PUA:Win32/Hypnamer.C!ml removal

The PUA:Win32/Hypnamer.C!ml is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PUA:Win32/Hypnamer.C!ml virus can do?

Presents an Authenticode digital signature
Attempts to connect to a dead IP:Port (5 unique times)
Performs some HTTP requests
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.

Related domains:

z.whorecord.xyz

downloader.aldtop.com

downapi.pcsoft.com.cn

resource.aldtop.com

a.tomx.xyz

img.aldtop.com

How to determine PUA:Win32/Hypnamer.C!ml?


File Info:
crc32: EDE9CD3C
md5: 631e16ae280e343c27c19d0b84b89eb4
name: msvcr100.dll_008242564.exe
sha1: 56fe0ddea15f5deca05e63cc1823a332072dc0d3
sha256: 368513fe3f9054c9a0875eda0163d48c71effeec3fc340a776352c89a511d426
sha512: 1fd7e81bdb10d7ecda6d164a8a5616b3d11ea24cdc0b2bfc5782cc46096100dedffbc760c1113317051c2fcd51eaba49cfc2987da2de6cc05b7103256c1930e0
ssdeep: 24576:wwnw4JHMgX7bsfIed5KPbRE7zcvyYk/RKdTSELn3qMYXRUwXByjAtdK:wwweHF4b2ba/cqYc+OuqdXRUw2AtdK
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2018
InternalName: FastDownloader.exe
FileVersion: 3.2.0.8
CompanyName: -
ProductName: x8f6fx4ef6x4e0bx8f7dx5668
ProductVersion: 3.2.0.8
FileDescription:  
OriginalFilename: FastDownloader.exe
Translation: 0x0804 0x04b0

PUA:Win32/Hypnamer.C!ml also known as:

MicroWorld-eScan	Gen:Variant.Application.Bundler.313
FireEye	Generic.mg.631e16ae280e343c
McAfee	GenericRXAA-FA!631E16AE280E
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Riskware ( 00544e421 )
BitDefender	Gen:Variant.Application.Bundler.313
K7GW	Riskware ( 00544e421 )
APEX	Malicious
GData	Gen:Variant.Application.Bundler.313
Kaspersky	not-a-virus:HEUR:Downloader.Win32.Agent.vho
Ad-Aware	Gen:Variant.Application.Bundler.313
Emsisoft	Gen:Variant.Application.Bundler.313 (B)
F-Secure	Heuristic.HEUR/AGEN.1126112
Invincea	heuristic
Jiangmin	Downloader.Agent.npo
Avira	HEUR/AGEN.1126112
eGambit	Unsafe.AI_Score_91%
Endgame	malicious (high confidence)
Arcabit	Trojan.Application.Bundler.313
ZoneAlarm	not-a-virus:HEUR:Downloader.Win32.Agent.vho
Microsoft	PUA:Win32/Hypnamer.C!ml
Cynet	Malicious (score: 100)
MAX	malware (ai score=77)
VBA32	Downloader.Agent
Malwarebytes	PUP.Optional.FastDownloader
ESET-NOD32	a variant of Win32/RiskWare.Downer.B
Rising	Malware.Heuristic!ET#100% (RDMK:cmRtazpERsMeQCJviMul3gc0AkV+)
Ikarus	PUA.RiskWare.Downer
AVG	FileRepMalware
Paloalto	generic.ml

How to remove PUA:Win32/Hypnamer.C!ml?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

PUA:Win32/Hypnamer.C!ml removal