Troj/Nivdor-A (file analysis)

The Troj/Nivdor-A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Troj/Nivdor-A virus can do?

Sample contains Overlay data
Authenticode signature is invalid

How to determine Troj/Nivdor-A?


File Info:
name: B1D13F6F462BFDA3BDD1.mlw
path: /opt/CAPEv2/storage/binaries/b0184321c608e424dd123f8297b00b32514c6e5a25d671cad77463aecd6b948a
crc32: 1D57EF60
md5: b1d13f6f462bfda3bdd1e98524a55dd6
sha1: 41f01144327bd97c32a96e730f32fb751628b1bd
sha256: b0184321c608e424dd123f8297b00b32514c6e5a25d671cad77463aecd6b948a
sha512: 8998733a86e0046db6bbfe7aadfa99f2431ceaec2d1560903141d7d1dfcb256e891613dd7bbb1020084e5a3a45513fae2140d6fd95b3dd1be586088da2d01bcb
ssdeep: 6144:XLfb4IGFYlNSM/3XYdzfPPUznpucKzPgHl:34I1LnYdzfPPMscwPgF
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DB344A1D7480D139D9D1B0B9A6BC377356BCA6E037B456DBAFE408494ADA0C13AF324B
sha3_384: c1f025db9713d15e50ff366013d73d6002114b5b499f7be4787cd6b4f4a7995bf1160832c7cacb16f8ed744caffc58e5
ep_bytes: e8bcd40000e9000000006a1468489e45
timestamp: 2015-05-11 06:11:35

Version Info:
0: [No Data]

Troj/Nivdor-A also known as:

Bkav	W32.AIDetectMalware
FireEye	Generic.mg.b1d13f6f462bfda3
Skyhigh	BehavesLike.Win32.Generic.dh
McAfee	Artemis!B1D13F6F462B
Malwarebytes	Generic.Malware.AI.DDS
Zillya	Trojan.Bayrob.Win32.32458
CrowdStrike	win/malicious_confidence_60% (D)
Baidu	Win32.Trojan.Generic.bd
APEX	Malicious
Cynet	Malicious (score: 100)
Sophos	Troj/Nivdor-A
SentinelOne	Static AI – Suspicious PE
Jiangmin	Trojan.Generic.blvfl
Webroot	Trojan.Dropper.Gen
Google	Detected
Microsoft	Trojan:Win32/Wacatac.B!ml
Rising	Trojan.Win32.Bayrod.b (CLASSIC)
Ikarus	Trojan.Win32.Bayrob
Fortinet	W32/Bayrob.T!tr
DeepInstinct	MALICIOUS

How to remove Troj/Nivdor-A?

Troj/Nivdor-A removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X