VirTool.CeeInject.A (file analysis)

The VirTool.CeeInject.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What VirTool.CeeInject.A virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Dynamic (imported) function loading detected
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)

How to determine VirTool.CeeInject.A?

File Info:
name: EFBE34ECCC80F5AE9ABC.mlw
path: /opt/CAPEv2/storage/binaries/73dbd0e08ad7d06f83bd847e234ffa32a5eb9c25b1340ced2ef300c0cea57850
crc32: 52763BB6
md5: efbe34eccc80f5ae9abc698e73da6350
sha1: 0ed33e348956fcbe7df8aa9d4a9f5392d7b37234
sha256: 73dbd0e08ad7d06f83bd847e234ffa32a5eb9c25b1340ced2ef300c0cea57850
sha512: aa79a281e6704d68366dc8bedc2b570c1884cece81bedf10ffc5d10a6633362b4769fd7c5369cee7afd455b691f14eb363b3d0d0613a0fa0dd1399125e20ffad
ssdeep: 3072:4NQzyMoLBDVc6kpUex+7J3EIrGCeCURGZqT1q5+QkutPGPqVU7xuWx:4NQKLtyUe+EIrOCOT17AJCuWx
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15924AE16B789B532F0262233006E87678B2DB8353A7349DFBF86277696273C19F14716
sha3_384: f28ec6fafcea6fcf2314b8d57004dc105dd500ad35056b4c0111ab1b2a84a3f685bca55f3e480b3187146f9812a886b8
ep_bytes: e804840000e989feffffb8d8584100c3
timestamp: 2013-03-29 07:01:20

Version Info:
0: [No Data]

VirTool.CeeInject.A also known as:

How to remove VirTool.CeeInject.A?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.