Malware

Ursu.277611 (file analysis)

Malware Removal

The Ursu.277611 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Ursu.277611 virus can do?

  • Dynamic (imported) function loading detected
  • CAPE extracted potentially suspicious content
  • Authenticode signature is invalid

How to determine Ursu.277611?



File Info:

name: C9BEFBE1476708969745.mlw
path: /opt/CAPEv2/storage/binaries/47efdaab735d3d072fd52dbc9aea338ea8de9c5d8fa10af3aa585fe863c888bc
crc32: A58FD3CB
md5: c9befbe1476708969745cf05003dd47a
sha1: 49b20c3fd0ef81cb8f90c5cfa9f9c7d873532de4
sha256: 47efdaab735d3d072fd52dbc9aea338ea8de9c5d8fa10af3aa585fe863c888bc
sha512: b1be71fbc3a3cc162420bc4bcd7240a5a7d88a1ad0dc2986f585a3b8919dfdb4010abd2f76f502f0f73a5108d06a93d9b30664a2a1fac82e6775a89f92848032
ssdeep: 24576:YOQH4oyTnny34mwdyl8SSLcq7+H0e+7dc3:YOQH4oyTnnyImwdyl8TLcq7+H0eI
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15015F847F9906F67C03A2833C9A7587D82E9DA5F6B01DB0BB1F8532953623ED534224E
sha3_384: 331edda637807141b34c48e5deb77d7d60f4c0de0d8d96e984082861105c541a7dff0ede3f8eab449ae5cd3f07dff520
ep_bytes: ff250020400000000000000000000000
timestamp: 2018-02-11 14:27:47


Version Info:

Translation: 0x0000 0x04b0
CompanyName: Microsoft
FileDescription: WindowsApplication12
FileVersion: 1.0.0.0
InternalName: WindowsApplication12.exe
LegalCopyright: Copyright © Microsoft 2018
OriginalFilename: WindowsApplication12.exe
ProductName: WindowsApplication12
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Ursu.277611 also known as:

Elasticmalicious (high confidence)
CynetMalicious (score: 100)
FireEyeGeneric.mg.c9befbe147670896
McAfeeArtemis!C9BEFBE14767
CylanceUnsafe
ZillyaTrojan.Kryptik.Win32.1362570
SangforTrojan.Win32.Generic.ky
K7AntiVirusTrojan ( 00511d1d1 )
AlibabaTrojanDownloader:MSIL/Kryptik.7209f9c5
K7GWTrojan ( 00511d1d1 )
Cybereasonmalicious.147670
CyrenW32/MSIL_Bladabindi.AE.gen!Eldorado
SymantecTrojan.Gen.MBT
ESET-NOD32a variant of MSIL/Kryptik.KUV
APEXMalicious
Paloaltogeneric.ml
KasperskyHEUR:Trojan-Downloader.Win32.Generic
BitDefenderGen:Variant.Ursu.277611
NANO-AntivirusTrojan.Win32.Kryptik.exzmwf
MicroWorld-eScanGen:Variant.Ursu.277611
AvastMSIL:GenMalicious-DNX [Trj]
Ad-AwareGen:Variant.Ursu.277611
SophosMal/Generic-R + Troj/MSIL-HHC
ComodoMalware@#2rj7lr13wz9tg
VIPRETrojan.Win32.Generic!BT
McAfee-GW-EditionArtemis!Trojan
EmsisoftGen:Variant.Ursu.277611 (B)
SentinelOneStatic AI – Malicious PE
GDataGen:Variant.Ursu.277611
JiangminTrojanDownloader.Generic.bhbr
AviraTR/Dropper.MSIL.Gen
MAXmalware (ai score=88)
ArcabitTrojan.Ursu.D43C6B
MicrosoftTrojan:Win32/Dynamer!rfn
BitDefenderThetaGen:NN.ZemsilF.34084.2m0@aC3exQd
ALYacGen:Variant.Ursu.277611
VBA32TScope.Trojan.MSIL
TencentWin32.Trojan-downloader.Generic.Tayw
YandexTrojan.Kryptik!PqQOhWFd+K4
IkarusTrojan.MSIL.Crypt
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/MSIL.HHC!tr
AVGMSIL:GenMalicious-DNX [Trj]
PandaTrj/GdSda.A
CrowdStrikewin/malicious_confidence_100% (D)

How to remove Ursu.277611?

Ursu.277611 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment