Categories: Trojan

TrojanDownloader:Win32/Farfli.PJ!bit (file analysis)

The TrojanDownloader:Win32/Farfli.PJ!bit is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:Win32/Farfli.PJ!bit virus can do?

Executable code extraction
At least one process apparently crashed during execution
Detected script timer window indicative of sleep style evasion
Reads data out of its own binary image
A process created a hidden window
Drops a binary and executes it
Performs some HTTP requests
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
A scripting utility was executed
Attempts to repeatedly call a single API many times in order to delay analysis time
Installs itself for autorun at Windows startup
Attempts to modify proxy settings
Creates a copy of itself

Related domains:

djking.f3322.net

How to determine TrojanDownloader:Win32/Farfli.PJ!bit?


File Info:
crc32: B2162622md5: b8d509a63c26aaff5b6f940d32aa81cbname: B8D509A63C26AAFF5B6F940D32AA81CB.mlwsha1: 01382da9f1a53a8421bd3c9ffa0beebe27e433e9sha256: ab6c0f4ae9d79e5dca906f224e89024ab0b6f594757ad93e60dc5efc00d863c1sha512: b1cad50eed82db8bf234e8dabb20e9dd2cd11d7e1cb79234690009f447d6e1eb3e452c2c9087b378f839c20f106e009486637b066ec49b71602414d32653e786ssdeep: 6144:2EuOjRKvGBiiOvHSZWlIjfOwJ5jz8H2mh5L:DJwecijz8type: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: x7248x6743x6240x6709(C) 2020InternalName: ClientFileVersion: 1, 0, 0, 1CompanyName:  PrivateBuild: LegalTrademarks: Comments: ProductName:   ClientSpecialBuild: ProductVersion: 1, 0, 0, 1FileDescription: ClientOriginalFilename: Client.exeTranslation: 0x0804 0x04b0

TrojanDownloader:Win32/Farfli.PJ!bit also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.35702711
FireEye	Generic.mg.b8d509a63c26aaff
CAT-QuickHeal	TrojanDownloader.Dupzom
ALYac	Trojan.GenericKD.35702711
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan-Downloader ( 004fcba51 )
BitDefender	Trojan.GenericKD.35702711
K7GW	Trojan-Downloader ( 004fcba51 )
Cybereason	malicious.9f1a53
Cyren	W32/Trojan.UNXG-2040
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Downloader.Win32.Dupzom.gen
Alibaba	TrojanDownloader:Win32/Farfli.9bfb2957
ViRobot	Trojan.Win32.Z.Farfli.744977
Rising	Downloader.Agent!8.B23 (TFE:5:5PuxP7r7DMH)
Ad-Aware	Trojan.GenericKD.35702711
Emsisoft	Trojan.GenericKD.35702711 (B)
Comodo	Malware@#3at5u7r6d8uxg
F-Secure	Trojan.TR/Dldr.Agent.bzwbx
DrWeb	Trojan.DownLoader36.28934
Zillya	Downloader.Dupzom.Win32.466
TrendMicro	BKDR_ZEGOST.SM17
McAfee-GW-Edition	GenericRXMY-QC!B8D509A63C26
Sophos	Mal/Generic-S
Ikarus	Trojan-Downloader.Win32.Agent
Jiangmin	TrojanDownloader.Dupzom.mv
Avira	TR/Dldr.Agent.bzwbx
eGambit	Unsafe.AI_Score_99%
MAX	malware (ai score=100)
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	TrojanDownloader:Win32/Farfli.PJ!bit
Gridinsoft	Trojan.Win32.Downloader.oa
Arcabit	Trojan.Generic.D220C7B7
ZoneAlarm	HEUR:Trojan-Downloader.Win32.Dupzom.gen
GData	Trojan.GenericKD.35702711
Cynet	Malicious (score: 100)
AhnLab-V3	Backdoor/Win32.Zegost.C4262848
McAfee	GenericRXMY-QC!B8D509A63C26
VBA32	BScope.Backdoor.Farfli
Malwarebytes	Backdoor.Farfli
Panda	Trj/CI.A
ESET-NOD32	a variant of Win32/TrojanDownloader.Agent.CWU
TrendMicro-HouseCall	BKDR_ZEGOST.SM17
Tencent	Win32.Trojan-downloader.Agent.Pijt
Yandex	Trojan.DL.Agent!VK8Nm8RZMSU
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/Agent.CWU!tr.bdr
BitDefenderTheta	Gen:NN.ZexaF.34700.Tq1@aSnrMJkb
AVG	Win32:Trojan-gen
Avast	Win32:Trojan-gen
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Generic/HEUR/QVM07.1.E92F.Malware.Gen