Categories: Trojan

TrojanDownloader:O97M/EncDoc.RDU!MTB removal

The TrojanDownloader:O97M/EncDoc.RDU!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:O97M/EncDoc.RDU!MTB virus can do?

At least one process apparently crashed during execution
Injection (inter-process)
Injection with CreateRemoteThread in a remote process
Uses Windows utilities for basic functionality
A potential decoy document was displayed to the user
Network activity detected but not expressed in API logs
Harvests information related to installed mail clients

How to determine TrojanDownloader:O97M/EncDoc.RDU!MTB?


File Info:
crc32: 38432BA7md5: ad085c2d0b11bd6268b5cf5e1f86c6d2name: upload_filesha1: 20aa89a8d2cb83226065e4ecf97799409f9fd2aesha256: 8d9a34f51bcef521b4dad284038743c1cce9b9481d558225e33add85c4c9173bsha512: 3ff47f33dc1fb6d9e9197c345153febe4388923ac7e27e87e3ea97d2bf7dde7dd62fcc02f2768fabd6ac4764bf48df0f0b6388719167b8b9ba1b350e16e44b12ssdeep: 3072:Pk3hOdsylKlgryzc4bNhZFGzE+cL2knEv7W495jlNgZ0rAA5rqapJwXqfRuyAWs:Pk3hOdsylKlgryzc4bNhZF+E+W2knu7type: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: DELL, Last Saved By: DELL, Create Time/Date: Thu Jul 30 13:09:21 2020, Last Saved Time/Date: Thu Jul 30 13:09:26 2020, Security: 0
Version Info:
0: [No Data]

TrojanDownloader:O97M/EncDoc.RDU!MTB also known as:

MicroWorld-eScan	Trojan.GenericKD.34266165
FireEye	Trojan.GenericKD.34266165
McAfee	RDN/Generic Downloader.x
F-Prot	X97M/Dloader.H
Symantec	W97M.Downloader
Avast	SNH:Script [Dropper]
ClamAV	Xls.Dropper.Agent-9158807-0
GData	Trojan.GenericKD.34266165
Kaspersky	HEUR:Trojan-Downloader.MSOffice.SLoad.gen
BitDefender	Trojan.GenericKD.34266165
ViRobot	XLS.Z.Agent.187392.P
AegisLab	Trojan.MSExcel.Generic.4!c
Rising	Downloader.Agent/VBA!1.C970 (CLASSIC)
Ad-Aware	Trojan.GenericKD.34266165
Emsisoft	Trojan.GenericKD.34266165 (B)
F-Secure	Malware.VBA/Dldr.Agent.fpwsh
DrWeb	Exploit.Siggen2.12788
Sophos	Troj/DocDl-AABN
Ikarus	Trojan-Downloader.VBA.Agent
Cyren	X97M/Dloader.H
Avira	VBA/Dldr.Agent.fpwsh
MAX	malware (ai score=81)
Endgame	malicious (high confidence)
Arcabit	HEUR.VBA.Trojan.d
ZoneAlarm	HEUR:Trojan-Downloader.MSOffice.SLoad.gen
Microsoft	TrojanDownloader:O97M/EncDoc.RDU!MTB
Cynet	Malicious (score: 85)
ALYac	Trojan.Downloader.XLS.gen
TACHYON	Suspicious/X97M.Downloader.Gen
Zoner	Probably Heur.W97Obfuscated
ESET-NOD32	VBA/TrojanDownloader.Agent.TXV
Tencent	Heur.Macro.Generic.e.d3d0a9e1
SentinelOne	DFI – Suspicious OLE
Fortinet	VBA/Agent.GAK!tr.dldr
AVG	SNH:Script [Dropper]
Qihoo-360	Generic/Trojan.Downloader.3f4