Trojan-Ransom.Win32.Blocker.dvjn (file analysis)

The Trojan-Ransom.Win32.Blocker.dvjn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Ransom.Win32.Blocker.dvjn virus can do?

Executable code extraction
Creates RWX memory
A process created a hidden window
Uses Windows utilities for basic functionality
Sniffs keystrokes

Related domains:

z.whorecord.xyz

a.tomx.xyz

daloom.no-ip.org

How to determine Trojan-Ransom.Win32.Blocker.dvjn?


File Info:
crc32: E553E4D8
md5: df489cac7af964875cfad9a148dc5c2d
name: DF489CAC7AF964875CFAD9A148DC5C2D.mlw
sha1: c8860e8d79f6c849cfda8072d772e7907124be3d
sha256: 404fe443fc9aee4396cc907253a5deca53c58800f7ad8f4b5d32ae790fd44896
sha512: b50c1197404f2c8670d7602ffd518af7940b50b779838fca2028e4ca9f7944da71bc5035cc75d9a99817f552bd6e1b093610bcb49bf7f1db7e1acf523d560b32
ssdeep: 3072:2K+F24wkM3QU5HdTJN/iRVUlP4ZSrjzPyq9b46+7ktUEBFG0+Zu99fMCe+0A1tB:rkERJNMVUlPdfPb4F7UYEEh+0A1tB2
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright:  
Assembly Version: 0.0.0.0
InternalName: 1aaaaa.exe
FileVersion: 0.0.0.0
ProductVersion: 0.0.0.0
FileDescription:  
OriginalFilename: 1aaaaa.exe

Trojan-Ransom.Win32.Blocker.dvjn also known as:

Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader18.23009
Cynet	Malicious (score: 100)
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_60% (D)
Alibaba	Ransom:Win32/Blocker.015d56d9
Cybereason	malicious.c7af96
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDropper.Agent.BJO
APEX	Malicious
Avast	FileRepMalware
Kaspersky	Trojan-Ransom.Win32.Blocker.dvjn
BitDefender	Gen:Heur.MSIL.Bladabindi.1
NANO-Antivirus	Trojan.Win32.Blocker.dzttzt
MicroWorld-eScan	Gen:Heur.MSIL.Bladabindi.1
Tencent	Win32.Trojan.Blocker.Wtnk
Ad-Aware	Gen:Heur.MSIL.Bladabindi.1
Comodo	Malware@#1uazjtl52ag19
BitDefenderTheta	Gen:NN.ZemsilF.34790.qq0@a05u@Qh
VIPRE	Trojan.Win32.Generic!BT
FireEye	Generic.mg.df489cac7af96487
Emsisoft	Gen:Heur.MSIL.Bladabindi.1 (B)
SentinelOne	Static AI – Malicious PE
Avira	HEUR/AGEN.1114270
Antiy-AVL	Trojan/Generic.ASBOL.1B87
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Backdoor:MSIL/Bladabindi
GData	Gen:Heur.MSIL.Bladabindi.1
AhnLab-V3	Trojan/Win32.Inject.C681026
McAfee	Artemis!DF489CAC7AF9
MAX	malware (ai score=100)
VBA32	Hoax.Blocker
Panda	Trj/GdSda.A
Yandex	Trojan.Blocker!ypXUXxpah3I
Ikarus	Trojan.MSIL2
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Blocker.BJO!tr
AVG	FileRepMalware
Paloalto	generic.ml
Qihoo-360	Win32/Ransom.Blocker.HwMAEpsA

How to remove Trojan-Ransom.Win32.Blocker.dvjn?

Trojan-Ransom.Win32.Blocker.dvjn removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan-Ransom.Win32.Blocker.dvjn (file analysis)