Trojan.Win32.SchoolBoy.ndi malicious file

The Trojan.Win32.SchoolBoy.ndi is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.SchoolBoy.ndi virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The executable is likely packed with VMProtect
• Authenticode signature is invalid
• Anomalous binary characteristics

How to determine Trojan.Win32.SchoolBoy.ndi?

File Info:
name: 9F054F997ED5AC06F719.mlw
path: /opt/CAPEv2/storage/binaries/5dac8b34632e0cdcd1fb4b74bb96bb0fcc53e3a6d781921487e8845e0985fda8
crc32: 1EFDAC7E
md5: 9f054f997ed5ac06f7198a4e68619f94
sha1: 27d1d557ee0e658f8ea0bae491ed4d01f8e9c7ee
sha256: 5dac8b34632e0cdcd1fb4b74bb96bb0fcc53e3a6d781921487e8845e0985fda8
sha512: 320fcece2c510277c4a0f9be0000d01b3a112c6bc25778ea202fa7b7f038a3c6aeacafd19cc0843db23c029716fe6608cb2dcb6967685fb234338f2239da2889
ssdeep: 6144:vWUBO17MqRgofChE4DQ8F6qLvp9qynbfh2bCipkCk3euWC3AOG4g562:v3BNNThEEF6qLvp9qynbfhWU3euWC33m
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A9648D1175E2C432D462113649B4D7B6493EB8304B6596EBB3C80B7EDF303C2AB75A6B
sha3_384: f8f64b744238eeebeb7ebe3124ce645823d79255b1a77d9533181e776d1921e2f93df52c684c368a7ae51e38e74bfb98
ep_bytes: e8623c0000e995feffff8bff558bec81
timestamp: 1970-01-01 05:23:36

Version Info:
0: [No Data]

Trojan.Win32.SchoolBoy.ndi also known as:

How to remove Trojan.Win32.SchoolBoy.ndi?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.