Malware

VirTool:Win32/AutInject!pz malicious file

Malware Removal

The VirTool:Win32/AutInject!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What VirTool:Win32/AutInject!pz virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Sample contains Overlay data
  • Presents an Authenticode digital signature
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Authenticode signature is invalid
  • Installs itself for autorun at Windows startup
  • Anomalous binary characteristics
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine VirTool:Win32/AutInject!pz?


File Info:

name: 3AA2313C5427DB1ACC39.mlw
path: /opt/CAPEv2/storage/binaries/aecb84c4b6f65a4f69681aaa2df6dff4a87595b711c9a02c5cbaaea82cc612e0
crc32: C3F60DE6
md5: 3aa2313c5427db1acc39eff6b921dcbe
sha1: e2244bb37e61b4109734fbb6fd28c4cf2a65e258
sha256: aecb84c4b6f65a4f69681aaa2df6dff4a87595b711c9a02c5cbaaea82cc612e0
sha512: 0a0ced37fe9583d88a4ebf61e63a8f8010244c8a3e65bbe64310dfd7b54d0f91073ed10176fa91647f61a11b8d75d7d979fcb956b4dd5c7fc844979f31e0ecd1
ssdeep: 24576:CAHnh+eWsN3skA4RV1Hom2KXMmHaAasbwhgl5M:Fh+ZkldoPK8YaAzM
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T194259D0273D5C076FFABA2739B69F2425ABC79254133852F13981DB9BD701B2123E663
sha3_384: ada6d0e1abbf9c536254316464d6223232224441856e6f58edfdc4becf26a0872b8a942948ac58603b880b3860f50c9b
ep_bytes: e8c8d00000e97ffeffffcccccccccccc
timestamp: 2019-04-15 20:05:54

Version Info:

Translation: 0x0809 0x04b0

VirTool:Win32/AutInject!pz also known as:

BkavW32.AIDetectMalware
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKD.66026662
ClamAVWin.Malware.Autoit-6944498-0
FireEyeGeneric.mg.3aa2313c5427db1a
SkyhighBehavesLike.Win32.Injector.dh
ALYacTrojan.GenericKD.66026662
MalwarebytesGeneric.Malware.AI.DDS
SangforVirus.Win32.Save.a
K7AntiVirusTrojan ( 0054c1601 )
K7GWTrojan ( 0054c1601 )
CrowdStrikewin/malicious_confidence_100% (D)
BitDefenderThetaAI:Packer.7D51B81017
VirITBackdoor.Win32.Bladabindi.WGO
SymantecAUT.Heuristic!gen5
ESET-NOD32a variant of Win32/Injector.Autoit.DUY
APEXMalicious
CynetMalicious (score: 100)
KasperskyHEUR:Trojan.Win32.Autoit.gen
BitDefenderTrojan.GenericKD.66026662
NANO-AntivirusTrojan.Script.Agent.jpixbz
AvastAutoIt:Injector-JF [Trj]
TencentTrojan.Win32.Autoit.404624
SophosTroj/AutoIt-CPM
F-SecureDropper.DR/AutoIt.Gen8
DrWebTrojan.AutoIt.385
VIPRETrojan.GenericKD.66026662
TrendMicroTrojan.AutoIt.CRYPTINJECT.SMA
EmsisoftTrojan.GenericKD.66026662 (B)
SentinelOneStatic AI – Malicious PE
GoogleDetected
AviraDR/AutoIt.Gen8
MAXmalware (ai score=82)
Antiy-AVLGrayWare/Win32.ShellCode.a
MicrosoftVirTool:Win32/AutInject!pz
ArcabitTrojan.Generic.D3EF7CA6
ZoneAlarmHEUR:Trojan.Win32.Generic
GDataTrojan.GenericKD.66026662
VaristW32/AutoIt.LA.gen!Eldorado
AhnLab-V3Win-Trojan/AutoInj.Exp
McAfeeAutoIt/Injector.ac
VBA32Backdoor.Remcos
Cylanceunsafe
PandaTrj/Genetic.gen
TrendMicro-HouseCallTrojan.AutoIt.CRYPTINJECT.SMA
IkarusTrojan-Spy.FormBook
FortinetAutoIt/Injector.DUY!tr
AVGAutoIt:Injector-JF [Trj]
DeepInstinctMALICIOUS

How to remove VirTool:Win32/AutInject!pz?

VirTool:Win32/AutInject!pz removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment