Categories: Trojan

Trojan:Win32/Blinder (file analysis)

The Trojan:Win32/Blinder is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Blinder virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Executable file is packed/obfuscated with ASPack
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Binary file triggered YARA rule
Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan:Win32/Blinder?


File Info:
name: 7594AD17004F1CAB99C6.mlwpath: /opt/CAPEv2/storage/binaries/1f5125f10f55d2735a592deb3d0302a1fbb6c31ab91d028bd8a9fb1e359f4d3acrc32: 0253E6E1md5: 7594ad17004f1cab99c650f64d8d5c59sha1: 5105bb17eb3f70f1411e7c7ac96b1b8acd88d85asha256: 1f5125f10f55d2735a592deb3d0302a1fbb6c31ab91d028bd8a9fb1e359f4d3asha512: 9b339c503ba3850d6b0445bf218f1f516af80265ad6981d8321ef1ba8f028015adff463a0b833bae97ada2f0569ebab026667975e33c48f550eec85b3145511cssdeep: 768:ra5nac5lWMjJHtMNUQs428NH8xAUgVWxb47Plo+8VKUExXdeVb+oUxfdeVr:raZZXW2JNMNLI8NcOUQazIe+/Utype: PE32 executable (DLL) (GUI) Intel 80386, for MS Windowstlsh: T1AB43D0B2DC5D48FAECCB213214BC792B983E693D81149A8B93F844AB3906325EC5CD57sha3_384: a643bdb9ea6802fc9da03a30bdb1a315f966b15beda0384b823241511b83b7ac3237fdd8f33abb271f667f9b9bb452d5ep_bytes: 60e803000000e9eb045d4555c3e80100timestamp: 1992-06-19 22:22:17
Version Info:
0: [No Data]

Trojan:Win32/Blinder also known as:

Bkav	W32.AIDetectMalware
Lionic	Virus.Win32.Elkern.kZkM
Elastic	malicious (high confidence)
DrWeb	Trojan.Inspr.11
MicroWorld-eScan	Trojan.Blinder.A
CMC	Generic.Win32.7594ad1700!MD
Skyhigh	BehavesLike.Win32.Eggnog.qh
McAfee	GenericRXAA-FA!7594AD17004F
Cylance	unsafe
Zillya	Trojan.Blinder.Win32.3
Sangfor	Trojan.Win32.Blinder.Vjpc
CrowdStrike	win/malicious_confidence_100% (D)
Alibaba	Trojan:Win32/Blinder.f303235b
K7GW	Riskware ( 0040eff71 )
K7AntiVirus	Riskware ( 0040eff71 )
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	Win32/Blinder
APEX	Malicious
ClamAV	Win.Trojan.Blinder-1
Kaspersky	Trojan.Win32.Blinder
BitDefender	Trojan.Blinder.A
NANO-Antivirus	Trojan.Win32.Blinder.ctczfw
Avast	Win32:Trojan-gen
Tencent	Malware.Win32.Gencirc.13bc7bfb
Emsisoft	Trojan.Blinder.A (B)
F-Secure	Trojan.TR/Blinder.2
VIPRE	Trojan.Blinder.A
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.7594ad17004f1cab
Sophos	Mal/Generic-R
SentinelOne	Static AI – Suspicious PE
MAX	malware (ai score=100)
Jiangmin	Trojan/Blinder.a
Google	Detected
Avira	TR/Blinder.2
Varist	W32/Trojan.JSBH-0754
Antiy-AVL	Trojan/Win32.Blinder
Kingsoft	Win32.Trojan.Blinder.a
Microsoft	Trojan:Win32/Blinder
Xcitium	Malware@#i52due7war7h
Arcabit	Trojan.Blinder.A
ZoneAlarm	Trojan.Win32.Blinder
GData	Trojan.Blinder.A
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Hupigon.C29166
VBA32	Trojan.Blinder
ALYac	Trojan.Blinder.A
Panda	Trojan Horse
Rising	Trojan.Blinder (CLASSIC)
Yandex	Trojan.GenAsa!KfEiXl9gxCc
Ikarus	Trojan-Spy.Win32.Beacon
MaxSecure	Trojan.Malware.692300.susgen
Fortinet	W32/Blinder.A!tr
AVG	Win32:Trojan-gen
DeepInstinct	MALICIOUS
alibabacloud	Trojan:Win/Blinder.A