VirTool:Win32/Obfuscator.E (file analysis)

The VirTool:Win32/Obfuscator.E is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What VirTool:Win32/Obfuscator.E virus can do?

Sample contains Overlay data
Authenticode signature is invalid
CAPE detected the shellcode get eip malware family

How to determine VirTool:Win32/Obfuscator.E?


File Info:
name: 6812076FCF7E0A3A153B.mlw
path: /opt/CAPEv2/storage/binaries/cb55196c9f647375839aea5e787b19271859143a72e2e54c03248e3872be37e4
crc32: 26B4C8EF
md5: 6812076fcf7e0a3a153b9a4298c98c61
sha1: 7138c99918d1141a809754116940caab9ab08d54
sha256: cb55196c9f647375839aea5e787b19271859143a72e2e54c03248e3872be37e4
sha512: adf5377c43a59be720ebfd07998d924afce70c4e357099df682034389acb0d0e9cc523f730d6a04d9fce6f5322607c546e0359239ddfc07fb32951e6d0380810
ssdeep: 6144:nXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cNO5Gv:nX7tPMK8ctGe4Dzl4h2QnuPs/ZsTcv
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10FF69E01BAD1C072D57524300D36F776EAB8BD202836497BB3D61D5BFE31190B62AAB7
sha3_384: bebc8e2349344cffbfc4f152987e0d665158fe9a200a1abfeb146b4551e5f917b2c76d4d40307983e53950da82c76955
ep_bytes: 00000000000000000000000000000000
timestamp: 1998-08-27 13:15:03

Version Info:
0: [No Data]

VirTool:Win32/Obfuscator.E also known as:

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
Skyhigh	New Malware.cc
McAfee	New Malware.cc
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
Baidu	Win32.Trojan.Kryptik.awm
Symantec	ML.Attribute.HighConfidence
Elastic	Windows.Trojan.Remcos
ESET-NOD32	a variant of Win32/GenKryptik.FVBJ
APEX	Malicious
ClamAV	Win.Trojan.Remcos-9841897-0
Avast	Win32:RATX-gen [Trj]
Sophos	Generic ML PUA (PUA)
DrWeb	Trojan.Siggen22.19832
TrendMicro	Cryp_Morphine
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.6812076fcf7e0a3a
Ikarus	Worm.Win32.Bagle
Jiangmin	Trojan.Generic.hsafl
Google	Detected
Varist	W32/Remcos.V.gen!Eldorado
Xcitium	TrojWare.Win32.PkdMorphine.~AN@1l4q0o
Microsoft	VirTool:Win32/Obfuscator.E
Cynet	Malicious (score: 100)
AhnLab-V3	Packed/Win.Morphine.R609055
VBA32	Backdoor.Remcos
Cylance	unsafe
TrendMicro-HouseCall	Cryp_Morphine
Rising	Trojan.Injector!1.6768 (CLASSIC)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/GenKryptik.FVBJ!tr
AVG	Win32:RATX-gen [Trj]
Cybereason	malicious.918d11
DeepInstinct	MALICIOUS

How to remove VirTool:Win32/Obfuscator.E?

VirTool:Win32/Obfuscator.E removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X