What is “ML/PE-A + Mal/FakeAV-PK”?

The ML/PE-A + Mal/FakeAV-PK is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What ML/PE-A + Mal/FakeAV-PK virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Creates RWX memory
• Checks adapter addresses which can be used to detect virtual network interfaces
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Enumerates running processes
• Expresses interest in specific running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Bulgarian
• Authenticode signature is invalid
• Deletes its original binary from disk
• Installs itself for autorun at Windows startup
• Attempts to modify proxy settings
• Deletes executed files from disk

How to determine ML/PE-A + Mal/FakeAV-PK?

File Info:
name: 9D3B4D1652AAA23D9B55.mlw
path: /opt/CAPEv2/storage/binaries/f80fc46810c968f87f7da423b4cc4ebfafb29dcff4e62d90a79b9a5bbe85cbae
crc32: FFD26630
md5: 9d3b4d1652aaa23d9b55a7bd9c2191b4
sha1: df7e6f26c9e0982b0f04a121d5331ed36974ac51
sha256: f80fc46810c968f87f7da423b4cc4ebfafb29dcff4e62d90a79b9a5bbe85cbae
sha512: 88431b9d81b799234ba346dc518f765c54babfce6f3ecf6e94057ca00f0c29bcd86e1eb45810c094394cda44e8596893619a188f7f7d6f9e23ab6928dd692f12
ssdeep: 12288:moLz4cCiqQxBEKM2TVE39sGO1Kyo9+C3a3q6s75Z2Q:jn4L6xBM2TGNxwA+mBwQ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T170E41243EB038375E2A839F8699F1F560F182AC551601D1757A8E82B36E77B2609F7CC
sha3_384: 6013091a72f2429c57ff651d25a50f5bbf312fab11efb46dde1951cd5419a1f35f8d272541e608a317a91ee16f2964c7
ep_bytes: 558bec81ec1c0200008b15960d480033
timestamp: 1970-01-02 18:33:23

Version Info:
CompanyName: BitDefender S.R.L.
FileDescription: BitDefender Antivirus Scanner
FileVersion: 13,0,21,1
InternalName: UIScanner
LegalCopyright: Copyright (C) 2010
OriginalFilename: uiscan.exe
ProductName: BitDefender 2010
ProductVersion: 13,0,18,344
Translation: 0x0409 0x04b0

ML/PE-A + Mal/FakeAV-PK also known as:

How to remove ML/PE-A + Mal/FakeAV-PK?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.