What is “ML/PE-A + Troj/EncPk-AQ”?

The ML/PE-A + Troj/EncPk-AQ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What ML/PE-A + Troj/EncPk-AQ virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Creates RWX memory
• Dynamic (imported) function loading detected
• Enumerates running processes
• Reads data out of its own binary image
• A process created a hidden window
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Uses Windows utilities for basic functionality
• Created a process from a suspicious location
• Installs itself for autorun at Windows startup
• Installs itself for autorun at Windows startup
• Created a service that was not started
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities

How to determine ML/PE-A + Troj/EncPk-AQ?

File Info:
name: D3727134E00539E3FA4D.mlw
path: /opt/CAPEv2/storage/binaries/c7908cfb7e9de6c0ea04ea9091556cc4c9a427531b5d6a4d7f40ac17122202ca
crc32: D835D8D5
md5: d3727134e00539e3fa4db855fdab07f1
sha1: 3280f1033ffc9fd196191374f1520030b876a767
sha256: c7908cfb7e9de6c0ea04ea9091556cc4c9a427531b5d6a4d7f40ac17122202ca
sha512: e3b1453742d831106dd6e0b9f3a4cc73502eac17ba06d8cc7699190c22819182019ec010c57174af3939041a1e05159c6347ff79c1db625b95f390db36b04d9d
ssdeep: 6144:NWPxOcqKrVlx95VuDp58rQodc6kFRPQ/yw:Nzc5BVipizdczHPYn
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A43423AD0B8474D3C228377B31BF7D88FAA1185B3F2799293F991652ED1C60590FA1D2
sha3_384: ad6d23a4186dc8c4a7153458910071d39d1a7bd49b83ca4c45f75c30a079c0cc5b79e600bc2e9363e03148d394f73496
ep_bytes: 53b84f3b0500bb78563412b978563412
timestamp: 2014-12-24 07:26:24

Version Info:
0: [No Data]

ML/PE-A + Troj/EncPk-AQ also known as:

How to remove ML/PE-A + Troj/EncPk-AQ?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.