Categories: Malware

What is “Ursu.439982”?

The Ursu.439982 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.439982 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Creates RWX memory
Guard pages use detected – possible anti-debugging.
Dynamic (imported) function loading detected
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Anomalous .NET characteristics
Anomalous binary characteristics

How to determine Ursu.439982?


File Info:
name: F49AD1EC9801F4157B9C.mlwpath: /opt/CAPEv2/storage/binaries/9c2cd69fce2993901198dfdb668d4d7ee90a81326929bd45553d817472095f15crc32: 7C807B0Dmd5: f49ad1ec9801f4157b9cd14a3433c3absha1: c3bc8045b38b6f96b0fb711e2acf89c14be20764sha256: 9c2cd69fce2993901198dfdb668d4d7ee90a81326929bd45553d817472095f15sha512: 9f958d3fcd7f66c23fb6352fbb767a98c91972537468b36b77a89229aeec92f67796df59bc31134e4ef0e4eb5faccd7cf32f2ca2248e8fbb184b1e9c13e77ca5ssdeep: 768:0ic/FJux5G8n+X2o9S/LVTMb2DKZXFG+Q:s/25Gfx9U5wjUVtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1B9C2D00717C34C37C9BC4F7107632AA0A392D65929EA4A37C6D59A7DAFB61510FB2343sha3_384: 0b5c82842895f29e2137b61eef13407a3bd8edb184fd05b49cc2a81e036931f08949bf3db4d850c2871680fada45ea80ep_bytes: ff250020400000000000000000000000timestamp: 2009-04-05 09:38:32
Version Info:
0: [No Data]

Ursu.439982 also known as:

Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
DrWeb	Win32.HLLW.Autoruner.25074
MicroWorld-eScan	Gen:Variant.Ursu.439982
FireEye	Generic.mg.f49ad1ec9801f415
ALYac	Gen:Variant.Ursu.439982
Cylance	Unsafe
Zillya	Trojan.Generic.Win32.349169
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:Win32/Jorik.1011a4e1
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.c9801f
BitDefenderTheta	Gen:NN.ZemsilF.34084.bmY@aSFtSnl
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Trojan.Agent-1163927
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Ursu.439982
NANO-Antivirus	Trojan.Win32.Autoruner.fknpqa
SUPERAntiSpyware	Trojan.Agent/Gen-Gal
Avast	MSIL:Bladabindi-HZ [Wrm]
Tencent	Win32.Trojan.Generic.Eddq
Ad-Aware	Gen:Variant.Ursu.439982
Emsisoft	Gen:Variant.Ursu.439982 (B)
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.mc
Sophos	Mal/Generic-S
GData	Gen:Variant.Ursu.439982
Avira	HEUR/AGEN.1121954
MAX	malware (ai score=87)
Antiy-AVL	Trojan/Generic.ASMalwS.1A17A9
Microsoft	Backdoor:Win32/Bladabindi!ml
Cynet	Malicious (score: 100)
McAfee	RDN/Generic.grp
VBA32	TScope.Trojan.MSIL
Malwarebytes	Trojan.Agent.MSIL
Yandex	Trojan.Agent!wCWf5MZXdE0
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_100%
Fortinet	MSIL/Generic.DN.112C3C!tr
AVG	MSIL:Bladabindi-HZ [Wrm]
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_70% (W)