Categories: Worm

UDS:Worm.Win32.Qvod.pkl (file analysis)

The UDS:Worm.Win32.Qvod.pkl is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What UDS:Worm.Win32.Qvod.pkl virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
Presents an Authenticode digital signature
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Attempts to modify proxy settings

How to determine UDS:Worm.Win32.Qvod.pkl?


File Info:
name: A44D1FDCD611A873ACF7.mlwpath: /opt/CAPEv2/storage/binaries/6a414635c60eca3b07db06383242f536b18281a9dea8b921b38fec4fcc8ec72bcrc32: 4D7D3ED6md5: a44d1fdcd611a873acf7b31066b6c334sha1: 339edd2064a13e12772e160eadc8b90fc2d9423bsha256: 6a414635c60eca3b07db06383242f536b18281a9dea8b921b38fec4fcc8ec72bsha512: ebbd00db138c503cb20897a407fcee0334f7ba180719a3ba2edd1c6cabf0389babc3dcc5c07fab422a5ce0107e915c47c65d2b27973327c19f7216408faeed81ssdeep: 49152:U6KaNfUp/cOxbyg/fGCVLBblMKTe1g3dGqb6iumB:pfU5cTgXzV9lMKd3dGqWiRtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1E3A5AE415BF7D1BEE013363347B6A3316139686816174BDE2AD8D72E3453EA01CEE6E8sha3_384: dc0519f4c9a6afe6f696065d372d2977ebcbef6b6d0e108e1160faef72bd5afc94d5a00600f6f67e036d44912f5ce040ep_bytes: 558bec6aff68e8dd46006890b3440064timestamp: 2015-04-15 10:09:35
Version Info:
Comments: CompanyName: FileDescription: STC-ISPFileVersion: 0, 6, 0, 85InternalName: STC-ISPLegalCopyright: CopyRight (C) 2010LegalTrademarks: OriginalFilename: STC-ISP.exePrivateBuild: ProductName: STC-ISP applicationProductVersion: 0, 6, 0, 85SpecialBuild: Translation: 0x0409 0x04b0

UDS:Worm.Win32.Qvod.pkl also known as:

Lionic	Trojan.Win32.Qvod.4!c
DrWeb	Trojan.DownLoader12.61994
MicroWorld-eScan	Gen:Win32.QVod.A
ClamAV	Win.Worm.Wapomi-9882044-0
FireEye	Generic.mg.a44d1fdcd611a873
ALYac	Gen:Win32.QVod.A
Malwarebytes	Generic.Worm.AutoRun.DDS
VIPRE	Gen:Win32.QVod.A
Sangfor	Trojan.Win32.Agent.Vvhd
Alibaba	Worm:Win32/Viking.14ec5026
CrowdStrike	win/malicious_confidence_60% (D)
BitDefenderTheta	Gen:NN.ZexaF.36196.fqueaS12Nacb
VirIT	Trojan.Win32.DownLoader12.DNSK
Cyren	W32/Pikorms.A.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Cynet	Malicious (score: 99)
Kaspersky	UDS:Worm.Win32.Qvod.pkl
BitDefender	Gen:Win32.QVod.A
NANO-Antivirus	Trojan.Win32.Hostar.vizob
Avast	Win32:Evo-gen [Trj]
Emsisoft	Gen:Win32.QVod.A (B)
F-Secure	Malware.W32/Viking.atdc.109
Baidu	Win32.Worm.Qvod.c
McAfee-GW-Edition	Artemis!Virus
Trapmine	malicious.moderate.ml.score
Sophos	Generic Reputation PUA (PUA)
SentinelOne	Static AI – Suspicious PE
GData	Gen:Win32.QVod.A
Avira	W32/Viking.atdc.109
MAX	malware (ai score=88)
Antiy-AVL	Virus/Win32.Qvod.b
Arcabit	Gen:Win32.QVod.A
ZoneAlarm	UDS:Worm.Win32.Qvod.pkl
Microsoft	Program:Win32/Wacapew.C!ml
McAfee	Artemis!A44D1FDCD611
VBA32	BScope.Trojan.Downloader
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R002H0CEN23
Rising	Trojan.Generic@AI.86 (RDMK:cmRtazrOEWNBPmei0iHKkFvrLxVr)
Yandex	Trojan.GenAsa!lve5S0fl5NI
Ikarus	Worm.Win32.Qvod
Fortinet	W32/PossibleThreat
AVG	Win32:Evo-gen [Trj]
Cybereason	malicious.cd611a
DeepInstinct	MALICIOUS