ML/PE-A + Mal/EncPk-AO removal

The ML/PE-A + Mal/EncPk-AO is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What ML/PE-A + Mal/EncPk-AO virus can do?

Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Anomalous binary characteristics

How to determine ML/PE-A + Mal/EncPk-AO?


File Info:
crc32: 1A9B901B
md5: 37409cd40d2c60dba805fdab3bb10efe
name: 37409CD40D2C60DBA805FDAB3BB10EFE.mlw
sha1: c5fc36bac614aa90020063a475953390df487617
sha256: 8720d84c379e6eb71421ee0cbff72e1724607ffcbff4e9674bad0b39b7bf657d
sha512: 760197116f8ed4da7380c4adf9303218ef25c571134127427cc7a7974e3eaf8a2c03b3c3d966d81ec4ee61c9964e0baf5eb1af9e4ab683e16ece08739d10bba4
ssdeep: 12288:CeyL+xHCHhy0lvOz4X7j+hlinyGEsCNsMgomHjm2RilY+o2+22rxZgB+Cg6RK4B:CF+0hLcsX7ChlqyXpgomrRKY+obzxZg
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: WandaPlaza TangShan-LuNan.
ProductVersion: 1.0.0.1
FileVersion: 1.0.3.30
Comments: http://www.wanda.cn/
FileDescription: x5317x533ax65e5x62a5x5febx901fx751fx6210x5668
Translation: 0x0804 0x04b0

ML/PE-A + Mal/EncPk-AO also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Trojan.EmotetU.Gen.Oy0@h4gYfVmj
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_90% (W)
Cyren	W32/Heuristic-162!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Malware-gen
BitDefender	Trojan.EmotetU.Gen.Oy0@h4gYfVmj
ViRobot	Packed.Win32.NPack
MicroWorld-eScan	Trojan.EmotetU.Gen.Oy0@h4gYfVmj
Ad-Aware	Trojan.EmotetU.Gen.Oy0@h4gYfVmj
Sophos	ML/PE-A + Mal/EncPk-AO
BitDefenderTheta	AI:Packer.B57D62571F
VIPRE	Trojan.Win32.Packer.nPack1.1.1800 (ep)
McAfee-GW-Edition	BehavesLike.Win32.ZeroAccess.jc
FireEye	Generic.mg.37409cd40d2c60db
Emsisoft	Trojan.EmotetU.Gen.Oy0@h4gYfVmj (B)
SentinelOne	Static AI – Suspicious PE
eGambit	Unsafe.AI_Score_99%
Microsoft	Trojan:Win32/Hynamer.A!ml
Gridinsoft	Trojan.Heur!.030120A1
Arcabit	Trojan.EmotetU.Gen.E8E7A8
GData	Trojan.EmotetU.Gen.Oy0@h4gYfVmj
AhnLab-V3	Win32/MalPackedB.suspicious
McAfee	Generic Malware.eb
MAX	malware (ai score=83)
Malwarebytes	Malware.Heuristic.1004
Panda	Malicious Packer
Rising	Malware.Heuristic!ET#95% (RDMK:cmRtazqqScDBnlxG2juudbObXppv)
Yandex	Packed/nPack
Ikarus	Trojan-Banker.Win32.Banker
Fortinet	W32/PossibleThreat
AVG	Win32:Malware-gen
Qihoo-360	HEUR/QVM18.1.5827.Malware.Gen

How to remove ML/PE-A + Mal/EncPk-AO?

ML/PE-A + Mal/EncPk-AO removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X