Categories: Malware

VirTool:Win32/CeeInject!CR (file analysis)

The VirTool:Win32/CeeInject!CR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What VirTool:Win32/CeeInject!CR virus can do?

Sample contains Overlay data
Uses Windows utilities for basic functionality
CAPE extracted potentially suspicious content
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
Behavioural detection: Injection (Process Hollowing)
Behavioural detection: Injection (inter-process)
Deletes executed files from disk

How to determine VirTool:Win32/CeeInject!CR?


File Info:
name: 8B939E86E1C36182A77A.mlwpath: /opt/CAPEv2/storage/binaries/8ce218856819dcddb1cb197409607d40765d073434d9ca6662107f6e9abef509crc32: 08103091md5: 8b939e86e1c36182a77a6b97aad7f2e9sha1: 5cb815c5383e65102ff6f73f50bdfbfcdcee6ebesha256: 8ce218856819dcddb1cb197409607d40765d073434d9ca6662107f6e9abef509sha512: 8f22d8e76a45da03485e08d5025081aebe4554f53befdb73354e588f4e604fdb92174307e0e54cabcec544258e86c6a4aed8c759fe5e7be88196e3f486a52fb8ssdeep: 3072:bC3KXOFkejwGMepHPnO+9j2oADf3Kzki4FEbGGaXdlTKzbTs37ryZMaudBOb7L+s:W2OeIwZep2Cxzk7FEbGGodvsdUBBLTQtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T154D418ACA873C591D7574A39042CEBA2FB7A43721D6A4970B0B4770E5B21067C2DE37Esha3_384: a043a2eaff67756df28ae69aea31ccad234279f223cc85b464dc5e1e319c3d6a4cdd7bc5b733f17e61836ba30954161aep_bytes: 558bec6aff68d04d410068784e400064timestamp: 2009-12-23 11:23:32
Version Info:
Comments: CompanyName: 快快捷桌面秀FileDescription: 一款桌面辅助美化工具FileVersion: 2.0.1.1InternalName: Mac ToolLegalCopyright: Mac CopyrightLegalTrademarks: OriginalFilename: PrivateBuild: ProductName: 快快捷桌面秀ProductVersion: 2.0.1. 1SpecialBuild: Translation: 0x0804 0x04b0

VirTool:Win32/CeeInject!CR also known as:

Lionic	Trojan.Win32.StartPage.4!c
AVG	Win32:Agent-AMKL [Drp]
Elastic	malicious (high confidence)
DrWeb	Trojan.StartPage1.11288
MicroWorld-eScan	Gen:Variant.Dropper.13
FireEye	Generic.mg.8b939e86e1c36182
CAT-QuickHeal	Trojan.CeeinjectcrRI.S27341433
Skyhigh	BehavesLike.Win32.Generic.ht
McAfee	Generic Dropper.sr
Malwarebytes	Generic.Malware.AI.DDS
VIPRE	Gen:Variant.Dropper.13
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 005654771 )
Alibaba	Trojan:Win32/StartPage.56b9ff28
K7GW	Trojan ( 005654771 )
CrowdStrike	win/malicious_confidence_100% (D)
BitDefenderTheta	Gen:NN.ZexaF.36802.Lq1@a8naCHob
VirIT	Trojan.Win32.Agent.EQU
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.BPJ
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Trojan.Startpage-3518
Kaspersky	Trojan.Win32.StartPage.wwb
BitDefender	Gen:Variant.Dropper.13
NANO-Antivirus	Trojan.Win32.StartPage.fdpqhs
Avast	Win32:Agent-AMKL [Drp]
Tencent	Trojan.Win32.StartPage.abo
Emsisoft	Gen:Variant.Dropper.13 (B)
F-Secure	Trojan.TR/Dropper.Gen2
Zillya	Trojan.StartPage.Win32.7590
TrendMicro	Mal_Tap-7
Trapmine	suspicious.low.ml.score
Sophos	ML/PE-A
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan/StartPage.dnt
Varist	W32/Injector.K.gen!Eldorado
Avira	TR/Dropper.Gen2
Antiy-AVL	Trojan/Win32.StartPage
Kingsoft	Win32.Trojan.StartPage.wwb
Microsoft	VirTool:Win32/CeeInject.gen!CR
Xcitium	TrojWare.Win32.Trojan.Startpage.~wwb@1ukc56
Arcabit	Trojan.Dropper.13
ZoneAlarm	Trojan.Win32.StartPage.wwb
GData	Gen:Variant.Dropper.13
Google	Detected
AhnLab-V3	Win-Trojan/Startpage3.Gen
VBA32	BScope.Trojan.StartPage
ALYac	Gen:Variant.Dropper.13
MAX	malware (ai score=100)
Cylance	unsafe
Panda	Trj/Startpage.DHZ
TrendMicro-HouseCall	Mal_Tap-7
Rising	Trojan.Win32.StartPage.odc (CLASSIC)
Yandex	Trojan.GenAsa!xsQc3Ne8Ymo
Ikarus	Trojan.Win32.StartPage
MaxSecure	Trojan.Malware.1082428.susgen
Fortinet	W32/Inegery.A!tr
Cybereason	malicious.6e1c36
DeepInstinct	MALICIOUS
alibabacloud	Trojan[dropper]:Win/StartPage.wwb