Categories: Trojan

Trojan.GenericPMF.S30132569 removal guide

The Trojan.GenericPMF.S30132569 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.GenericPMF.S30132569 virus can do?

A file was accessed within the Public folder.
Sample contains Overlay data
Reads data out of its own binary image
Drops a binary and executes it
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
The executable is compressed using UPX
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Anomalous binary characteristics
Uses suspicious command line tools or Windows utilities
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan.GenericPMF.S30132569?


File Info:
name: 5D2AE2259F357CF0A7AB.mlwpath: /opt/CAPEv2/storage/binaries/b9cdd13a88a934c191f097da315f9047029ba668b7d5d9e4c4daa060741720fbcrc32: ACE41568md5: 5d2ae2259f357cf0a7abed8d6c5df12bsha1: 4b2a4a2163ff13c3f4495c10f2a9b37ea7357e82sha256: b9cdd13a88a934c191f097da315f9047029ba668b7d5d9e4c4daa060741720fbsha512: 63b592835bf865b7aa4fddbb98807fdf78c3db00d35bfb8531a629d4d109e9aefbe9f29d1ce9da816a610a3a8f0ad13626ffae5ce4e1e2b67d76dc9e2584337fssdeep: 1536:zmDc/pULCHdf0T19yyX0tH28JZveKb7ucKoqII:yD/LxB9yyX0ECveG3KoBItype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T12AF3A379E7D1D852DC2B413D49E2A3E3AC95FC25D24E9A97FE80B74F8831D50EE14A02sha3_384: 2f66ec70268a99158f806d63f89223f35e35c81252b90055eb88522356be676c33c07c765c5fa8103c21048ca7c1797fep_bytes: 558bec6aff6870614000686039400064timestamp: 2017-05-04 13:36:19
Version Info:
Comments: MlhelloCompanyName: OMFGFileDescription: Clien Local RunProcessFileVersion: 10.0.14393.0 (rs1_release.160715-1616)InternalName: MlhelloLegalCopyright: All rights reserved.LegalTrademarks: MlhelloOriginalFilename: MlhelloPrivateBuild: MlhelloProductName: OMFG® Operating SystemProductVersion: 17.000.14393.08SpecialBuild: Translation: 0x0409 0x04b0

Trojan.GenericPMF.S30132569 also known as:

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
MicroWorld-eScan	Dropped:Generic.Dacic.DED21A61.A.C17632E8
ClamAV	Win.Trojan.Nitol-6335025-0
FireEye	Generic.mg.5d2ae2259f357cf0
CAT-QuickHeal	Trojan.GenericPMF.S30132569
ALYac	Dropped:Generic.Dacic.DED21A61.A.C17632E8
Malwarebytes	Generic.Trojan.ServStart.DDS
Zillya	Trojan.ServStart.Win32.25615
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 004bcce41 )
K7GW	Trojan ( 004bcce41 )
Cybereason	malicious.59f357
Baidu	Win32.Trojan.ServStart.as
Cyren	W32/Heuristic-114!Eldorado
Symantec	SMG.Heur!gen
Elastic	malicious (moderate confidence)
ESET-NOD32	Win32/ServStart.IK
Zoner	Trojan.Win32.126837
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-DDoS.Win32.Nitol.gen
BitDefender	Dropped:Generic.Dacic.DED21A61.A.C17632E8
NANO-Antivirus	Trojan.Win32.GenKryptik.fnpxyy
SUPERAntiSpyware	Trojan.Agent/Gen-Nitol
Avast	Win32:Nitol-B [Trj]
Tencent	Trojan-DdoS.Win32.Nitol.wa
Emsisoft	Dropped:Generic.Dacic.DED21A61.A.C17632E8 (B)
F-Secure	Trojan.TR/Crypt.XPACK.Gen5
DrWeb	Trojan.DownLoader24.51669
VIPRE	Dropped:Generic.Dacic.DED21A61.A.C17632E8
TrendMicro	TROJ_NITOL.SMN1
McAfee-GW-Edition	BehavesLike.Win32.Trojan.cz
Trapmine	malicious.high.ml.score
Sophos	Troj/Nitol-BF
SentinelOne	Static AI – Malicious PE
GData	Win32.Trojan.PSE1.1J91XNC
Jiangmin	Trojan.Generic.bhzka
Webroot	W32.Trojan.Gen
Avira	TR/Crypt.XPACK.Gen5
Antiy-AVL	Trojan/Win32.AGeneric
Xcitium	TrojWare.Win32.GameThief.Magania.~NWABI@1775fs
Arcabit	Generic.Dacic.DED21A61.A.C17632E8
ZoneAlarm	VHO:Trojan-DDoS.Win32.Nitol.gen
Microsoft	DDoS:Win32/Nitol!atmnm
Google	Detected
AhnLab-V3	Trojan/Win.Nitol.R457472
McAfee	Trojan-FOGN!5D2AE2259F35
MAX	malware (ai score=83)
VBA32	BScope.Trojan.Downloader
Cylance	unsafe
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_NITOL.SMN1
Rising	Backdoor.Overie!1.C6A2 (CLASSIC)
Yandex	Trojan.GenAsa!DM1KURgoIaA
Ikarus	Trojan.Win32.ServStart
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	MalwThreat!E1E6IV
BitDefenderTheta	Gen:NN.ZexaF.36318.jm1@airZkOaj
AVG	Win32:Nitol-B [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)