Categories: Risk

RiskWare.AVDis.MSIL (file analysis)

The RiskWare.AVDis.MSIL is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What RiskWare.AVDis.MSIL virus can do?

Creates RWX memory
Reads data out of its own binary image
Drops a binary and executes it
Uses Windows utilities for basic functionality
Network activity detected but not expressed in API logs
Attempts to identify installed AV products by registry key
Anomalous binary characteristics
Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine RiskWare.AVDis.MSIL?


File Info:
crc32: 37EB72CCmd5: b7352a9cde99367d4053d0de7431a181name: 1.exesha1: 32d2046f588a98c1ea0fee63d1c275b34497ddeasha256: 9dd0d5b5b5efe2433cfcbc3044d0219ffeb517c2cde4e705e52719ed15660a00sha512: 8b6cee0cdd86c616e6a5e65bb08ad9df2926b5fa16b7186166e6fb69ca8eb3f1cef98f3e03ab2ae43c082b6acae82edd0a45d71df14b504ae7bf82da049796dfssdeep: 1536:QPzUmdx2gahvwPBW7rfoOcwCJpPYnlbobN8+DF:QPzUQ2gyYqrf5cwipKlbob62type: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Version Info:
LegalCopyright: FileVersion: 7.0.0.0FileDescription: csrssTranslation: 0x0409 0x0000

RiskWare.AVDis.MSIL also known as:

MicroWorld-eScan	Trojan.GenericKD.32672295
FireEye	Generic.mg.b7352a9cde99367d
CAT-QuickHeal	Trojan.Agent
ALYac	Trojan.GenericKD.32672295
Cylance	Unsafe
Zillya	Trojan.Agent.Win32.1098990
Sangfor	Malware
K7AntiVirus	Trojan ( 0051ed981 )
Alibaba	Trojan:BAT/KillAV.4470b106
K7GW	Trojan ( 0051ed981 )
CrowdStrike	win/malicious_confidence_90% (W)
Arcabit	Trojan.Generic.D1F28A27
Invincea	heuristic
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.MSIL.Agent.gen
BitDefender	Trojan.GenericKD.32672295
NANO-Antivirus	Trojan.Win32.KillAV.fqefzy
AegisLab	Trojan.MSIL.Agent.4!c
Rising	Trojan.Agent!8.B1E (CLOUD)
Ad-Aware	Trojan.GenericKD.32672295
Sophos	Mal/Generic-S
Comodo	Malware@#3sbua5ahnjbrx
F-Secure	Trojan.TR/Agent.wqbpm
DrWeb	Trojan.FakeAV.20338
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R047C0DAS20
McAfee-GW-Edition	BehavesLike.Win32.AdwareDotDo.qh
Trapmine	malicious.moderate.ml.score
CMC	Trojan.Win32.Miner!O
Emsisoft	Trojan.GenericKD.32672295 (B)
Ikarus	Trojan.Agent
Cyren	W32/Trojan.ODEZ-0351
Webroot	Trojanspy:Win32/Mafod!rts
Avira	TR/Agent.wqbpm
Antiy-AVL	Trojan/MSIL.Agent
Microsoft	PUA:Win32/RelevantKnowledge
Endgame	malicious (high confidence)
ZoneAlarm	HEUR:Trojan-Downloader.Win32.Agent.gen
GData	Trojan.GenericKD.32672295
McAfee	Artemis!B7352A9CDE99
MAX	malware (ai score=94)
VBA32	Trojan.MSIL.Agent
Malwarebytes	RiskWare.AVDis.MSIL
Panda	Trj/CI.A
ESET-NOD32	NSIS/TrojanDropper.Agent.CQ
TrendMicro-HouseCall	TROJ_GEN.R047C0DAS20
Tencent	Msil.Trojan.Agent.Pefl
Yandex	Trojan.Agent!fxct73TQh/c
SentinelOne	DFI – Suspicious PE
MaxSecure	Trojan.Malware.8703358.susgen
Fortinet	W32/Agent.CQ!tr
AVG	Win32:TrojanX-gen [Trj]
Cybereason	malicious.cde993
Avast	Win32:TrojanX-gen [Trj]
Qihoo-360	Generic/Trojan.289