Should I remove “Ransom.1640 (B)”?

The Ransom.1640 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom.1640 (B) virus can do?

Dynamic (imported) function loading detected
Unconventionial language used in binary resources: Mongolian
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Ransom.1640 (B)?


File Info:
name: A202773EB36B26001EC4.mlw
path: /opt/CAPEv2/storage/binaries/5963e2d2a33be52d09b951548b82f15d1b2d74b277426e03a3f4af0f885738fc
crc32: 4BDB4970
md5: a202773eb36b26001ec46cbc0b9f2144
sha1: bf6a1065185cf4a0cfe0553d41c5af83cac0f1c5
sha256: 5963e2d2a33be52d09b951548b82f15d1b2d74b277426e03a3f4af0f885738fc
sha512: 82e17c58e974f5a956b47461fe1c66b6f2e3c5bd66c435e9c0695f3b34198ddc2cafaf4d7bd6ece0148324956fd552ee67373de8844f710329774594b2d4f441
ssdeep: 6144:v3nYB18QePuYxfz5XjWZYhosM4RflFkiBKYn3BWlhCHAewg1Se:vYB18TPuYF5TWyQsfk23BC4gz6
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15364BF3B681031B4CDFBA972CDC784898B9DD771E2048D2F2C09795EEE5866AF7081E5
sha3_384: fa270382b7f499d86a607344e5c53fb3aa24533a730333134f4307a428fb730f78a6d97fe5463ad47e92a118e342d871
ep_bytes: 558bec6aff684893410068908b410064
timestamp: 2006-06-06 15:53:22

Version Info:
CompanyName: FinePrint Software, LLC
FileDescription: Sparsity
FileVersion: 67, 154, 200, 18
InternalName: Sponsored
LegalCopyright: Row © 2087
OriginalFilename: Scrambling.exe
ProductName: Shutdowns Slating

Ransom.1640 (B) also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Yakes.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader16.21980
MicroWorld-eScan	Gen:Variant.Ransom.1640
FireEye	Generic.mg.a202773eb36b2600
CAT-QuickHeal	Ransom.TeslaCrypt.WR4
McAfee	GenericR-JWQ!A202773EB36B
Cylance	Unsafe
Zillya	Trojan.Kryptik.Win32.790994
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 004d41c61 )
Alibaba	Ransom:Win32/generic.ali2000010
K7GW	Trojan ( 004d41c61 )
Cybereason	malicious.eb36b2
BitDefenderTheta	Gen:NN.ZexaF.34182.tq3@aS9pN2eG
Symantec	Ransom.TeslaCrypt
ESET-NOD32	a variant of Win32/Kryptik.DVKL
TrendMicro-HouseCall	TROJ_FRS.0NA103BL20
Paloalto	generic.ml
Kaspersky	Trojan.Win32.Yakes.nurk
BitDefender	Gen:Variant.Ransom.1640
NANO-Antivirus	Trojan.Win32.Dwn.dwydif
Tencent	Malware.Win32.Gencirc.114c7b0f
Ad-Aware	Gen:Variant.Ransom.1640
Emsisoft	Gen:Variant.Ransom.1640 (B)
Comodo	Malware@#3bs71g815f1vz
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_FRS.0NA103BL20
McAfee-GW-Edition	GenericR-JWQ!A202773EB36B
Sophos	Mal/Generic-R + Mal/Tinba-L
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Ransom.1640
Jiangmin	Trojan.Bitman.awl
Webroot	W32.Trojan.GenKD
Avira	HEUR/AGEN.1124212
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Generic.ASMalwS.141D0CB
Microsoft	Ransom:Win32/Tescrypt.C
Cynet	Malicious (score: 100)
AhnLab-V3	Win-Trojan/Lockycrypt.Gen
Acronis	suspicious
VBA32	BScope.Trojan.Yakes
ALYac	Gen:Variant.Ransom.1640
Malwarebytes	Trojan.Crypt
Panda	Trj/Genetic.gen
APEX	Malicious
Rising	Ransom.Tescrypt!8.3AF (CLOUD)
Ikarus	Trojan.Win32.Crypt
eGambit	Generic.Malware
Fortinet	W32/Deshacop.XO!tr
AVG	Win32:Malware-gen
Avast	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_100% (W)
MaxSecure	Trojan.Malware.300983.susgen

How to remove Ransom.1640 (B)?

Ransom.1640 (B) removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X