TrojanDownloader:O97M/EncDoc.PML!MTB removal

The TrojanDownloader:O97M/EncDoc.PML!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:O97M/EncDoc.PML!MTB virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Dynamic (imported) function loading detected
• At least one IP Address, Domain, or File Name was found in a crypto call
• Reads data out of its own binary image
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• A ping command was executed with the -n argument possibly to delay analysis
• Uses Windows utilities for basic functionality
• Deletes its original binary from disk

How to determine TrojanDownloader:O97M/EncDoc.PML!MTB?

File Info:
name: 3FDE2E0DA899A173E698.mlw
path: /opt/CAPEv2/storage/binaries/f0ddfdda56df67d11cba87a61e65f3921cd5318818d5b7e620e71974744d54ac
crc32: 77458A75
md5: 3fde2e0da899a173e69828eaf81c0543
sha1: b681688889187bf18e0d9ecf546d78c712a4a033
sha256: f0ddfdda56df67d11cba87a61e65f3921cd5318818d5b7e620e71974744d54ac
sha512: a90b241465a65e77e395ea8382d2f01c90dc6801df0be6bb3618ad400bf7c2d795ae13db58f8a60b1a64179c71893f856ea2f6077d493e39e10897da2d0bca61
ssdeep: 98304:ma8yD+61Dcn2BlJPD8Nzl2bT8mRaw8GFvuztrxcwW1AQBze0Wcn:MyC61nt8NPLwJ+VfSFBGo
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1225633D9127C871BF7E63D34B8BB2DD19F70AC866E78825E22E13C98197371A5814F24
sha3_384: be8ef8fb02b579e0f009e93f921343dbc76c1a6f17623b8fc3a1e36b9304aaf67d2079967cd417c7bc613729657d6451
ep_bytes: 60be00009d008dbe0010a3ff57eb0b90
timestamp: 2019-03-18 06:57:05

Version Info:
FileVersion: 6.1.19.318
LegalCopyright: Copyright © 2013-2015
ProductVersion: 6.1.19.318
授权方式: arFi
Translation: 0x0804 0x04b0

TrojanDownloader:O97M/EncDoc.PML!MTB also known as:

How to remove TrojanDownloader:O97M/EncDoc.PML!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.