Trojan.Win32.Penguish malicious file

The Trojan.Win32.Penguish is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Penguish virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Presents an Authenticode digital signature
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan.Win32.Penguish?

File Info:
name: 5ABAC0A18F95A67D2682.mlw
path: /opt/CAPEv2/storage/binaries/f434d6dac54c5e6aced6c4485084f670f3492e6a11dbf03fb97bd097643766a6
crc32: 95FD8B29
md5: 5abac0a18f95a67d2682a8c74f12df78
sha1: 22e35d1c013f7ad2a379c93bb42c0ecf3580a709
sha256: f434d6dac54c5e6aced6c4485084f670f3492e6a11dbf03fb97bd097643766a6
sha512: e36d0a627e76cb35aa37f597e98a7c95a715eb520213238bc2820e748969af8b5c9253735a91c5c0c1178f4816e1b3b9a493e3aadd5e13ca6365757422eef1b7
ssdeep: 196608:HT2k2aa+1z/cTMmBtva581C9r1ItVFFxRT/ij:z2Oa+WwmjHC9r1IpnS
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T104662333B6914036EAF14077B82541343E7CB328576549FEE3D4BA1D6EB84825BB732A
sha3_384: edc1c61a2258c213d4dd5c8c66c9478449001918e673da33251f44ad8f337467ead9f00fb6caf069bc365a5b53585e31
ep_bytes: e83a050000e97afeffffcccccccccc8b
timestamp: 2019-09-17 05:33:38

Version Info:
CompanyName: Plarium
FileDescription: Plarium Play
FileVersion: 8.7.0
InternalName: setup
LegalCopyright: Copyright (c) Plarium. All rights reserved.
OriginalFilename: PlariumPlaySetup.exe
ProductName: Plarium Play
ProductVersion: 8.7.0
Translation: 0x0409 0x04e4

Trojan.Win32.Penguish also known as:

How to remove Trojan.Win32.Penguish?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.