Ursu.436359 malicious file

The Ursu.436359 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.436359 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is likely packed with VMProtect
• Authenticode signature is invalid
• Tries to suspend Cuckoo threads to prevent logging of malicious activity

How to determine Ursu.436359?

File Info:
name: 847B14EE1DADD6051FA6.mlw
path: /opt/CAPEv2/storage/binaries/e4f7c96c34468ce4aa4cce6975e78913d435d2b0130258f9872b74ff303396a0
crc32: ACBF8FC6
md5: 847b14ee1dadd6051fa6cb9d4445875d
sha1: e123987aed46bbe464c552fa2d910d8efdde49b2
sha256: e4f7c96c34468ce4aa4cce6975e78913d435d2b0130258f9872b74ff303396a0
sha512: 1c5c01582008bd185033cf07d37568601e278f5e70c2089e98ae6e0447ab410d5578500ee3f9c64d1bbbc1def563e0ec3c1688a4572d734f16905399f8e4709e
ssdeep: 196608:AMUaISdxYiaEHMw0ucO7Q4eR2Mu2Xr4PU9B:bUaIoxgEssz+R2EcI
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T158862313032A0115F6EEDD3A9A1BEDF535F62F66CAC27CFC77D6B9C114724A2A206412
sha3_384: 33c4738979577bd2b370aaafe18df3869ad5ae7fa3930d590c0b856682bb825519b63f740f36f0ac41bd2099150d2ae1
ep_bytes: 6805aa38eae8c3caa1ffc1c1033ac3e9
timestamp: 2019-04-18 08:25:35

Version Info:
Comments: Developed  by Archeng
CompanyName: Realtek Semiconductor Corp.
FileDescription: Driver Setup API for Realtek HD Audio
FileVersion: 3, 2, 0, 2
InternalName: RtlUpd
LegalCopyright: Copyright (C) 2018 Realtek Semiconductor Corp.
OriginalFilename: RtlUpd.EXE
ProductName: Realtek HD Auido Update and remove driver Tool
ProductVersion: 3, 2, 0, 2
Translation: 0x0409 0x04b0

Ursu.436359 also known as:

How to remove Ursu.436359?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.