Adware

MSIL/Adware.Dotdo.BH malicious file

Malware Removal

The MSIL/Adware.Dotdo.BH is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What MSIL/Adware.Dotdo.BH virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Creates RWX memory
  • Guard pages use detected – possible anti-debugging.
  • Dynamic (imported) function loading detected
  • CAPE extracted potentially suspicious content
  • Authenticode signature is invalid

How to determine MSIL/Adware.Dotdo.BH?



File Info:

name: 5D48205164B9D9C70FCB.mlw
path: /opt/CAPEv2/storage/binaries/0ad5e6139fdeaee4c4628fc77dbf332a2a3b4440d52397f62298f207fa65a215
crc32: 8A0D8510
md5: 5d48205164b9d9c70fcbf8c917539e17
sha1: 0232045d06a37e4aba0a2c8df6a15041bd48e05d
sha256: 0ad5e6139fdeaee4c4628fc77dbf332a2a3b4440d52397f62298f207fa65a215
sha512: 9a60c12058e93070edda8bb09e7250b725981d19399c51fd9a033cbc2e03b95bea6b8de4afb1d1240f2c6d18581b71bc9675c9f7540794eac048c9c9c1d0efcc
ssdeep: 48:6IIoLyl/RxXGGQwxQJMJ/5lZGEt3DNX88Vax63+/BSfbNtm:FylRQK5lbD3VxXzNt
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T16D91615193F4473BE8F74BB6ED63A7005678BB14CBA74E6D2888451F9C113580BA3B32
sha3_384: 40675e72f7158d31b1aaa671fe6de87331b201ccf8438a932db99e133b30e6ab21cddb42b3ea388febd8783ec32e95d3
ep_bytes: ff250020400000000000000000000000
timestamp: 2021-11-25 11:34:39


Version Info:

Translation: 0x0000 0x04b0
FileDescription: ConsoleApplication1
FileVersion: 6.2.4.53
InternalName: ConsoleApplication1.exe
LegalCopyright:  
OriginalFilename: ConsoleApplication1.exe
ProductName: ConsoleApplication1
ProductVersion: 6.2.4.53
Assembly Version: 6.2.4.53

MSIL/Adware.Dotdo.BH also known as:

LionicRiskware.MSIL.Tiny.1!c
Elasticmalicious (high confidence)
MicroWorld-eScanAdware.GenericKD.47573606
McAfeeArtemis!5D48205164B9
CylanceUnsafe
ZillyaAdware.Dotdo.Win32.72722
K7AntiVirusAdware ( 00512cc21 )
AlibabaDownloader:MSIL/Dotdo.c9725eef
K7GWAdware ( 00512cc21 )
CyrenW32/DotDo.AF.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of MSIL/Adware.Dotdo.BH
TrendMicro-HouseCallTROJ_GEN.R002C0WL921
Kasperskynot-a-virus:HEUR:Downloader.MSIL.Tiny.gen
BitDefenderAdware.GenericKD.47573606
AvastWin32:AdwareX-gen [Adw]
TencentMsil.Trojan-downloader.Tiny.Sxeu
Ad-AwareAdware.GenericKD.47573606
SophosGeneric PUA AC (PUA)
TrendMicroTROJ_GEN.R002C0WL921
McAfee-GW-EditionArtemis!Trojan
FireEyeGeneric.mg.5d48205164b9d9c7
EmsisoftAdware.GenericKD.47573606 (B)
GDataAdware.GenericKD.47573606
AviraHEUR/AGEN.1127847
GridinsoftRansom.Win32.Sabsik.sa
ArcabitAdware.Generic.D2D5EA66
MicrosoftTrojan:Win32/Wacatac.B!ml
CynetMalicious (score: 99)
AhnLab-V3Malware/Win.Generic.C4439318
VBA32TScope.Trojan.MSIL
ALYacAdware.GenericKD.47573606
MAXmalware (ai score=61)
MalwarebytesAdware.DotDo.Generic.TskLnk
APEXMalicious
SentinelOneStatic AI – Suspicious PE
FortinetMSIL/DotDo.AF!tr
AVGWin32:AdwareX-gen [Adw]
PandaTrj/CI.A
CrowdStrikewin/malicious_confidence_70% (D)

How to remove MSIL/Adware.Dotdo.BH?

MSIL/Adware.Dotdo.BH removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment