Malware

Malware.AI.4109366275 (file analysis)

Malware Removal

The Malware.AI.4109366275 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.4109366275 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • Unconventionial language used in binary resources: Arabic (Syria)
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Anomalous binary characteristics

How to determine Malware.AI.4109366275?


File Info:

name: E568D0F5DDD6E77607D5.mlw
path: /opt/CAPEv2/storage/binaries/86c17656cdb508a39af3c70a126877c763d4b33346a31eec3aadedfbd71bacfb
crc32: AF2AD91D
md5: e568d0f5ddd6e77607d54c16c0300517
sha1: d0cb03a659d9067e7ba7c1af9b374e86971eb025
sha256: 86c17656cdb508a39af3c70a126877c763d4b33346a31eec3aadedfbd71bacfb
sha512: 300ef539eeb612ec00ec4e371a42ea48aa914abb1f4af8cb42bbd33b6e02b28764ad2a24d0bed9454ca2e3994c2e2635ccde115be163100a056d404c91ef5679
ssdeep: 12288:OzTuN9abJauyXTvB+R8WkFggKDTIzYlJ24Fn4tywi:OzCN9abWvBH9F+MYlJ24C7
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A6D46C2077F4259CF4B75F3438B4AA54FA3A7E307E26E22D399B108D0978B528670767
sha3_384: 6c58701dc4e9aa9ddacc56e182a16b69773f3fd422d081933bc13c32e82078f7f4aa0b8444ee326365cf1344a5be973c
ep_bytes: 535751bb18000000648b3b03db01fb8b
timestamp: 2022-03-07 01:11:37

Version Info:

CompanyName: Microsoft Corporation
FileDescription: Microsoft Edge Update
FileVersion: 1.3.155.85
InternalName: Microsoft Edge Update
LegalCopyright: Copyright Microsoft Corporation
OriginalFilename: msedgeupdate.dll
ProductName: Microsoft Edge Update
ProductVersion: 1.3.155.85
LanguageId: sr-Cyrl-RS
UpstreamVersion: 1.3.99.0
Translation: 0x0409 0x04b0

Malware.AI.4109366275 also known as:

BkavW32.AIDetect.malware2
LionicVirus.Win32.Expiro.n!c
MicroWorld-eScanWin32.Expiro.Gen.6
FireEyeGeneric.mg.e568d0f5ddd6e776
CylanceUnsafe
SangforVirus.Win32.Expiro.6
K7AntiVirusTrojan ( 0058d3271 )
BitDefenderWin32.Expiro.Gen.6
K7GWTrojan ( 0058d3271 )
CrowdStrikewin/malicious_confidence_100% (W)
VirITWin32.Expiro.CW
CyrenW32/Expiro.AX.gen!Eldorado
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/Expiro.CP
APEXMalicious
AlibabaVirus:Win32/Expiro.9485b5bc
NANO-AntivirusVirus.Win32.Gen.ccmw
RisingVirus.Expiro!8.375 (CLOUD)
Ad-AwareWin32.Expiro.Gen.6
SophosMal/Generic-S
F-SecureMalware.W32/Infector.Gen8
TrendMicroVirus.Win32.EXPIRO.AD
McAfee-GW-EditionBehavesLike.Win32.Generic.hc
EmsisoftWin32.Expiro.Gen.6 (B)
IkarusVirus.Win32.Expiro
JiangminTrojan.Bingoml.esh
AviraW32/Infector.Gen8
MAXmalware (ai score=85)
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
GDataWin32.Expiro.Gen.6
CynetMalicious (score: 100)
BitDefenderThetaAI:Packer.3D46DB0D1F
ALYacWin32.Expiro.Gen.6
VBA32BScope.Trojan.Wacatac
MalwarebytesMalware.AI.4109366275
TrendMicro-HouseCallVirus.Win32.EXPIRO.AD
TencentVirus.Win32.Expiro.ns
SentinelOneStatic AI – Malicious PE
FortinetW32/Expiro.CP
AVGWin32:Xpirat-C [Inf]
Cybereasonmalicious.5ddd6e
AvastWin32:Xpirat-C [Inf]

How to remove Malware.AI.4109366275?

Malware.AI.4109366275 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment