Malware.AI.673231264 (file analysis)

The Malware.AI.673231264 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Malware.AI.673231264 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• CAPE extracted potentially suspicious content
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Anomalous binary characteristics

How to determine Malware.AI.673231264?

File Info:
name: 8FC1DBD288248B485548.mlw
path: /opt/CAPEv2/storage/binaries/f2fd5fb4fa816862a2a147415959ca78a5d710412616807fa1b3add60320accd
crc32: FA4AF599
md5: 8fc1dbd288248b4855485788869d928e
sha1: 2a687a77e97a9daf70f9fbeac2309c644670d914
sha256: f2fd5fb4fa816862a2a147415959ca78a5d710412616807fa1b3add60320accd
sha512: 2b0b6b873272835a73197ebdedf2c22aef2b8b07a89add8068380c5d75547f76c8ea897e99d6e34a1fb9090d2c01040aa97b25492ce089d799132443f0a3648f
ssdeep: 24576:YGNIqOZOnb3FnTyGd++++++++++++++++++++++++++++++++++++++++9+++++d:NNIlZmT9d++++++++++++++++++++++O
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15835F1207582C072E78201B59CAEDB7D457EBD680B2959C3FBC43D5A6DB12D1FA3A342
sha3_384: 36f273b0e9e0e9d3b157bd11825f6fab8e128a9b86e6d1afe5a123999ea74af9f2a7e5f1071c5720011e357584ab9019
ep_bytes: e89eb50000e979feffff8bff558bec8b
timestamp: 2014-07-07 09:56:26

Version Info:
Comments: Alpha
CompanyName: 爱奇艺
FileDescription: 爱奇艺网络数据传输组件
FileVersion: 4, 0, 0, 59
InternalName: PPSKernel
LegalCopyright: Copyright (C) 2014 爱奇艺 All Rights Reserved
OriginalFilename: PPSKernel.exe
ProductName: 爱奇艺网络数据传输组件
ProductVersion: 4, 0, 0, 59
Translation: 0x0804 0x04b0

Malware.AI.673231264 also known as:

How to remove Malware.AI.673231264?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.