Categories: Malware

MSIL:Dropper-CG [Drp] information

The MSIL:Dropper-CG [Drp] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MSIL:Dropper-CG [Drp] virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Creates RWX memory
Guard pages use detected – possible anti-debugging.
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Unusual version info supplied for binary

How to determine MSIL:Dropper-CG [Drp]?


File Info:
name: 7CCC792974547754EE63.mlwpath: /opt/CAPEv2/storage/binaries/59354c6a9c5b0d4da0d068cec3d3ec8665115155a93c4871d2a0abd69584d3d2crc32: 739F9424md5: 7ccc792974547754ee63b3dd97f7cb84sha1: e09ae134f1f4cf2f7aad63fc0541331731ca6067sha256: 59354c6a9c5b0d4da0d068cec3d3ec8665115155a93c4871d2a0abd69584d3d2sha512: 386d1f76bbf44236a467ea061c623e1288cdddf1ad41f9b46fb6311e7193ae74cb0005ae2e4dc492788bed453d49edb9722942699a1ee8206e2742ecccac9369ssdeep: 12288:RXPoBb6ykj9rXFOSeLFAiYYQMKXD5dvDFRadnhol2NausravaTu0p2GN3T6tviss:RXPoBb6ykj9o5AiMjvpRmnhlUTF3o55wtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1F4251245B7149E07D93A61B484AA039307F4AC656B13FBC7DCCEB1A82ABB3C1449E5D3sha3_384: fb6806f7766af35f8f17092e9e489852533821f38aaa0bb5a3aed506e9d29bc2e8cc224864bc3692eab68e113fcca1d2ep_bytes: ff250020400000000000000000000000timestamp: 2010-04-28 22:09:40
Version Info:
Translation: 0x0000 0x04b0Comments: Microsoft ToolCompanyName: Mircosoft DistrictFileDescription: Mircosoft HelperFileVersion: 4.1.5.22InternalName: 1.exeLegalCopyright: MicrosoftLegalTrademarks: Company MicrosoftOriginalFilename: 1.exeProductName: Mircosoft ComponentProductVersion: 4.1.5.22Assembly Version: 4.1.5.22

MSIL:Dropper-CG [Drp] also known as:

MicroWorld-eScan	Gen:Variant.Barys.23567
FireEye	Generic.mg.7ccc792974547754
McAfee	GenericRXHP-OZ!7CCC79297454
Cylance	Unsafe
Zillya	Trojan.Agent.Win32.488699
Sangfor	Trojan.Win32.Generic.8
K7AntiVirus	Riskware ( 00584baa1 )
K7GW	Riskware ( 00584baa1 )
Cybereason	malicious.974547
BitDefenderTheta	Gen:NN.ZemsilF.34182.9m1@aeXq4Cl
VirIT	Worm.Win32.Generic.BOCI
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	MSIL:Dropper-CG [Drp]
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Barys.23567
NANO-Antivirus	Trojan.Win32.Agent.cupxzk
SUPERAntiSpyware	Trojan.Agent/Gen-Dropper
Tencent	Win32.Trojan.Generic.Altc
Sophos	ML/PE-A + Mal/Rennes-A
Comodo	Malware@#2nn7of94y3bfu
DrWeb	Trojan.Siggen3.31146
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
Emsisoft	Gen:Variant.Barys.23567 (B)
Paloalto	generic.ml
Jiangmin	Trojan.Generic.grzpv
Avira	TR/Drop.MSIL.Ag.aes
Antiy-AVL	Trojan/Generic.ASMalwS.201AFC
Kingsoft	Win32.PSWTroj.Agent.v.(kcloud)
Microsoft	Backdoor:Win32/Bladabindi!ml
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Gen:Variant.Barys.23567
AhnLab-V3	Trojan/Win.Generic.C4946730
VBA32	TScope.Trojan.MSIL
ALYac	Gen:Variant.Barys.23567
MAX	malware (ai score=87)
TrendMicro-HouseCall	TROJ_GEN.R02DC0PB322
Yandex	Trojan.PWS.Agent!IAramwn2JJk
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Agent.A!tr.pws
AVG	MSIL:Dropper-CG [Drp]
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_90% (W)