXNMMzMMMUMMVM4:HjMMHMMMvMMZMMMlmMMMiMMMYJMMHMMN
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T1A6558D22BB88D851F86B77728A328B650652FCF86C01C70F3195772E3D733625A76B25
sha3_384: b52fbb93773608f91d24838bf58f88b26a297ba4b0ba1bf71b985d6f64ecd3e7dbd04b5fbcd10f75dbaa1abcada5a793
ep_bytes: 90554889e55648ffce57415441554156
timestamp: 2076-12-29 00:53:36

Version Info:

CompanyName: Microsoft Corporation
FileDescription: Internet Explorer
FileVersion: 11.00.17134.1
InternalName: iexplore
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: IEXPLORE.EXE
ProductName: Internet Explorer
ProductVersion: 11.00.17134.1
Translation: 0x0409 0x04b0

Malware.AI.4087395032 also known as:

Elasticmalicious (high confidence)
DrWebWin64.Expiro.108
MicroWorld-eScanWin64.Expiro.Gen.3
FireEyeGeneric.mg.bfd9441b109241b0
ALYacWin64.Expiro.Gen.3
CylanceUnsafe
ZillyaVirus.Expiro.Win64.34
SangforTrojan.Win32.Save.a
K7AntiVirusVirus ( 0040f8071 )
K7GWVirus ( 0040f8071 )
Cybereasonmalicious.b10924
CyrenW64/Expiro.D!gen
SymantecW64.Xpiro.F
ESET-NOD32Win64/Expiro.AG
TrendMicro-HouseCallPE64_EXPIRO.AR
ClamAVWin.Virus.Expiro-6813490-0
KasperskyVirus.Win64.Expiro.g
BitDefenderWin64.Expiro.Gen.3
NANO-AntivirusVirus.Win64.Expiro.dtfhve
AvastWin32:Expiro-DD
RisingVirus.Expiro!1.A140 (CLASSIC)
Ad-AwareWin64.Expiro.Gen.3
SophosML/PE-A + W64/Expiro-S
BaiduWin64.Virus.Expiro.r
VIPREVirus.Win64.Expiro.gen.a (v)
TrendMicroPE64_EXPIRO.AR
McAfee-GW-EditionW64/Expiro.a
SentinelOneStatic AI – Malicious PE
EmsisoftWin64.Expiro.Gen.3 (B)
IkarusVirus.Win32.Expiro
AviraW64/Expiro.AF
Antiy-AVLTrojan/Generic.ASVirus.311
MicrosoftTrojan:Win32/Wacatac.B!ml
GDataWin64.Expiro.Gen.3
CynetMalicious (score: 100)
AhnLab-V3Win64/Expiro2.Gen
Acronissuspicious
McAfeeW64/Expiro.a
TACHYONVirus/W64.Expiro.C
MalwarebytesMalware.AI.4087395032
APEXMalicious
TencentVirus.Win64.Expiro.ad
MAXmalware (ai score=87)
FortinetW64/Expiro.Q
AVGWin32:Expiro-DD
PandaW32/Expiro.gen
CrowdStrikewin/malicious_confidence_100% (D)
MaxSecurevirus.win64.expiro.gen

How to remove Malware.AI.4087395032?

Malware.AI.4087395032 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment