ML/PE-A + Mal/Wanna-A (file analysis)

The ML/PE-A + Mal/Wanna-A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What ML/PE-A + Mal/Wanna-A virus can do?

Attempts to modify desktop wallpaper

How to determine ML/PE-A + Mal/Wanna-A?


File Info:
crc32: 9603B428
md5: 99351b639ba684820ed663a0005c2e49
name: 99351B639BA684820ED663A0005C2E49.mlw
sha1: 3956b5faa320faffda155120f0a40423f0064ae1
sha256: 9931b4c35136e3d95afc1edcb508b98d208d109863c324de86e212b83cf1df66
sha512: 0eed5c428bf16fd1040708e4e84b875e9f36c4a2df4feb01feb65564dfc7341d74f470b4060c9ec142927ed94834479744ad60174578c8ade948a71314485ad8
ssdeep: 3072:Rmrhm1eibcR+uiUg6p4FLlG4tlLbP+mmCoHFZxoHEo3m:REgoZiZhLlG4H2mmCU
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: LODCTR.EXE
FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
CompanyName: Microsoft Corporation
ProductName: Microsoftxae Windowsxae Operating System
ProductVersion: 6.1.7600.16385
FileDescription: Load PerfMon Counters
OriginalFilename: LODCTR.EXE
Translation: 0x0409 0x04b0

ML/PE-A + Mal/Wanna-A also known as:

K7AntiVirus	Trojan ( 00571a9e1 )
Elastic	malicious (high confidence)
DrWeb	Trojan.Encoder.11432
Cynet	Malicious (score: 100)
CAT-QuickHeal	Ransom.WannaCrypt.A4
ALYac	Trojan.Ransom.WannaCryptor.D
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
K7GW	Trojan ( 00571a9e1 )
Cybereason	malicious.39ba68
Cyren	W32/WannaCry.G.gen!Eldorado
Symantec	Ransom.Wannacry
ESET-NOD32	a variant of Win32/Filecoder.WannaCryptor.D
APEX	Malicious
Avast	Win32:WanaCry-A [Trj]
ClamAV	Win.Ransomware.WannaCry-6313787-0
Kaspersky	Trojan-Ransom.Win32.Wanna.c
BitDefender	Trojan.Ransom.WannaCryptor.D
NANO-Antivirus	Trojan.Win32.Wanna.eovgej
MicroWorld-eScan	Trojan.Ransom.WannaCryptor.D
Tencent	Trojan.Win32.WannaCry.d
Ad-Aware	Trojan.Ransom.WannaCryptor.D
Sophos	ML/PE-A + Mal/Wanna-A
Comodo	TrojWare.Win32.Ransom.WannaCrypt.B@719b9h
BitDefenderTheta	Gen:NN.ZexaF.34770.pq0@aOm@Elgi
VIPRE	Trojan.Win32.WannaCrypt.a (v)
TrendMicro	Ransom_WCRY.SM
McAfee-GW-Edition	Ransom-WannaCry!99351B639BA6
FireEye	Generic.mg.99351b639ba68482
Emsisoft	Trojan.Ransom.WannaCryptor.D (B)
SentinelOne	Static AI – Suspicious PE
Jiangmin	Trojan.Wanna.ln
Avira	HEUR/AGEN.1118500
eGambit	Unsafe.AI_Score_100%
Antiy-AVL	Trojan/Generic.ASMalwS.2027829
Microsoft	Ransom:Win32/Cryptolocker.PDP!MTB
Arcabit	Trojan.Ransom.WannaCryptor.D
GData	Win32.Trojan-Ransom.WannaCry.E
TACHYON	Ransom/W32.Wanna.245760
AhnLab-V3	Trojan/Win32.WannaCryptor.R200589
McAfee	Ransom-WannaCry!99351B639BA6
MAX	malware (ai score=80)
VBA32	TrojanRansom.Wanna
Malwarebytes	Ransom.WannaCrypt
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	Ransom_WCRY.SM
Rising	Ransom.WanaCrypt!1.AAEB (CLASSIC)
Yandex	Trojan.GenAsa!DkX5FxEFGvQ
Ikarus	Trojan-Ransom.WannaCry
MaxSecure	Trojan.Ransom.Wanna.d
Fortinet	W32/WannaCryptor.O!tr.ransom
AVG	Win32:WanaCry-A [Trj]

How to remove ML/PE-A + Mal/Wanna-A?

ML/PE-A + Mal/Wanna-A removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X