Malware.AI.640460820 (file analysis)

The Malware.AI.640460820 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Malware.AI.640460820 virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Malware.AI.640460820?


File Info:
name: FBB57DA5C73ACEED9A7E.mlw
path: /opt/CAPEv2/storage/binaries/47050494e2553142c73324a14d393ddf87dc07824dab20d47768ce7800de3d08
crc32: 1AD968B4
md5: fbb57da5c73aceed9a7efa01e25f967e
sha1: ecb1fc1d580b70f4444fb37b3850b8e0d46522f6
sha256: 47050494e2553142c73324a14d393ddf87dc07824dab20d47768ce7800de3d08
sha512: b691ff9fd9dd2804d7b9a83f48fe8670fb2ea23cccbec8abaf705fd70aa67b5aafdf7d4dbe5a7262dd86e9cf7b0d4386c77616eff6de4083fc09218311a6231b
ssdeep: 98304:LjvyjvajvkjvUQ05Pkv6Ynt8oBNxjvdjvokv6Ynt8oB:Lj6jSjMj855dloVjFjylo
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E0F518033F48EB96C03A5B79C4A1D3F59355AD05E722C64F19A47EAAFCB15E22F422C4
sha3_384: 3d8b887747d4cbfafcd24677eb228d5e9f396b9778df7e4cf6543be66b900358088a6cc41c63e16a5a851fe8523bec7f
ep_bytes: ff250020400000000000000000000000
timestamp: 2018-08-27 06:44:46

Version Info:
Translation: 0x0000 0x04b0
FileDescription: InstalatorMultiLanguage
FileVersion: 1.0.0.0
InternalName: F1 2016 - InstallShield Wizard.exe
LegalCopyright: Copyright ©  2018
OriginalFilename: F1 2016 - InstallShield Wizard.exe
ProductName: InstalatorMultiLanguage
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Malware.AI.640460820 also known as:

Lionic	Trojan.Win32.Bulz.4!c
DrWeb	Trojan.Surveyer.205
MicroWorld-eScan	Gen:Variant.Bulz.172204
FireEye	Gen:Variant.Bulz.172204
McAfee	GenericRXOY-DR!FBB57DA5C73A
Alibaba	Trojan:MSIL/Surveyer.bc006da6
K7GW	Trojan ( 00546e2f1 )
K7AntiVirus	Trojan ( 00546e2f1 )
BitDefenderTheta	Gen:NN.ZemsilF.34294.ut0@a48K@3g
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Surveyer.GI
TrendMicro-HouseCall	TROJ_GEN.R002C0OKQ21
ClamAV	Win.Packed.Surveyer-6873462-0
BitDefender	Gen:Variant.Bulz.172204
NANO-Antivirus	Trojan.Win32.Surveyer.fmtbvm
Avast	Win32:Trojan-gen
Ad-Aware	Gen:Variant.Bulz.172204
Comodo	Malware@#igq7mz2rly12
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0OKQ21
McAfee-GW-Edition	GenericRXOY-DR!FBB57DA5C73A
Emsisoft	Gen:Variant.Bulz.172204 (B)
SentinelOne	Static AI – Suspicious PE
Avira	HEUR/AGEN.1109701
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Gen:Variant.Bulz.172204
ALYac	Gen:Variant.Bulz.172204
Malwarebytes	Malware.AI.640460820
APEX	Malicious
Ikarus	Trojan.MSIL.Surveyer
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Surveyer.GI!tr
AVG	Win32:Trojan-gen

How to remove Malware.AI.640460820?

Malware.AI.640460820 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X