Trojan-Dropper.Win32.Injector.pef removal guide

The Trojan-Dropper.Win32.Injector.pef is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Dropper.Win32.Injector.pef virus can do?

• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Deletes executed files from disk
• Anomalous binary characteristics
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan-Dropper.Win32.Injector.pef?

File Info:
name: 02BD4FDFAA3365DF69F8.mlw
path: /opt/CAPEv2/storage/binaries/55ac2baa1ac5dd245e3a0ec73f0adb839710ca8b047c999252dee742b20d5e97
crc32: AEBC73D2
md5: 02bd4fdfaa3365df69f8478090cd5d88
sha1: a297085e087130132bd023c04472926a946b63bd
sha256: 55ac2baa1ac5dd245e3a0ec73f0adb839710ca8b047c999252dee742b20d5e97
sha512: bf32abef2484edde0a99004a2aadb9ba95899782db55a4e23ea96bcfbe3d5b0d303b6475af1888193f981b30e811a2fd53792c44d200c40163e74ba4244356f7
ssdeep: 1536:17AvnKhWQtC3Izj6TrlDa2z6Ewd0zvPTQw9LBZRv8V3zhb:FAvKztiIzj6xtDLBZRv8Vj5
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T195937E00FAD594B0EC95377000E76BB6C1BA9DA1520B0BB36F64CE6B38B25B9BD35417
sha3_384: 2bbc789b25efba184a7445e316a920b5da92a3c3bf035406f7144fff798ad551acfc345c24df82fe6c62e5d719c1c2fd
ep_bytes: 558bec6aff689011151368dacf151364
timestamp: 2012-07-19 19:00:28

Version Info:
Comments: 1.5901.1.195
CompanyName: 网龙天晴数码
FileDescription: 网络游戏魔域客户端执行程序
FileVersion: 1, 5901, 1, 195
InternalName: soul.exe
LegalCopyright: 版权所有 (C) 2002
LegalTrademarks: 
OriginalFilename: 魔域.exe
PrivateBuild: 
ProductName: 魔域客户端执行程序
ProductVersion: 1, 0, 0, 1
SpecialBuild: 
Translation: 0x0804 0x04b0

Trojan-Dropper.Win32.Injector.pef also known as:

How to remove Trojan-Dropper.Win32.Injector.pef?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.