MSILHeracles.38193 (file analysis)

The MSILHeracles.38193 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSILHeracles.38193 virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
.NET file is packed/obfuscated with Confuser
Authenticode signature is invalid
Anomalous .NET characteristics

How to determine MSILHeracles.38193?


File Info:
name: 7AE8BC536F03B309200A.mlw
path: /opt/CAPEv2/storage/binaries/2d904b3343e839160a6e7676cb7c1e5d124284b93a7e519f8329db528e34a0a6
crc32: 03B573AB
md5: 7ae8bc536f03b309200ab647a2f4cc9e
sha1: b9f09a57cf2df7c86e36bb6eef4a6092b573528a
sha256: 2d904b3343e839160a6e7676cb7c1e5d124284b93a7e519f8329db528e34a0a6
sha512: a0288a8ab8093159c4dc1042c951f6bdbcd235fe32f4fe70fd914cc40a7670a70bd84630aea2d68d0f24182d3e9743e8867dc66b0ae86a7e3997783d3affa0c3
ssdeep: 12288:bXOpUwZ0Z/1Hma2v3i7Mm5V1jnmf9N+qUkDFitW4So9BVwCw1AW:bXvGa2vAb5yfnxDFitqo97Nw6
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10665D988DBFF9983AF50D4F34D4320D81AA31DDFA741A92E2D3B566970B4A5AD4043B3
sha3_384: cfa031d2d2829df551709f76f9739cf3e032bde74ba7c49d87a2485a216217b9d7c88cff44fbcf34bf670ccb8c1de359
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-06-07 13:58:17

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: System
FileVersion: 1.0.0.0
InternalName: defe.exe
LegalCopyright: Copyright ©  2017
LegalTrademarks: 
OriginalFilename: defe.exe
ProductName: System
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

MSILHeracles.38193 also known as:

Bkav	W32.AIDetectNet.01
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.MSILHeracles.38193
FireEye	Generic.mg.7ae8bc536f03b309
ALYac	Gen:Variant.MSILHeracles.38193
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.36f03b
BitDefenderTheta	Gen:NN.ZemsilF.34712.xn0@aue1Axo
Cyren	W32/MSIL_Troj.NT.gen!Eldorado
ESET-NOD32	a variant of MSIL/Kryptik.NMP
Kaspersky	HEUR:Backdoor.MSIL.Bladabindi.gen
BitDefender	Gen:Variant.MSILHeracles.38193
Avast	FileRepMalware [Misc]
Ad-Aware	Gen:Variant.MSILHeracles.38193
Sophos	ML/PE-A
McAfee-GW-Edition	GenericRXTB-NC!7AE8BC536F03
SentinelOne	Static AI – Malicious PE
Trapmine	suspicious.low.ml.score
Emsisoft	Gen:Variant.MSILHeracles.38193 (B)
GData	Gen:Variant.MSILHeracles.38193
Avira	TR/Dropper.MSIL.Gen
Microsoft	Program:Win32/Wacapew.C!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C5153999
Acronis	suspicious
McAfee	GenericRXTB-NC!7AE8BC536F03
Malwarebytes	Malware.AI.5910483
APEX	Malicious
Rising	Trojan.Generic/MSIL@AI.94 (RDM.MSIL:rMJUQQXo9x7mlhBO6GoM/g)
MAX	malware (ai score=85)
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.NMP!tr
AVG	FileRepMalware [Misc]
CrowdStrike	win/malicious_confidence_100% (W)

How to remove MSILHeracles.38193?

MSILHeracles.38193 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X