About “Midie.105641 (B)” infection

The Midie.105641 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Midie.105641 (B) virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Spanish (Ecuador)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location

How to determine Midie.105641 (B)?

File Info:
name: FDE0A8741FA772760974.mlw
path: /opt/CAPEv2/storage/binaries/cfba163df8952076490a69d3baf5ec7628698ccfc5d70f9b7898b1aad87d3757
crc32: 78FBFF2D
md5: fde0a8741fa772760974df3a8c6934b7
sha1: fa9f618560a5f15e9b4c934ed40f095007c6821b
sha256: cfba163df8952076490a69d3baf5ec7628698ccfc5d70f9b7898b1aad87d3757
sha512: 45059cca9bc1cc7c56b8ad265ef7a5f332408c8dcfd4d555f8abdc83788a2b2b7cbb67e1802ad194bcdd1352adb2e750a0f2b8d59724047e8a34dc45591c0f78
ssdeep: 3072:7kydcJyuEGaK02P8m62PN5UdbyfZLhhsZVggjcGkNIVqIz52:7my2a6Em6pdbyf6b7ITsqn
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E704AEFA75F0C471C6A23A3488A09BD44E7BBC61DA70554B37B817AE2F723D05A25363
sha3_384: 4ec5e1ccea0f84abe86121aafe47e0c8b9e5c1ead61d99fc1417a587158ab7944e45e56ff43e20d475034b087ecd87c5
ep_bytes: e8a3370000e978feffffcccccccccccc
timestamp: 2020-10-17 14:35:59

Version Info:
InternalName: bomgpiaruci.iwa
Copyright: Copyrighz (C) 2021, fudkat
ProductVersion: 23.54.77.27
Translation: 0x0127 0x046a

Midie.105641 (B) also known as:

How to remove Midie.105641 (B)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.