Trojan:Win32/Farfli.AX!MTB (file analysis)

The Trojan:Win32/Farfli.AX!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Farfli.AX!MTB virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• At least one process apparently crashed during execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• Authenticode signature is invalid
• Anomalous binary characteristics

How to determine Trojan:Win32/Farfli.AX!MTB?

File Info:
name: 7A63FDEBD6450EE8423C.mlw
path: /opt/CAPEv2/storage/binaries/bacf013a1229502619f2b91a9e0b039a390a9da46c9933a196a29ce8a9c70cba
crc32: 9EC65D14
md5: 7a63fdebd6450ee8423c4f426f9517db
sha1: de4dedf23c249673c2d6605657298baeafa5eac8
sha256: bacf013a1229502619f2b91a9e0b039a390a9da46c9933a196a29ce8a9c70cba
sha512: 58d8b195652a693e03426cc431d5a0f6ac08fcb4298ce48ac010484adf032a71c1dd4993cd6f0c5354bc1f2ee080d36cf0f69107202ff57b14917a0931e88fe7
ssdeep: 49152:14xnUT9/zd+0nSwDL4BtTWmmf9KVQvRedRZdhA4j9T4lMgaLzsvXgY+:gUT9/zfnSwDLDmVQvRedRZdh7jRDLzsN
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T157959F3D3A5280B6D93335308A4DB3B9F6EEE9304E70929765951E392E701C39A1C76F
sha3_384: 513ee47e8759db0f25299cf01af191f9d4a955f4acf9a38ee6f4b92e175f6f207721a293702a5d8acae2ea7561006160
ep_bytes: e8f2e90000e989feffff8bff558bec53
timestamp: 2022-06-16 01:33:48

Version Info:
CompanyName: 
FileDescription: MVCSphere Microsoft 基础类应用程序
FileVersion: 1, 0, 0, 1
InternalName: MVCSphere
LegalCopyright: 版权所有 (C) 2005
LegalTrademarks: 
OriginalFilename: MVCSphere.EXE
ProductName: MVCSphere 应用程序
ProductVersion: 1, 0, 0, 1
Translation: 0x0804 0x04b0

Trojan:Win32/Farfli.AX!MTB also known as:

How to remove Trojan:Win32/Farfli.AX!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.