Categories: Ransom

ML/PE-A + Mal/Ransom-AI malicious file

The ML/PE-A + Mal/Ransom-AI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What ML/PE-A + Mal/Ransom-AI virus can do?

Creates RWX memory
Expresses interest in specific running processes
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Unconventionial language used in binary resources: Russian
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Installs itself for autorun at Windows startup
Creates a hidden or system file
Anomalous binary characteristics
Attempts to modify Explorer settings to prevent hidden files from being displayed

How to determine ML/PE-A + Mal/Ransom-AI?


File Info:
crc32: 8BE7121Dmd5: 780a51e46880c3685748a83443354fcbname: 780A51E46880C3685748A83443354FCB.mlwsha1: a53ec02e4fcd50eadcd5745362654f4a7b3eefaasha256: 8ea7e2bb5a0da7094f84e01eb274fa6877f6fab8dc61450646d61d8bea6322bcsha512: 9a11174bd7e2d06d88d6a1948cb3c0ce5df2bc2cb1a88a2d6c0a3f61e458212efbd75dcd53469ca23e0add1b11e073269734ceecc05105c2b5a0589f05d3a805ssdeep: 6144:cG7u6jrkwvKaXR0cyYLF6lcBapBdd2qd:t7u6jvnXRsLiATVdtype: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Version Info:
0: [No Data]

ML/PE-A + Mal/Ransom-AI also known as:

K7AntiVirus	Trojan ( 0039911e1 )
Elastic	malicious (high confidence)
DrWeb	Trojan.Winlock.3333
Cynet	Malicious (score: 100)
CAT-QuickHeal	Ransom.Weenloc.A8
ALYac	Trojan.Generic.5848174
Cylance	Unsafe
Zillya	Trojan.Fullscreen.Win32.36
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Ransom:Win32/Blocker.fd91ec3c
K7GW	Trojan ( 0039911e1 )
Cybereason	malicious.46880c
Baidu	Win32.Trojan.LockScreen.b
Cyren	W32/Trojan.GDVD-7096
Symantec	Trojan.Ransomlock
ESET-NOD32	Win32/LockScreen.AGU
APEX	Malicious
TotalDefense	Win32/Ransom.BAM
Avast	Win32:LockScreen-AHV [Trj]
ClamAV	Win.Ransomware.Fullscreen-7347612-0
Kaspersky	Trojan-Ransom.Win32.Blocker.jzec
BitDefender	Trojan.Generic.5848174
NANO-Antivirus	Trojan.Win32.Fullscreen.crnep
SUPERAntiSpyware	Trojan.Agent/Gen-Ransom
MicroWorld-eScan	Trojan.Generic.5848174
Tencent	Trojan-Ransom.Win32.Blocker.jzec
Ad-Aware	Trojan.Generic.5848174
Sophos	ML/PE-A + Mal/Ransom-AI
Comodo	TrojWare.Win32.Ransom.Fullscreen.fgt@4t6ar8
BitDefenderTheta	Gen:NN.ZelphiF.34628.mmGfaWWjlAgI
VIPRE	Trojan.Win32.Birele.mby (v)
TrendMicro	Ransom_WINLOCK.SM
McAfee-GW-Edition	BehavesLike.Win32.Dropper.dc
FireEye	Generic.mg.780a51e46880c368
Emsisoft	Trojan.Generic.5848174 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan/Fullscreen.ak
Webroot	W32.Malware.Gen
Avira	DR/Delphi.Gen4
eGambit	Unsafe.AI_Score_99%
Kingsoft	Heur.SSC.5536.1216.(kcloud)
Microsoft	Trojan:Win32/Ymacco.AA8E
AegisLab	Trojan.Win32.Blocker.j!c
GData	Trojan.Generic.5848174
TACHYON	Ransom/W32.DP-Blocker.458240
AhnLab-V3	Trojan/Win32.Winlock.C134008
McAfee	GenericRXAA-AA!780A51E46880
MAX	malware (ai score=80)
VBA32	Hoax.PornoAsset
Malwarebytes	Ransom.Agent.UPX
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	Ransom_WINLOCK.SM
Rising	Trojan.Win32.Weenloc.a (CLOUD)
Yandex	Trojan.GenAsa!EkA5wRxKoJY
Ikarus	Trojan-Ransom.Fullscreen
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/LockScreen.AGU!tr
AVG	Win32:LockScreen-AHV [Trj]
Paloalto	generic.ml
Qihoo-360	Win32/Ransom.Weenloc.HwsBA1UA