Categories: Trojan

Trojan.Win32.Wecod.all (file analysis)

The Trojan.Win32.Wecod.all is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Wecod.all virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Dynamic (imported) function loading detected
Enumerates running processes
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Unconventionial language used in binary resources: Korean
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid

How to determine Trojan.Win32.Wecod.all?


File Info:
name: 0055EB5EC52CEE11BFE6.mlwpath: /opt/CAPEv2/storage/binaries/2c3c3f194767e72da6afc67e1eb775af0a4238a094a1697d3f394ec8e9159d69crc32: 0AEC754Dmd5: 0055eb5ec52cee11bfe6a47943e65f37sha1: e5c1d72edf21e4f2a5be6a8902b2e4eb57347bbcsha256: 2c3c3f194767e72da6afc67e1eb775af0a4238a094a1697d3f394ec8e9159d69sha512: 6d30d992c49db14bfab55a8a68a66d40712b1d2e04ab6668d3c765117459baab60d08820552f20e2487139c1141f0bedb2d4db1392f2ada1a02773afe69c657bssdeep: 3072:jBcyGvCKY6PYTZeAgYjPWrtfb5outzQIN3C9ISE0qJiNlUtcW4UW:7s+SYPPWrnoSzQISzqJBcztype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T17E24DF52A6048898F31D0B725907F6E408998E7D68D4F15FF43CBE36A8722971EB724Fsha3_384: 02ead0c7350559fc3aab3bbcc39c46c56a2b1176d99b42fbe8697d1011cf1b7d023eef2955cb4b19771b0ac16cdb6a26ep_bytes: 60be003048008dbe00e0f7ff5789e58dtimestamp: 2013-09-08 04:52:30
Version Info:
0: [No Data]

Trojan.Win32.Wecod.all also known as:

tehtris	Generic.Malware
MicroWorld-eScan	Gen:Heur.Mint.SP.Urelas.1
CAT-QuickHeal	Trojan.Urelas.B6
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Spyware ( 00588d7d1 )
K7GW	Spyware ( 00588d7d1 )
Cybereason	malicious.ec52ce
Baidu	Win32.Trojan.Urelas.d
VirIT	Trojan.Win32.Generic.CONR
Cyren	W32/CardSpy.I.gen!Eldorado
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Spy.CardSpy.NAF
APEX	Malicious
Kaspersky	Trojan.Win32.Wecod.all
BitDefender	Gen:Heur.Mint.SP.Urelas.1
NANO-Antivirus	Trojan.Win32.Wecod.fmwmwh
Avast	Win32:TrojanX-gen [Trj]
Tencent	Trojan.Win32.CardSpy.16000130
Ad-Aware	Gen:Heur.Mint.SP.Urelas.1
Sophos	ML/PE-A + Troj/Cardspy-G
Comodo	TrojWare.Win32.Urelas.E@51wwjn
DrWeb	Trojan.AVKill.63827
Zillya	Trojan.FakeAV.Win32.314405
McAfee-GW-Edition	BehavesLike.Win32.Corrupt.dc
Trapmine	suspicious.low.ml.score
FireEye	Generic.mg.0055eb5ec52cee11
Emsisoft	Gen:Heur.Mint.SP.Urelas.1 (B)
Ikarus	Trojan.Win32.Gupboot
GData	Win32.Trojan.PSE.13IJRMU
Jiangmin	Trojan/Wecod.dh
Avira	TR/Crypt.Agent.PXL
Arcabit	Trojan.Mint.SP.Urelas.1
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Backdoor/Win32.Plite.R81822
Acronis	suspicious
McAfee	GenericRXAA-AA!0055EB5EC52C
MAX	malware (ai score=85)
VBA32	Trojan.AVKill
Malwarebytes	Urelas.Spyware.Stealer.DDS
Zoner	Probably Heur.ExeHeaderL
Rising	Spyware.CardSpy!1.A1A8 (CLASSIC)
Yandex	Trojan.GenAsa!e5GHY94i0Lg
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Wecod.ALL!tr
BitDefenderTheta	Gen:NN.ZexaF.34712.nmHfa0S!RsiO
AVG	Win32:TrojanX-gen [Trj]
Panda	Generic Suspicious
CrowdStrike	win/malicious_confidence_70% (D)