Malware.AI.4157429402 (file analysis)

The Malware.AI.4157429402 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Malware.AI.4157429402 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Executed a very long command line or script command which may be indicative of chained commands or obfuscation
• Drops a binary and executes it
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• A scripting utility was executed
• Uses PowerShell for copying files
• Uses Windows utilities for basic functionality
• Created a process from a suspicious location
• Creates a hidden or system file

How to determine Malware.AI.4157429402?

File Info:
name: 2FA794D3A27436C70CFD.mlw
path: /opt/CAPEv2/storage/binaries/ae6ba3cb22e7bc819dbce9edba380827c1df48009e9443aa594766b3b77a259e
crc32: 356A8799
md5: 2fa794d3a27436c70cfd69216445219f
sha1: e779524fe1d9d0c81e965060a63526bf4d70dc03
sha256: ae6ba3cb22e7bc819dbce9edba380827c1df48009e9443aa594766b3b77a259e
sha512: a2fc69ca1e87e3f417aae15188e732acb798609638375e41227c66652779fb7116223ab142b0abd59b006b746abfad5798f556ef510227d963e9b4bcaa3f55b0
ssdeep: 12288:ahxp3lZnT9bDEjMs1+nVfx864jD3V7VLOIrOTBccFyj:aJlh9bDEgAQte66DN1OL9nyj
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10EE40243BAD184B2C23255355A39EB15A53CBD200F299A5EF7C83E3DAE311907325FA7
sha3_384: 9489d0526264bcadd840ba4e692b36458150083f8f69f2efa323eb5fa1dd2ef706ab34756b92756d3f66ff313a77d8a8
ep_bytes: e899040000e980feffff3b0db8914300
timestamp: 2016-08-14 19:15:49

Version Info:
0: [No Data]

Malware.AI.4157429402 also known as:

How to remove Malware.AI.4157429402?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.