Categories: Trojan

About “Trojan-Dropper.Win32.NSIS.uwk” infection

The Trojan-Dropper.Win32.NSIS.uwk is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Dropper.Win32.NSIS.uwk virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction – unpacking
Creates RWX memory
Guard pages use detected – possible anti-debugging.
Dynamic (imported) function loading detected
Reads data out of its own binary image
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Attempts to modify proxy settings
Harvests cookies for information gathering

How to determine Trojan-Dropper.Win32.NSIS.uwk?


File Info:
name: E032C5A56575B7E389F2.mlwpath: /opt/CAPEv2/storage/binaries/c1e1a7f07412a900fef7bd930b384a6ce103e344dbccd964a7119baed333baf5crc32: A7639505md5: e032c5a56575b7e389f2344bc2fc5199sha1: 34853976ce6a604b8d0addad696a7b6e7f392090sha256: c1e1a7f07412a900fef7bd930b384a6ce103e344dbccd964a7119baed333baf5sha512: 2371a15400914b698924cdcfe07169892366a87ec3418d1fe04b422415f525c604372846aa45cc0ecf8b80dedd288474197b13eb47637df93b60e5d4b1177d46ssdeep: 12288:k0g6z7Ix/kZQ/RqOP/8O5ISCL/02tUBIxliM9f/Y70YIczVmjuldONAvA7KGbNuu:vrz7YsZkR1Hk/0kHLp9o9SudONgA7XUutype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T14515235623BA8976F8E11A711EB18688963FFC321C39C55E37866ECD3F71D808725362sha3_384: 4fd7ab57d09a4d16f736dabc44dc584e8d9b38efec2b5a287e9b01e2ec692d02340dc97162484bb993509cc441a605a5ep_bytes: 81ecd4020000535556576a2033ed5e89timestamp: 2012-02-24 19:20:04
Version Info:
Comments: This installation was built with Inno Setup.CompanyName: Ubisoft                                                     FileDescription: South Park The Stick of Truth - Update 1 Setup              FileVersion:                     LegalCopyright:                                                                                                     ProductName: South Park The Stick of Truth - Update 1                    ProductVersion: 1.0.1353                                          Translation: 0x0000 0x04b0

Trojan-Dropper.Win32.NSIS.uwk also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.41605440
FireEye	Generic.mg.e032c5a56575b7e3
McAfee	GenericR-KAI!E032C5A56575
Cylance	Unsafe
Zillya	Trojan.GenericKD.Win32.90210
Sangfor	Trojan.Win32.AGEN.1005415
Alibaba	TrojanDropper:Win32/Generic.b89e7f90
Cybereason	malicious.56575b
Symantec	ML.Attribute.HighConfidence
TrendMicro-HouseCall	TROJ_GEN.R002C0PB222
Paloalto	generic.ml
ClamAV	Win.Ransomware.Sodinokibi-9887839-0
Kaspersky	Trojan-Dropper.Win32.NSIS.uwk
BitDefender	Trojan.GenericKD.41605440
Avast	Win32:Malware-gen
Tencent	Win32.Trojan-dropper.Nsis.Agkg
Ad-Aware	Trojan.GenericKD.41605440
Emsisoft	Trojan.GenericKD.41605440 (B)
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0PB222
McAfee-GW-Edition	BehavesLike.Win32.Generic.cc
Sophos	Mal/Generic-S
GData	Trojan.GenericKD.41605440
Avira	HEUR/AGEN.1226334
MAX	malware (ai score=85)
Gridinsoft	Ransom.Win32.Sodinokibi.sa
ViRobot	Trojan.Win32.Z.Agent.891151
ZoneAlarm	Trojan-Dropper.Win32.NSIS.uwk
Microsoft	Trojan:Win32/Dynamer!ac
Cynet	Malicious (score: 99)
VBA32	TrojanDropper.uwk
ALYac	Trojan.GenericKD.41605440
APEX	Malicious
MaxSecure	Trojan.Malware.771626.susgen
Fortinet	W32/Uwk.KAI!tr
AVG	Win32:Malware-gen
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_100% (W)