Trojan:Win32/Delf.EM information

The Trojan:Win32/Delf.EM is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Delf.EM virus can do?

• A file with an unusual extension was attempted to be loaded as a DLL.
• Anomalous file deletion behavior detected (10+)
• Enumerates running processes
• Expresses interest in specific running processes
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Likely virus infection of existing system binary
• Harvests cookies for information gathering

How to determine Trojan:Win32/Delf.EM?

File Info:
name: BF427A37ED07B2E63703.mlw
path: /opt/CAPEv2/storage/binaries/b8e300dbf2cfe0d5a21e76b54556afc8014ce82405dec41f90aa7b0926885537
crc32: FD60B480
md5: bf427a37ed07b2e63703094439e493bc
sha1: 2b9cdd8a2aef012a58076808220f919b826b83a2
sha256: b8e300dbf2cfe0d5a21e76b54556afc8014ce82405dec41f90aa7b0926885537
sha512: 958b0a93cda4f5741e4c8408b9b1fecddfb1fabd0193666fa89dbe10a4ec01f8e52974e3fb453ebc7eaa84f8ad8d23ae13fe56af52f556f4b7dfdf04189285e1
ssdeep: 12288:4q6IMKOmkW+Dfhg0cvd5JIDvTJw1OvvUC:47mOmkDJnidcDvTK1UMC
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14EB48D457FE5C436C11259F24BCD5BD05CEEAE676C20048F2EC01A2EE9B4DB5C369B2A
sha3_384: f95467808b31be0d3e06ef90083f5ca47ff7aa5b3e787c9069968b26087905ce996a7be73554bb85c33298c8dccae57b
ep_bytes: 558becb98a0000006a006a004975f953
timestamp: 1992-06-19 22:22:17

Version Info:
CompanyName: Igor Pavlov
FileDescription: 7-Zip Console
FileVersion: 18.06
InternalName: 7z
LegalCopyright: Copyright (c) 1999-2018 Igor Pavlov
OriginalFilename: 7z.exe
ProductName: 7-Zip
ProductVersion: 18.06
Translation: 0x0409 0x04b0

Trojan:Win32/Delf.EM also known as:

How to remove Trojan:Win32/Delf.EM?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.