Ursu.147479 (B) removal tips

The Ursu.147479 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ursu.147479 (B) virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Ursu.147479 (B)?


File Info:
name: 9239C7A98FB2346C9D0F.mlw
path: /opt/CAPEv2/storage/binaries/96295f95791423ac9daa33c4a91addd21c5db62c2b6f5f79232301be345132ae
crc32: 4F0EA1E6
md5: 9239c7a98fb2346c9d0f781c3c0f61b5
sha1: d78e22b215c5ac574e340e02c1b3eb9a45009ce1
sha256: 96295f95791423ac9daa33c4a91addd21c5db62c2b6f5f79232301be345132ae
sha512: 27cfe3c2b921387fc609cd257a6998a5d6be962dba8301278c13e9c309580a46c96c0bcee7feef6c729f893d114e99a88a355445456af01ba79bddcdc9d9f413
ssdeep: 12288:vp/Z1EUBznpm5E5zI8L18Q+F7hmnVtyVANb8tHVHtC0:R/ZaUBzDF8Qq7w/0
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T155352FD635E46B45D62DB33C43BB64689BEED93AE308FF253F4020C944923C4DA51BA6
sha3_384: 08e73ac12f1ff2cbcef8c1a19fdbd3b0e4a276b375efd570f11dccb3af570343b1a590511c2660381a55cd500248b5c1
ep_bytes: ff250020400000000000000000000000
timestamp: 2021-11-28 21:01:48

Version Info:
Translation: 0x0000 0x04b0
Comments: HHHHHHHHHHHHHHHHHHHHH
CompanyName: HHHHHHHHHHHHHHHHHHHHH
FileDescription: HHHHHHHHHHHHHHHHHHHHH
FileVersion: 1.0.0.0
InternalName: HHHHHHHHHHHHHHHHHHHHH.exe
LegalCopyright: HHHHHHHHHHHHHHHHHHHHH
LegalTrademarks: HHHHHHHHHHHHHHHHHHHHH
OriginalFilename: HHHHHHHHHHHHHHHHHHHHH.exe
ProductName: HHHHHHHHHHHHHHHHHHHHH
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Ursu.147479 (B) also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Ursu.147479
CAT-QuickHeal	Backdoor.Fynloski.A3
Malwarebytes	Malware.AI.1007127234
CrowdStrike	win/malicious_confidence_60% (D)
BitDefender	Gen:Variant.Ursu.147479
Symantec	Backdoor.Ratenjay
ESET-NOD32	a variant of MSIL/Injector.NHG
APEX	Malicious
ClamAV	Win.Packed.Zusy-7399662-0
Ad-Aware	Gen:Variant.Ursu.147479
Emsisoft	Gen:Variant.Ursu.147479 (B)
DrWeb	Trojan.PackedNET.149
FireEye	Generic.mg.9239c7a98fb2346c
Sophos	ML/PE-A
GData	Gen:Variant.Ursu.147479
Avira	HEUR/AGEN.1108977
MAX	malware (ai score=87)
Arcabit	Trojan.Ursu.D24017
SUPERAntiSpyware	Trojan.Agent/Gen-Faker
Microsoft	Backdoor:MSIL/Bladabindi.AJ
Cynet	Malicious (score: 99)
ALYac	Gen:Variant.Ursu.147479
SentinelOne	Static AI – Malicious PE
BitDefenderTheta	Gen:NN.ZemsilF.34294.cr0@auC!HUd
Cybereason	malicious.98fb23
MaxSecure	Trojan.Malware.300983.susgen

How to remove Ursu.147479 (B)?

Ursu.147479 (B) removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X