PUA:Win32/Hypnamer.C!ml removal

Malware Removal

The PUA:Win32/Hypnamer.C!ml is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What PUA:Win32/Hypnamer.C!ml virus can do?

  • Presents an Authenticode digital signature
  • Attempts to connect to a dead IP:Port (5 unique times)
  • Performs some HTTP requests
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary likely contains encrypted or compressed data.

Related domains:

z.whorecord.xyz
downloader.aldtop.com
downapi.pcsoft.com.cn
resource.aldtop.com
a.tomx.xyz
img.aldtop.com

How to determine PUA:Win32/Hypnamer.C!ml?


File Info:

crc32: EDE9CD3C
md5: 631e16ae280e343c27c19d0b84b89eb4
name: msvcr100.dll_008242564.exe
sha1: 56fe0ddea15f5deca05e63cc1823a332072dc0d3
sha256: 368513fe3f9054c9a0875eda0163d48c71effeec3fc340a776352c89a511d426
sha512: 1fd7e81bdb10d7ecda6d164a8a5616b3d11ea24cdc0b2bfc5782cc46096100dedffbc760c1113317051c2fcd51eaba49cfc2987da2de6cc05b7103256c1930e0
ssdeep: 24576:wwnw4JHMgX7bsfIed5KPbRE7zcvyYk/RKdTSELn3qMYXRUwXByjAtdK:wwweHF4b2ba/cqYc+OuqdXRUw2AtdK
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (C) 2018
InternalName: FastDownloader.exe
FileVersion: 3.2.0.8
CompanyName: -
ProductName: x8f6fx4ef6x4e0bx8f7dx5668
ProductVersion: 3.2.0.8
FileDescription:
OriginalFilename: FastDownloader.exe
Translation: 0x0804 0x04b0

PUA:Win32/Hypnamer.C!ml also known as:

MicroWorld-eScanGen:Variant.Application.Bundler.313
FireEyeGeneric.mg.631e16ae280e343c
McAfeeGenericRXAA-FA!631E16AE280E
CylanceUnsafe
SangforMalware
K7AntiVirusRiskware ( 00544e421 )
BitDefenderGen:Variant.Application.Bundler.313
K7GWRiskware ( 00544e421 )
APEXMalicious
GDataGen:Variant.Application.Bundler.313
Kasperskynot-a-virus:HEUR:Downloader.Win32.Agent.vho
Ad-AwareGen:Variant.Application.Bundler.313
EmsisoftGen:Variant.Application.Bundler.313 (B)
F-SecureHeuristic.HEUR/AGEN.1126112
Invinceaheuristic
JiangminDownloader.Agent.npo
AviraHEUR/AGEN.1126112
eGambitUnsafe.AI_Score_91%
Endgamemalicious (high confidence)
ArcabitTrojan.Application.Bundler.313
ZoneAlarmnot-a-virus:HEUR:Downloader.Win32.Agent.vho
MicrosoftPUA:Win32/Hypnamer.C!ml
CynetMalicious (score: 100)
MAXmalware (ai score=77)
VBA32Downloader.Agent
MalwarebytesPUP.Optional.FastDownloader
ESET-NOD32a variant of Win32/RiskWare.Downer.B
RisingMalware.Heuristic!ET#100% (RDMK:cmRtazpERsMeQCJviMul3gc0AkV+)
IkarusPUA.RiskWare.Downer
AVGFileRepMalware
Paloaltogeneric.ml

How to remove PUA:Win32/Hypnamer.C!ml?

PUA:Win32/Hypnamer.C!ml removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment