Trojan.Win32.Wecod.all (file analysis)

The Trojan.Win32.Wecod.all is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Wecod.all virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Dynamic (imported) function loading detected
• Enumerates running processes
• Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
• Unconventionial language used in binary resources: Korean
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid

How to determine Trojan.Win32.Wecod.all?

File Info:
name: 0055EB5EC52CEE11BFE6.mlw
path: /opt/CAPEv2/storage/binaries/2c3c3f194767e72da6afc67e1eb775af0a4238a094a1697d3f394ec8e9159d69
crc32: 0AEC754D
md5: 0055eb5ec52cee11bfe6a47943e65f37
sha1: e5c1d72edf21e4f2a5be6a8902b2e4eb57347bbc
sha256: 2c3c3f194767e72da6afc67e1eb775af0a4238a094a1697d3f394ec8e9159d69
sha512: 6d30d992c49db14bfab55a8a68a66d40712b1d2e04ab6668d3c765117459baab60d08820552f20e2487139c1141f0bedb2d4db1392f2ada1a02773afe69c657b
ssdeep: 3072:jBcyGvCKY6PYTZeAgYjPWrtfb5outzQIN3C9ISE0qJiNlUtcW4UW:7s+SYPPWrnoSzQISzqJBcz
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17E24DF52A6048898F31D0B725907F6E408998E7D68D4F15FF43CBE36A8722971EB724F
sha3_384: 02ead0c7350559fc3aab3bbcc39c46c56a2b1176d99b42fbe8697d1011cf1b7d023eef2955cb4b19771b0ac16cdb6a26
ep_bytes: 60be003048008dbe00e0f7ff5789e58d
timestamp: 2013-09-08 04:52:30

Version Info:
0: [No Data]

Trojan.Win32.Wecod.all also known as:

How to remove Trojan.Win32.Wecod.all?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.