Trojan:Win32/Occamy.CFA (file analysis)

The Trojan:Win32/Occamy.CFA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Occamy.CFA virus can do?

The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs

How to determine Trojan:Win32/Occamy.CFA?


File Info:
crc32: F07C4A72
md5: b0e7c5affe110644f86b6950b9ab0213
name: B0E7C5AFFE110644F86B6950B9AB0213.mlw
sha1: f090d97671aa27e0f037cf71691ded3f76e8c784
sha256: fa310aa7f861379540d41480c1d962beea5b66f3d97c9923854eb575d06e8abe
sha512: f5ced76dad6153b999776b0f5f1961e61432d90ca4acae22a95560512f5cac28d4f1c858433ec847e53840373cc5927cad0aa40d9cf02078d3cafa733e93d20f
ssdeep: 6144:wVh0LN0PXrvPVdNT6zncVUJKWehinoCnC:WJrlTT6zncVUJ7vn5C
type: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2019
Assembly Version: 1.0.0.0
InternalName: ProxyChecker.exe
FileVersion: 1.0.0.0
CompanyName: 
LegalTrademarks: 
Comments: 
ProductName: ProxyChecker
ProductVersion: 1.0.0.0
FileDescription: ProxyChecker
OriginalFilename: ProxyChecker.exe

Trojan:Win32/Occamy.CFA also known as:

K7AntiVirus	Riskware ( 0040eff71 )
Lionic	Trojan.Win32.Perseus.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.MSILPerseus.192261
Cylance	Unsafe
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.ffe110
Cyren	W32/MSIL_Troj.NT.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Malware-gen
BitDefender	Gen:Variant.MSILPerseus.192261
MicroWorld-eScan	Gen:Variant.MSILPerseus.192261
Ad-Aware	Gen:Variant.MSILPerseus.192261
Sophos	ML/PE-A
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
FireEye	Generic.mg.b0e7c5affe110644
Emsisoft	Gen:Variant.MSILPerseus.192261 (B)
SentinelOne	Static AI – Suspicious PE
Microsoft	Trojan:Win32/Occamy.CFA
Arcabit	Trojan.MSILPerseus.D2EF05
GData	Gen:Variant.MSILPerseus.192261
AhnLab-V3	Malware/Win32.RL_Generic.C3985463
McAfee	Artemis!B0E7C5AFFE11
MAX	malware (ai score=87)
Panda	Trj/CI.A
Ikarus	Trojan.MSIL.ClipBanker
MaxSecure	Trojan.Malware.7175203.susgen
Fortinet	PossibleThreat
AVG	Win32:Malware-gen
Paloalto	generic.ml
Qihoo-360	Win32/Trojan.Generic.HwMAOAUA

How to remove Trojan:Win32/Occamy.CFA?

Trojan:Win32/Occamy.CFA removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X