Categories: Malware

What is “PWS:Win32/Tibia.AS”?

The PWS:Win32/Tibia.AS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PWS:Win32/Tibia.AS virus can do?

Sample contains Overlay data
Drops a binary and executes it
Unconventionial language used in binary resources: Polish
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous binary characteristics

How to determine PWS:Win32/Tibia.AS?


File Info:
name: 2053B51C05ECC20D90E6.mlwpath: /opt/CAPEv2/storage/binaries/1fcb13e312540a76faceb91e07bd7d8a518695cf861edf10a1ea26a53498d98dcrc32: F020DB9Cmd5: 2053b51c05ecc20d90e6cc3abfb3d774sha1: 163589cbb35cd2b87460d7b63b3ad121f0df178fsha256: 1fcb13e312540a76faceb91e07bd7d8a518695cf861edf10a1ea26a53498d98dsha512: 72e0560d304a32b159d5ed90a5d1a1a389e2c07d30313d6cbeb5e390c6b12e7538ad90eefc2c31b9f2f9430433e223a312e335f4452178e1f5a57e94d8978f6fssdeep: 6144:is8XGxZyB1HkoGMHarsCxJpYdraFz65m20bXRVZkgjZIgafIIsjoEFin3ld:t8XcZyB1HkMdraRmN0bHZINQv9in1dtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T11A948E26F6E08833D1A3253DDC1FA768AC39BE913D6459463BF82D4C4F3A7813526297sha3_384: de1c17ffb787c8d44162c2f8d6e0799f1aadf6940ce5b3071c7afc68cd80770c5b013ad735db8a8917aac1b7812707f8ep_bytes: 558bec83c4f0b840614500e8c4fafafftimestamp: 2007-08-04 11:07:18
Version Info:
CompanyName: lopaFileDescription: lopaFileVersion: 4.4.4.4InternalName: lopaLegalCopyright: lopaLegalTrademarks: lopaOriginalFilename: lopaProductName: lopaProductVersion: 4.4.4.4Translation: 0x046e 0x04e4

PWS:Win32/Tibia.AS also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Scar.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Trojan.Heur.zG1@t97qgkoG
FireEye	Generic.mg.2053b51c05ecc20d
Skyhigh	Generic.bop
McAfee	Generic.bop
VIPRE	Gen:Trojan.Heur.zG1@t97qgkoG
K7AntiVirus	Riskware ( 00584baa1 )
BitDefender	Gen:Trojan.Heur.zG1@t97qgkoG
K7GW	Riskware ( 00584baa1 )
Cybereason	malicious.bb35cd
VirIT	Trojan.Win32.Generic.AJZC
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/PSW.Tibia.NEG
Cynet	Malicious (score: 99)
APEX	Malicious
ClamAV	Win.Trojan.Scar-2929
Kaspersky	Trojan.Win32.Scar.bevx
Alibaba	TrojanPSW:Win32/Tibia.1e75ffd6
NANO-Antivirus	Trojan.Win32.Scar.bjpzr
ViRobot	Trojan.Win32.Scar.350500
Rising	Trojan.Generic@AI.85 (RDML:cZrs3omQRjAg13G1PSIeDA)
Sophos	Mal/Generic-R
F-Secure	Heuristic.HEUR/AGEN.1331138
DrWeb	Trojan.MulDrop2.64052
Zillya	Trojan.Scar.Win32.11805
Trapmine	malicious.moderate.ml.score
Emsisoft	Gen:Trojan.Heur.zG1@t97qgkoG (B)
Ikarus	Trojan.Win32.Scar
Jiangmin	Trojan/Scar.nxc
Webroot	W32.Infostealer.Gen
Varist	W32/OnlineGames.DJ.gen!Eldorado
Avira	HEUR/AGEN.1331138
Antiy-AVL	Trojan/Win32.Scar
Kingsoft	Win32.HeurC.KVM007.a
Microsoft	PWS:Win32/Tibia.AS
Xcitium	TrojWare.Win32.Agent.~JH4@1ohy0k
Arcabit	Trojan.Heur.E28D2C
ZoneAlarm	Trojan.Win32.Scar.bevx
GData	Gen:Trojan.Heur.zG1@t97qgkoG
Google	Detected
AhnLab-V3	Win-Trojan/Scar.417290
BitDefenderTheta	AI:Packer.A3265DA51C
ALYac	Gen:Trojan.Heur.zG1@t97qgkoG
MAX	malware (ai score=98)
DeepInstinct	MALICIOUS
VBA32	BScope.Trojan.Keyloggerger
Cylance	unsafe
Panda	Generic Malware
Tencent	Malware.Win32.Gencirc.13b37d7a
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.921714.susgen
AVG	Win32:Scar-DA [Trj]
Avast	Win32:Scar-DA [Trj]
CrowdStrike	win/malicious_confidence_100% (W)