About “TrojanDropper.Pakes” infection

The TrojanDropper.Pakes is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDropper.Pakes virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• Unconventionial language used in binary resources: Korean
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid

How to determine TrojanDropper.Pakes?

File Info:
name: 5B4161E36F099BAB512B.mlw
path: /opt/CAPEv2/storage/binaries/83dd87a95ed21cbf00b66c53b65149225374691c78fb277a49086f4a3e74e165
crc32: EF81520B
md5: 5b4161e36f099bab512bb499dd00f4b4
sha1: 391914bee26ec0200851a22012da0e72de842dc4
sha256: 83dd87a95ed21cbf00b66c53b65149225374691c78fb277a49086f4a3e74e165
sha512: c15b226b03b88d2b739d49c87469adfda62de0fbd4de0276fde5b13fa367015005276ee5fecc5935b65c8ca87f9863f8d15584be43080fe90d23c9f9ab47e359
ssdeep: 24576:B4aLKcwKxidvG59hpb6VnD56jCDmukEOf6sDT1fWxRfB+mUQx:FLdwKxMo9Typ6pX14NDUq
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T110453361523C4DD8C2844F38E622510C1C76ACB7A9C53797FB6375D3BCB66A2EA2748C
sha3_384: d995a6c2c3381079abdca538d0e69558e057463f40d94846b1ebac2c113d1ab2d0745e97aeaded283f8a17d620337dfb
ep_bytes: 60be006045008dbe00b0faff57eb0b90
timestamp: 2010-03-28 14:46:16

Version Info:
CompanyName: ESTsoft Corp.
FileDescription: ALZip SFX
FileVersion: 10, 3, 28, 0
InternalName: ALZip SFX
LegalCopyright: Copyright (C) 2010 by ESTsoft Corp.
ProductName: ALZip 
ProductVersion: 10, 3, 28, 0
Translation: 0x0412 0x04b0

TrojanDropper.Pakes also known as:

How to remove TrojanDropper.Pakes?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.