Ransom • Trojan

Trojan-Ransom.Win32.Encoder.loo (file analysis)

The Trojan-Ransom.Win32.Encoder.loo is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan-Ransom.Win32.Encoder.loo virus can do?

The binary likely contains encrypted or compressed data.
Uses Windows utilities for basic functionality
Installs itself for autorun at Windows startup

How to determine Trojan-Ransom.Win32.Encoder.loo?


File Info:
crc32: 9C99031C
md5: d3ff81021528c788321dccd52fe8e750
name: D3FF81021528C788321DCCD52FE8E750.mlw
sha1: fed6a1f6ecb3b88d8a986e7f2c7207e7e5befae4
sha256: 6a0e9c3180ff536f3ff3a78041707953f03e2437ab739a244c3c8ae3f5198bb8
sha512: 1c77028d1027bf6e27d65438b1f00cbf5b052ee0e586a051198dc2ae92823174ded592b59b202decc05256cbb78c46ab4298231f0dd2d7900e9d721810193867
ssdeep: 3072:H18c7+01m5GWp1icKAArDZz4N9GhbkrNEk1vM7:V8c7+Pp0yN90QED
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: Wextract                
FileVersion: 11.00.17134.1 (WinBuild.160101.0800)
CompanyName: Microsoft Corporation
ProductName: Internet Explorer
ProductVersion: 11.00.17134.1
FileDescription: Win32 Cabinet Self-Extractor                                           
OriginalFilename: WEXTRACT.EXE            .MUI
Translation: 0x0409 0x04b0

Trojan-Ransom.Win32.Encoder.loo also known as:

CAT-QuickHeal	Trojanransom.Encoder
Cylance	Unsafe
Zillya	Trojan.Encoder.Win32.2188
CrowdStrike	win/malicious_confidence_60% (W)
Kaspersky	Trojan-Ransom.Win32.Encoder.loo
SUPERAntiSpyware	Trojan.Agent/Gen-Downloader
Sophos	ML/PE-A
McAfee-GW-Edition	Artemis
AegisLab	Trojan.Win32.Encoder.j!c
ZoneAlarm	Trojan-Ransom.Win32.Encoder.loo
AhnLab-V3	Malware/Gen.Generic.C4345326
McAfee	Artemis!D3FF81021528
MaxSecure	Trojan.Malware.73926358.susgen
Qihoo-360	Win32/Heur.Generic.HxQBcqYA

How to remove Trojan-Ransom.Win32.Encoder.loo?

Trojan-Ransom.Win32.Encoder.loo removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X