MemScan:Worm.Bundpil.B (file analysis)

The MemScan:Worm.Bundpil.B is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MemScan:Worm.Bundpil.B virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine MemScan:Worm.Bundpil.B?


File Info:
name: 4BA340BEB4C264DD9AE4.mlw
path: /opt/CAPEv2/storage/binaries/05bf703b10bb0ce13fb1b82819bde59cbe3d41a1754c525934cd97eee5f59993
crc32: 4EEE8719
md5: 4ba340beb4c264dd9ae49c4559c084c4
sha1: c8244ff82664d639e2ef76ce5bb9ba9ba3052e2a
sha256: 05bf703b10bb0ce13fb1b82819bde59cbe3d41a1754c525934cd97eee5f59993
sha512: 814bbbbcaf87c5f8b34573ed1bf319af21fa986a8b9f2f5390238b3a400c880876e53d2542c9e0d839118ac4f8403e72e4b8ba27013144d059ea9cdfd3ae63da
ssdeep: 98304:crrH+0YbxDdKxMS+bP2xCa+jdJL4aOnVvQ5bOyvJY/htb9Rc:c3BY9Jn+xc3L4a8RQ5bO3//Pc
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T156563335D926B379CAF35ABD8DFBA68A574D7324A3CC584F110D9288D301B2CA7190E7
sha3_384: 4ac3316b61bd0975d55911e136c693ad592cbc8dcb1c705239ab5b656c6487bfd9890d216dc273b61d4f64f1031d734d
ep_bytes: 558bec538b5d08568b750c578b7d1085
timestamp: 2014-05-06 13:06:48

Version Info:
CompanyName: NETCAFE.24H.COM.VN
FileDescription: Family
FileVersion: 36, 95, 250, 137
InternalName: Largish
LegalCopyright: Copyright © 2011
OriginalFilename: Inexperience.exe
ProductName: Integrate Linnet
ProductVersion: 132, 160, 212, 219

MemScan:Worm.Bundpil.B also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	MemScan:Worm.Bundpil.B
ClamAV	Win.Worm.Gamarue-9946713-0
FireEye	Generic.mg.4ba340beb4c264dd
CAT-QuickHeal	Trojan.Lodbak.WR5
Skyhigh	BehavesLike.Win32.Dropper.vh
McAfee	Trojan-FHRE!4BA340BEB4C2
VIPRE	MemScan:Worm.Bundpil.B
Sangfor	Suspicious.Win32.Save.ins
CrowdStrike	win/malicious_confidence_100% (D)
K7GW	Trojan ( 0055dd191 )
K7AntiVirus	Trojan ( 0055dd191 )
Symantec	Packed.Dromedan!gen23
ESET-NOD32	a variant of Win32/Kryptik.GSIM
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Worm.Win32.Bundpil.axv
BitDefender	MemScan:Worm.Bundpil.B
NANO-Antivirus	Trojan.Win32.Coantor.eboxwo
Avast	Win32:WormX-gen [Wrm]
Tencent	Malware.Win32.Gencirc.10b26e23
Emsisoft	MemScan:Worm.Bundpil.B (B)
F-Secure	Trojan.TR/Taranis.2868
DrWeb	Trojan.Bundpil.8
Zillya	Worm.Bundpil.Win32.126726
TrendMicro	WORM_GAMARUE.SMQB
Trapmine	malicious.high.ml.score
Sophos	ML/PE-A
Ikarus	Trojan.Win32.Crypt
GData	Win32.Worm.Gamarue.AJ
Jiangmin	Worm.Bundpil.aa
Webroot	W32.Mogoogwi.Gen
Google	Detected
Avira	TR/Taranis.2868
Antiy-AVL	Worm/Win32.Bundpil
Arcabit	Worm.Bundpil.B
ZoneAlarm	Worm.Win32.Bundpil.axv
Microsoft	Worm:Win32/Gamarue
Varist	W32/S-72007166!Eldorado
AhnLab-V3	Worm/Win32.Gamarue.R287947
VBA32	BScope.Trojan.Waldek
MAX	malware (ai score=85)
Cylance	unsafe
Panda	Trj/Gamarue.A
TrendMicro-HouseCall	WORM_GAMARUE.SMQB
Rising	Worm.Gamarue!8.13B (TFE:5:GoWjFBTOZwQ)
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Agent.F30!tr
BitDefenderTheta	Gen:NN.ZedlaF.36744.@x@@aCAZjwpi
AVG	Win32:WormX-gen [Wrm]
DeepInstinct	MALICIOUS

How to remove MemScan:Worm.Bundpil.B?

MemScan:Worm.Bundpil.B removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X