Risk

RiskTool.Win32.FlyStudio.cgjc (file analysis)

Malware Removal

The RiskTool.Win32.FlyStudio.cgjc is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What RiskTool.Win32.FlyStudio.cgjc virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Dynamic (imported) function loading detected
  • NtSetInformationThread: attempt to hide thread from debugger
  • Creates RWX memory
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is likely packed with VMProtect
  • Authenticode signature is invalid
  • Detects Sandboxie through the presence of a library
  • Tries to suspend Cuckoo threads to prevent logging of malicious activity

How to determine RiskTool.Win32.FlyStudio.cgjc?



File Info:

name: 741A091CC71F17656F50.mlw
path: /opt/CAPEv2/storage/binaries/1183d3469df33d71c10da6201d99a77b9b6a5c1f8dfd9d1a08400392b948dc40
crc32: EACD5622
md5: 741a091cc71f17656f5024e7c45158e8
sha1: e8880a6076258a0f60754c04d84d697b96feff4e
sha256: 1183d3469df33d71c10da6201d99a77b9b6a5c1f8dfd9d1a08400392b948dc40
sha512: c969a6401c8368b08795e6d2c7a62b86922d9ad6d8f13e1eae38d9c25791c84fff8e72b09589eaa5a5756f911395c5b75583649ef7348c920140de79c479f1a2
ssdeep: 98304:aCUvVBl66X7yzU1M/Rj/WsFI3z3zbIs1bP3K3utN27ZFNAkSaVUcdEwUYH2LO10c:fMVXNCmzh1z3K3CEZ0kT/d6Yn1wW
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18E6633CEA402DAEFC97524392CD25D9CDA3B02699D0BD7A34A303C2B61FF97245364B1
sha3_384: e9770e58fdd48067c0f730f4c6a7f911fa411fd0085bfffbadd44e8f418bea14b60b62f7912336efeb9cbea5f5c48392
ep_bytes: 60c744241c22ca139e9cc744241cdcf3
timestamp: 2021-11-29 08:12:40


Version Info:

FileVersion: 1.0.0.0
FileDescription: 涯兵韩服
ProductName: 涯兵韩服
ProductVersion: 1.0.0.0
CompanyName: 天涯
LegalCopyright: 天涯 版权所有
Comments: 涯兵韩服
Translation: 0x0804 0x04b0

RiskTool.Win32.FlyStudio.cgjc also known as:

BkavW32.AIDetect.malware2
LionicTrojan.Win32.Malicious.4!c
Elasticmalicious (high confidence)
McAfeeArtemis!741A091CC71F
CylanceUnsafe
K7AntiVirusAdware ( 004b8e1b1 )
AlibabaRiskWare:Win32/FlyStudio.951bed91
K7GWAdware ( 004b8e1b1 )
CrowdStrikewin/malicious_confidence_60% (W)
BitDefenderThetaGen:NN.ZexaF.34084.@F0@a8d29hib
CyrenW32/S-aa493aa1!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Packed.VMProtect.ABD
BaiduWin32.Packed.VMProtect.a
TrendMicro-HouseCallTROJ_GEN.R002C0RLD21
Paloaltogeneric.ml
CynetMalicious (score: 100)
Kasperskynot-a-virus:RiskTool.Win32.FlyStudio.cgjc
AvastWin32:Trojan-gen
SophosMal/VMProtBad-A
ComodoTrojWare.Win32.Agent.ISVQ@5mbonp
TrendMicroTROJ_GEN.R002C0RLD21
McAfee-GW-EditionBehavesLike.Win32.Generic.vc
SentinelOneStatic AI – Malicious PE
GDataWin32.Trojan.FlyStudio.J3YGKI
AviraTR/Black.Gen2
Antiy-AVLTrojan/Generic.ASMalwS.34EBEF4
GridinsoftRansom.Win32.Sabsik.sa
APEXMalicious
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
RisingMalware.Heuristic!ET#99% (RDMK:cmRtazo3vUw/Qxwuyi7gMoscjfQV)
IkarusTrojan-Downloader.Win32.FakeIE
eGambitUnsafe.AI_Score_100%
FortinetW32/PossibleThreat
AVGWin32:Trojan-gen
Cybereasonmalicious.076258

How to remove RiskTool.Win32.FlyStudio.cgjc?

RiskTool.Win32.FlyStudio.cgjc removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment