Malware.AI.4121318528 (file analysis)

The Malware.AI.4121318528 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Malware.AI.4121318528 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• NtSetInformationThread: attempt to hide thread from debugger
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Detects Bitdefender Antivirus through the presence of a library
• Detects the presence of Wine emulator via function name
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location
• CAPE detected the BetaBot malware family
• Checks the CPU name from registry, possibly for anti-virtualization
• Collects information to fingerprint the system
• Anomalous binary characteristics

How to determine Malware.AI.4121318528?

File Info:
name: DD8FBDC96FD080230B1D.mlw
path: /opt/CAPEv2/storage/binaries/33441312c20fbeccffceb522e626aa47366a966c48be537d82d4ecc60858d14c
crc32: 52C84985
md5: dd8fbdc96fd080230b1d230ac2f59cae
sha1: dc474a2f94b79d3c7936a393751b0aad7284362e
sha256: 33441312c20fbeccffceb522e626aa47366a966c48be537d82d4ecc60858d14c
sha512: 7f005e93a19818a7ec91ab7e814c9402aa3866972d784d78287212db924e97da43887e05b2e00766045bc35dc2b6fcf5ad47d24a3c5eeb3d26d366925d3570f0
ssdeep: 6144:mcLPXTA9loLDCyEzvx++SI9lN4yqY+P/7wJpU2fUfm7wVdoB:9fTA9OQp/jd4ygApnRa
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1BE64DFD3219C7032F5A2247C8A27D7508F1E789187A0598F6AC605BB8F74ADD9B2C74B
sha3_384: 5ed6cf028363d462cb16aadc5c519b286544f20b0cd90e0bc99b0bd0806f65729493ea77349e7016a723bfaff5fbf397
ep_bytes: e8a51f0000e989feffff8bff558bec83
timestamp: 2017-05-22 04:55:23

Version Info:
FileVersion: 19, 8, 5, 30
LegalCopyright: Puta xipaya duwubiteye da
ProductVersion: 19, 8, 5, 30
Translation: 0x0409 0x04b0

Malware.AI.4121318528 also known as:

How to remove Malware.AI.4121318528?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.