Troj/Palevo-CX (file analysis)

The Troj/Palevo-CX is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Troj/Palevo-CX virus can do?

Authenticode signature is invalid

How to determine Troj/Palevo-CX?


File Info:
name: C00D053C7B79582F8D3F.mlw
path: /opt/CAPEv2/storage/binaries/8deaf8fdeaa5b62a8d167a908d0ebdcead294bb2971b25ae050f696578c5c35c
crc32: 3981D369
md5: c00d053c7b79582f8d3f237333eabb05
sha1: fe87d0f4065d8248011f127d6aec03e475f179a7
sha256: 8deaf8fdeaa5b62a8d167a908d0ebdcead294bb2971b25ae050f696578c5c35c
sha512: 9df431125882c61f4e513e880921e550bd7b260bf015b372c6e0f9e9c47aa981a2fd3b4e4b4a7dfcc4df6e76e624161c61ce9bec4b7ac782c1cd4e0a2958d343
ssdeep: 1536:JQabuxgLbJnbQvVPsoYmnHFGSilKBZdDf7yQih6t0V+7PRmn2c8UYAAAmUU9:J9bqgpbkPBfGQfY4PRolOUU
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T106F33B1396095025EB7A08B0864EB397979F587A63B0AD3B3F38297D7B7199650F030F
sha3_384: c5bbb4181e91805ca68eb25802a031e45c848b407d0c883856d205dd7e39222122f44c6425d1f768324a90daf3ceed16
ep_bytes: 68846b4000e8f0ffffff000000000000
timestamp: 2002-12-17 23:43:05

Version Info:
Translation: 0x0409 0x04b0
CompanyName: Digitope
FileDescription: FontPak
LegalCopyright: Copyright © 2001-2002 by Eric J. LeVin II & Daniel J. LeVin. All Rights Reserved.
LegalTrademarks: Digitope™, FontZip™, InstantInstall™ and FontPak™ are trademarks of Eric J. LeVin II. All Rights Reserved.
ProductName: Digitope FontZip
FileVersion: 3.05.0002
ProductVersion: 3.05.0002
InternalName: fontface
OriginalFilename: fontface.exe

Troj/Palevo-CX also known as:

Bkav	W32.AIDetectMalware
FireEye	Generic.mg.c00d053c7b79582f
Zillya	Trojan.Injector.Win32.280064
K7AntiVirus	Trojan ( 0055e3991 )
K7GW	Trojan ( 0055e3991 )
CrowdStrike	win/malicious_confidence_70% (D)
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
APEX	Malicious
Cynet	Malicious (score: 100)
NANO-Antivirus	Trojan.Win32.Palevo.ebbisv
SUPERAntiSpyware	Worm.Palevo/Variant
Sophos	Troj/Palevo-CX
F-Secure	Trojan.TR/Patched.Gen
McAfee-GW-Edition	Artemis
Ikarus	P2P-Worm.Win32.Palevo
Jiangmin	Worm.Palevo.i
Avira	TR/Patched.Gen
Microsoft	Trojan:Win32/Sabsik.TE.A!ml
Google	Detected
McAfee	Artemis!C00D053C7B79
VBA32	Worm.Palevo
Malwarebytes	Worm.Palevo
Yandex	Trojan.GenAsa!YuXofyTEjWU
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Cybereason	malicious.4065d8
DeepInstinct	MALICIOUS

How to remove Troj/Palevo-CX?

Troj/Palevo-CX removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X