Malware

Malware.AI.4141103819 malicious file

Malware Removal

The Malware.AI.4141103819 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.4141103819 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Presents an Authenticode digital signature
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Anomalous file deletion behavior detected (10+)
  • Guard pages use detected – possible anti-debugging.
  • Dynamic (imported) function loading detected
  • Performs HTTP requests potentially not found in PCAP.
  • HTTPS urls from behavior.
  • Enumerates running processes
  • Expresses interest in specific running processes
  • Reads data out of its own binary image
  • A process created a hidden window
  • Attempts to modify Internet Explorer’s start page
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • Unconventionial language used in binary resources: Spanish (Chile)
  • The binary likely contains encrypted or compressed data.
  • Removes Security and Maintenance icon from Start menu, Taskbar and notifications
  • Authenticode signature is invalid
  • Behavioural detection: Injection (Process Hollowing)
  • Executed a process and injected code into it, probably while unpacking
  • Behavioural detection: Injection (inter-process)
  • Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
  • Created a process from a suspicious location
  • Steals private information from local Internet browsers
  • Network activity contains more than one unique useragent.
  • Installs itself for autorun at Windows startup
  • Overwrites multiple files with zero bytes (hex 00) indicative of a wiper
  • Attempts to identify installed AV products by installation directory
  • Attempts to modify proxy settings
  • Operates on local firewall’s policies and settings
  • Creates a copy of itself
  • Attempts to disable or modify Explorer Folder Options
  • Attempts to disable or modify the Run command from the Start menu and the New Task (Run) command from Task Manager
  • Attempts to disable System Restore
  • Attempts to disable UAC
  • The sample wrote data to the system hosts file.
  • Attempts to modify or disable Security Center warnings
  • Attempts to modify UAC prompt behavior
  • Modifies Image File Execution Options, indicative of process injection or persistence
  • Anomalous binary characteristics
  • Attempts to modify Explorer settings to prevent file extensions from being displayed
  • Attempts to modify Explorer settings to prevent hidden files from being displayed
  • Attempts to modify user notification settings

How to determine Malware.AI.4141103819?


File Info:

name: 8F6C8AC78E280287DFFB.mlw
path: /opt/CAPEv2/storage/binaries/42f6ac740c70c537cc0f4b6e6995fed8f5cacdab8a3c1688b65a5621c5bb04ba
crc32: 947549B3
md5: 8f6c8ac78e280287dffbe9592eec1b34
sha1: 64c9514d104d0634d6dd54dd2010a2f29e1e543b
sha256: 42f6ac740c70c537cc0f4b6e6995fed8f5cacdab8a3c1688b65a5621c5bb04ba
sha512: af7cab2d0f859cecc23908199e93b2222b92c4e361ac79a93c6fb93159b3bed5885ef1892716e44b72318aec674af6b9f4dbeee7105b79c84c8b94ba3757871f
ssdeep: 1536:r0HjHkAScR9hXkYQB3k69JusuqdGiA2MvZut+pN5ULmRPYAVPlVDKmQ9x6cps:rWEcWY9HVX2MvktynULsPemGx6
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10035025A5C2C7932EAC654B2E0DBC153DC7BA47CDEFBA0DB0CA102D096952F7192A11F
sha3_384: ce29d4e15827ffafa02ceba981894bb22dc00d5fd4ef6fb9f33f9931d9079701051a6266133c1a9271767872e1aeeeda
ep_bytes: 558becb804100000e873020000a10030
timestamp: 2013-06-09 15:24:29

Version Info:

0: [No Data]

Malware.AI.4141103819 also known as:

BkavW32.AIDetect.malware1
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Cerbu.82817
FireEyeGeneric.mg.8f6c8ac78e280287
CAT-QuickHealWorm.Esfury.A
McAfeeW32/Worm-FNH!8F6C8AC78E28
CylanceUnsafe
CrowdStrikewin/malicious_confidence_100% (D)
BitDefenderThetaAI:Packer.0671660E1E
VirITTrojan.Win32.X-Heur.NQ
CyrenW32/Esfury.C.gen!Eldorado
tehtrisGeneric.Malware
ESET-NOD32Win32/AutoRun.VB.XW
BaiduWin32.Trojan-Dropper.Injector.g
ClamAVWin.Trojan.Generic-9763885-0
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGen:Variant.Cerbu.82817
NANO-AntivirusTrojan.Win32.AntiAV.cqkxpe
AvastWin32:FakeAV-ESP [Trj]
RisingWorm.Vobfus!8.10E (RDMK:cmRtazo7ddvemlzp2wal2MjT/r9r)
Ad-AwareGen:Variant.Cerbu.82817
EmsisoftGen:Variant.Cerbu.82817 (B)
ComodoTrojWare.Win32.Injector.AQJ@4zto9a
DrWebWin32.HLLW.Siggen.4811
ZillyaTrojan.AntiAV.Win32.5678
McAfee-GW-EditionW32/Worm-FNH!8F6C8AC78E28
SentinelOneStatic AI – Malicious PE
Trapminemalicious.high.ml.score
SophosML/PE-A + Troj/Inject-BOX
APEXMalicious
JiangminTrojan/Onescan.ma
WebrootW32.Trojan.Gen
AviraTR/Dropper.Gen
MAXmalware (ai score=82)
MicrosoftTrojan:Win32/Wacatac.B!ml
SUPERAntiSpywareTrojan.Agent/Gen-AutoRun
GDataGen:Variant.Cerbu.82817
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.Agent.R72946
VBA32Worm.VB.Autorun.gen
ALYacGen:Variant.Cerbu.82817
MalwarebytesMalware.AI.4141103819
TencentMalware.Win32.Gencirc.10b59885
YandexWorm.Agent!8zYvCQOZNvQ
IkarusWorm.Win32.Esfury
FortinetW32/Generic.AC.753!tr
AVGWin32:FakeAV-ESP [Trj]
Cybereasonmalicious.78e280
PandaTrj/Genetic.gen

How to remove Malware.AI.4141103819?

Malware.AI.4141103819 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment