Ursu.849032 malicious file

The Ursu.849032 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ursu.849032 virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid

How to determine Ursu.849032?


File Info:
name: 6D3CE26FDC3FAFA56BC1.mlw
path: /opt/CAPEv2/storage/binaries/553169b1f71740912a052b40a992df83b8bc03fb91de07860a03b927b36ce79e
crc32: 5DDFB661
md5: 6d3ce26fdc3fafa56bc150b09eff7f07
sha1: b1f3097a597557a9f91c1334d27030fb65e4ccba
sha256: 553169b1f71740912a052b40a992df83b8bc03fb91de07860a03b927b36ce79e
sha512: 7582e4871d0e8f59ba6ca8fbbfaa555c1e82d6059fe33a1a9891c3421b9641b12985aebea3f485414069962a13f161cdfca11ecadf7c468cc8bad6cd5ca638fb
ssdeep: 49152:x72EmV6PR3L8Vkwfg7xS4Di1pNTxcfT+kSxRg:jL8Vk
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B5565B05AFC9290EF2B9769AA0414720D26FFF21613178D5FE30B7377B1AA438526B4D
sha3_384: acadc9f95cb95d7053f522617d8e07fcfae64fa8bccbf1ffbc71d2f83397bb5b5dbdc2c8ded3e4056ebe83f7408a4ee1
ep_bytes: ff250020400000000000000000000000
timestamp: 2016-09-19 21:29:02

Version Info:
Translation: 0x0000 0x04b0
Comments: WordPress Blog Poster
CompanyName: howtofix.pro
FileDescription: JoeBlogsWordpressWrapperTests
FileVersion: 1.0.0.0
InternalName: JoeBlogsWordpressWrapperTests.exe
LegalCopyright: Copyright © howtofix.pro
OriginalFilename: JoeBlogsWordpressWrapperTests.exe
ProductName: JoeBlogsWordpressWrapperTests
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Ursu.849032 also known as:

Bkav	W32.Common.FC951573
Lionic	Trojan.Win32.Keylogger.4!c
MicroWorld-eScan	Gen:Variant.Ursu.849032
McAfee	Artemis!6D3CE26FDC3F
Cylance	unsafe
Zillya	Trojan.Keylogger.Win32.66898
Alibaba	TrojanSpy:MSIL/Keylogger.4cc12c1b
Cybereason	malicious.fdc3fa
Symantec	Trojan.Gen.MBT
APEX	Malicious
Kaspersky	Trojan-Spy.MSIL.Keylogger.chel
BitDefender	Gen:Variant.Ursu.849032
Avast	Win32:Malware-gen
Rising	Spyware.Keylogger!8.12F (CLOUD)
TACHYON	Trojan-Dropper/W32.DN-Keylogger.6246912
Emsisoft	Gen:Variant.Ursu.849032 (B)
VIPRE	Gen:Variant.Ursu.849032
McAfee-GW-Edition	Artemis!Trojan
FireEye	Gen:Variant.Ursu.849032
Sophos	Mal/Generic-S
Jiangmin	TrojanSpy.MSIL.pzi
Antiy-AVL	Trojan[Spy]/MSIL.Keylogger
Microsoft	TrojanSpy:Win32/Skeeyah.A!rfn
Arcabit	Trojan.Ursu.DCF488
ZoneAlarm	Trojan-Spy.MSIL.Keylogger.chel
GData	Gen:Variant.Ursu.849032
ALYac	Gen:Variant.Ursu.849032
VBA32	TScope.Trojan.MSIL
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R002H0CAH23
MaxSecure	Trojan.Malware.11723852.susgen
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS

How to remove Ursu.849032?

Ursu.849032 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X