Categories: Malware

Troj/MSIL-CWS (file analysis)

The Troj/MSIL-CWS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Troj/MSIL-CWS virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid
Anomalous .NET characteristics

How to determine Troj/MSIL-CWS?


File Info:
name: FF5171DB55DCC12DF340.mlwpath: /opt/CAPEv2/storage/binaries/1fb6f68e064d6ec21e5b19a6ceaf17f33a0d5041ef94d825417c04d36413d27dcrc32: EFB6FF10md5: ff5171db55dcc12df340471be10bd267sha1: f9b701a7e9aaa2af867929366c1bc20cc16f1969sha256: 1fb6f68e064d6ec21e5b19a6ceaf17f33a0d5041ef94d825417c04d36413d27dsha512: ba8ae642b7dd11cd923beaf70f466fbebacf3210de2ccf99c4a9834e76237f3162842773da2be218178cd12f94c3ca7693dad60f365ec0d77931be78b3261defssdeep: 96:wuz4E254C2s4y2emZNYrhkmuNMWSoUp9TcE2NYlnlYJnLrL0KffvzBEG6v19RXmY:wui+mrVWSPGVQnlYJLrLTjinDNtype: PE32 executable (console) Intel 80386, for MS Windowstlsh: T1F0E1C81667F14275CA5B0B772CB302411B73EA05CE67EB6F088CA3E5C9E31654A62F72sha3_384: 676c04284101003aa5e1533da9c255522dea5e87f5f0a290e85e885fbf3ffb9b947adb8cf2cbb79a9283e740568db2ecep_bytes: ff250020400000000000000000000000timestamp: 2018-02-23 04:08:09
Version Info:
Translation: 0x0000 0x04b0FileDescription:  FileVersion: 0.0.0.0InternalName: Mozilla.exeLegalCopyright:  OriginalFilename: Mozilla.exeProductVersion: 0.0.0.0Assembly Version: 0.0.0.0

Troj/MSIL-CWS also known as:

Bkav	W32.FamVT.CerbuPKG.Trojan
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Agent.DACI
ClamAV	Win.Malware.Barys-6804071-0
FireEye	Generic.mg.ff5171db55dcc12d
CAT-QuickHeal	Trojan.Mogoogwi.A3
ALYac	Trojan.Agent.DACI
Cylance	unsafe
Zillya	Trojan.Agent.Win32.525695
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 004be57a1 )
K7GW	Trojan ( 004be57a1 )
Cybereason	malicious.b55dcc
VirIT	Trojan.Win32.Generic.BAMF
Cyren	W32/S-f2a4b9c7!Eldorado
Symantec	Trojan Horse
ESET-NOD32	MSIL/Agent.QIF
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.Agent.DACI
NANO-Antivirus	Trojan.Win32.Agent.dzsvxi
ViRobot	Trojan.Win32.Agent.7168.FI
Avast	MSIL:Agent-CWF [Trj]
Tencent	Trojan.MSIL.Agent.hk
TACHYON	Trojan/W32.DN-Agent.7168.AL
Sophos	Troj/MSIL-CWS
F-Secure	Trojan.TR/Mogoogwi.qifa
DrWeb	Trojan.Siggen7.31585
VIPRE	Trojan.Agent.DACI
TrendMicro	WORM_MOGOOGWI.SMHA
McAfee-GW-Edition	BehavesLike.Win32.Trojan.zt
Trapmine	malicious.high.ml.score
Emsisoft	Trojan.Agent.DACI (B)
SentinelOne	Static AI – Malicious PE
GData	Trojan.Agent.DACI
Jiangmin	Trojan.Generic01.a
Avira	TR/Mogoogwi.qifa
Antiy-AVL	Trojan/Win32.Agent
Xcitium	TrojWare.MSIL.Agent.QIF@6kzu82
Arcabit	Trojan.Agent.DACI
SUPERAntiSpyware	Backdoor.Bot/Variant
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	Trojan:MSIL/Mogoogwi.A
Google	Detected
AhnLab-V3	Trojan/Win32.Zusy.R154407
McAfee	Trojan-FMGK!FF5171DB55DC
MAX	malware (ai score=99)
VBA32	TScope.Trojan.MSIL
Malwarebytes	Generic.Malware.AI.DDS
Panda	Trj/CI.A
TrendMicro-HouseCall	WORM_MOGOOGWI.SMHA
Rising	Trojan.Mogoogwi!1.A1A3 (CLASSIC)
Ikarus	Trojan.MSIL.Mogoogwi
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.QIF!tr
BitDefenderTheta	Gen:NN.ZemsilF.36250.am0@aeFPVFk
AVG	MSIL:Agent-CWF [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)