Trojan.Win32.Inject.anzau (file analysis)

The Trojan.Win32.Inject.anzau is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Inject.anzau virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Uses Windows utilities for basic functionality
• Deletes its original binary from disk
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location
• CAPE detected the Formbook malware family
• Uses suspicious command line tools or Windows utilities

How to determine Trojan.Win32.Inject.anzau?

File Info:
name: B775EB8BA875EFB94655.mlw
path: /opt/CAPEv2/storage/binaries/ebae4c196d8a58491f149c1f561b8dfcb7286b5b5e14ee85bd2393a968a498b9
crc32: 9AA20EF0
md5: b775eb8ba875efb94655af48abd24591
sha1: 997519e42fc9369f98b4839c0d74e9557d3dbea7
sha256: ebae4c196d8a58491f149c1f561b8dfcb7286b5b5e14ee85bd2393a968a498b9
sha512: 88fd1c1a4672b260f11914906122721cc64948d2fd5080a8cfd832baee7d8ba513c4178fc7afdc6166dce8ab3e8868a2d7e910a5cd8b1d4ec775ace5f56bfdc0
ssdeep: 6144:rGiG9xDwpAZS3oCensOPbX/0Z6JQDuUkH+iB7CsvJamJFOSQ6YFUonGwiDRY1:69xBZRzsmMZ5KUkeiBeWJaEg16YyoGwz
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T147642343BAC240EBE6B15A386873D77CFF79868406740C037B953FA63AB53D7450A2A1
sha3_384: 70e3af725c910999822ad68b8e9b50ed83bd74677fb1c5fcae771355426a6cba6614001d1d63d45b243c04e180196854
ep_bytes: 81ec8001000053555633db57895c2418
timestamp: 2008-10-10 21:49:01

Version Info:
0: [No Data]

Trojan.Win32.Inject.anzau also known as:

How to remove Trojan.Win32.Inject.anzau?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.