Trojan:Win32/Tinba!pz information

The Trojan:Win32/Tinba!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Tinba!pz virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Lithuanian (Classic)
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Behavioural detection: Injection (inter-process)
• CAPE detected the embedded win api malware family
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan:Win32/Tinba!pz?

File Info:
name: 44852E31A9A5620EB658.mlw
path: /opt/CAPEv2/storage/binaries/01a207c9ff2fd1d4bdb490ea2a526afecea5a51358180dadf7c277e3deba8fd6
crc32: 4B1EEDFA
md5: 44852e31a9a5620eb658628d39b0dd8a
sha1: 50dc895f6fc3ae76f7036a8f2e3b5599ad164f38
sha256: 01a207c9ff2fd1d4bdb490ea2a526afecea5a51358180dadf7c277e3deba8fd6
sha512: bd534f90bacbb546d625b8f0a5fa914109a8814ea4d012d7bf23ba6dae803aec6ebf073d04d25e0a2d6a9c4b01ba2da312b777179e1d7183d3c9e7e659825944
ssdeep: 768:ENMbiFKPoBeVxrcCsUmWkp3rD7GpxkTIzQMBImGaNGyUwq9JaTovtebSo:EW7oBxCsUVE3r+B1G1CutY
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12D43B5266F8F0173F675FEB7192F41B6DB22E8314924493A1EABF6061D39E42344770A
sha3_384: 475cd63c45b453fab29208e11fcfa7665a29465120c8c035a7fa40959469d979548c23922eb11eaaf7d7375aa00b0247
ep_bytes: 682c204000e8f0ffffff000000000000
timestamp: 2014-08-06 04:01:00

Version Info:
Translation: 0x0409 0x04b0
CompanyName: Dr. W. Kutschera
FileDescription: "Iekљzemes kopprodukts (IKP) ir valsts tautsaimnieciba gada laika saraћotais galaprodukts naudas izteiksme.
LegalCopyright: Dr. W. Kutschera et al.) took place at the IKP in the framework of the BCGS (Bonn-Cologne Graduate School)
ProductName: Dr. W. Kutschera
FileVersion: 1.00.0227
ProductVersion: 1.00.0227
InternalName: Tenmnajswish
OriginalFilename: Tenmnajswish.exe

Trojan:Win32/Tinba!pz also known as:

How to remove Trojan:Win32/Tinba!pz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.