Trojan.AgentWDCR.PM (B) (file analysis)

The Trojan.AgentWDCR.PM (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.AgentWDCR.PM (B) virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Attempts to connect to a dead IP:Port (2 unique times)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Deletes its original binary from disk
• Behavioural detection: Injection (inter-process)
• Installs itself for autorun at Windows startup
• Creates a copy of itself
• Collects information to fingerprint the system
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities

How to determine Trojan.AgentWDCR.PM (B)?

File Info:
name: B3F2525E50032476C2D8.mlw
path: /opt/CAPEv2/storage/binaries/11eaaaee2290a88e1ad739208172dfd41cb82b5d4c4ac2a358edbc14c2b6fa06
crc32: F71FF692
md5: b3f2525e50032476c2d8b9faf1f81e39
sha1: 3219ac01e19a9981e4706f03ec12a429109fa95c
sha256: 11eaaaee2290a88e1ad739208172dfd41cb82b5d4c4ac2a358edbc14c2b6fa06
sha512: d3fcf8897e27aeef4ed2830685b779ae5444cd2704847dbaf23e8b97f31da2b5ff549c406ec84e3927ad2c82561bfe0ed14a7605c0cb20a115169512332375dd
ssdeep: 1536:FTkFSs1VXERUiyiF5dYfPJWkV+9+oSwwTsvYj+MEJWUv/PIzC5PeNbSXrxVk1nfA:F6nuUOnQ+9+zkMPS/YieNerENO
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B1D39EE07A50DDB3F5913B344BA2AD55A2A77D219B320B4B17F4C00DCD21291EDABA3D
sha3_384: b82b7f4f2825ad21ef2987699f25b49d3a92c545a3c2a9acd6db77f316071541ded02b8f170c464f71d76f0e7bf25c77
ep_bytes: e8b9ad0000e926980000e84f9e0000ff
timestamp: 2011-08-02 11:59:07

Version Info:
0: [No Data]

Trojan.AgentWDCR.PM (B) also known as:

How to remove Trojan.AgentWDCR.PM (B)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.