What is “Malware.Heuristic.2040”?

The Malware.Heuristic.2040 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Malware.Heuristic.2040 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial binary language: Portuguese (Brazil)
• Unconventionial language used in binary resources: Portuguese (Brazilian)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities to create a scheduled task
• CAPE detected the shellcode get eip malware family
• Attempts to modify proxy settings
• Creates a copy of itself
• Disables Windows firewall
• Harvests information related to installed mail clients
• Uses suspicious command line tools or Windows utilities
• Yara detections observed in process dumps, payloads or dropped files

How to determine Malware.Heuristic.2040?

File Info:
name: 81942BBD642B3BC09EAA.mlw
path: /opt/CAPEv2/storage/binaries/0d8d07ff56cd7d539c45a8c929e27039ba3f5283f47c87a92e514626ca7abe95
crc32: F7F5082C
md5: 81942bbd642b3bc09eaa963a6954b6d7
sha1: 253902759c6e54d94ea3d8b24f6aab63b98e2ac9
sha256: 0d8d07ff56cd7d539c45a8c929e27039ba3f5283f47c87a92e514626ca7abe95
sha512: d0cd94ea694ef1962ec8c8c169d0948345084dbe6c121b57f9d9fae8cc75175c27759907bb39509cd4376628e9a3aff6d522161108b3ecc2203a8c3798fb28cf
ssdeep: 12288:fvw+Xa2trsdffPUTjiyHZGPwooyBFzlbEe9d:fzb5EfPGiyHZIwofBFz2e9
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T145F4238ACB768557DCEF8DB09C7BD66A3608CCBD48EC158FCD31990ACD4286AD834487
sha3_384: dd9597771ea2bd9ea922400b67a8c5a9722a8ecce23ab918b03f3ca3a9b26f89af080588fe68b4ac61523ef53624e509
ep_bytes: b804e52c135064ff3500000000648925
timestamp: 1992-06-19 22:22:17

Version Info:
CompanyName: Microsoft Corporation
FileDescription: svchost.exe
FileVersion: 1.0.0.131
InternalName: svchost.exe
LegalCopyright: Microsoft
LegalTrademarks: 
OriginalFilename: svchost.exe
ProductName: 
ProductVersion: 1.0.0.0
Comments: 29102007-0045
Translation: 0x0416 0x04e4

Malware.Heuristic.2040 also known as:

How to remove Malware.Heuristic.2040?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.