Categories: Malware

W32/Klez-H malicious file

The W32/Klez-H is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What W32/Klez-H virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine W32/Klez-H?


File Info:
name: 6E50115C843C3F340FF1.mlwpath: /opt/CAPEv2/storage/binaries/f26836188cb190291b3554be8cbfd8fb3fddd7bbc5e2f1f9b61e41ee8f77a683crc32: 66B5B85Amd5: 6e50115c843c3f340ff14440c779b037sha1: 0705a0d1921da09d34dec7848cf0f340339ad001sha256: f26836188cb190291b3554be8cbfd8fb3fddd7bbc5e2f1f9b61e41ee8f77a683sha512: 7ff679e9a9f533efd052a9fc1ac9d2d6ed5e824105f0c94c7e5a7400252c01b67eb487b45bfb0a9ae0a888136c5aaf8d85078b4135b49ea03812c1c3d99b3bcfssdeep: 1536:+WGxs9kGdYk8wO4Cn/8Rnphoba0JLx7GCC4I4PP6PcvPnyp3aOTotXQ:fGfGdYSCn4phobv1GN86PcvgKOEtgtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1E584C902431220A7D65434B5C05A7B8A0690AFF93DA7E536FE157406FA72BCA4E335FEsha3_384: 84d2d2d2cd5d6335be796bd80d4334928737f51e9fe7aea07602687a87cd80eab1d761a2182c50577d7a9ffa93a7293cep_bytes: 558bec6aff6840d240006804ac400064timestamp: 2002-04-13 01:49:44
Version Info:
CompanyName: Adobe Systems IncorporatedFileDescription: Adobe Reader 8.0FileVersion: 8.0.0.2006102300LegalCopyright: Copyright 1984-2006 Adobe Systems Incorporated and its licensors. All rights reserved.ProductName: Adobe ReaderProductVersion: 8.0.0.2006102300OriginalFilename: AcroRd32.exeTranslation: 0x0409 0x04e4

W32/Klez-H also known as:

Bkav	W32.Klez.V201.Worm
Elastic	malicious (high confidence)
MicroWorld-eScan	Win32.Worm.Klez.DAR
ClamAV	Win.Trojan.Elkern-2
CAT-QuickHeal	W32.Klez.H
McAfee	W32/Klez.h@MM
Malwarebytes	Worm.Klez
Zillya	Worm.Klez.Win32.1
Sangfor	Suspicious.Win32.Save.ins
CrowdStrike	win/malicious_confidence_100% (D)
K7GW	Trojan ( 0000409e1 )
K7AntiVirus	Trojan ( 0000409e1 )
BitDefenderTheta	Gen:NN.ZexaF.36250.xu0@aiipFNbi
VirIT	Win32.Klez.H
Cyren	W32/Klez.H@mm
Symantec	W32.Klez.H@mm
ESET-NOD32	Win32/Klez.J
Zoner	Worm.Win32.Klez.32858
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Email-Worm.Win32.Klez.h
BitDefender	Win32.Worm.Klez.DAR
NANO-Antivirus	Trojan.Win32.Klez.csnpyr
Avast	Win32:Injected-AZ
Tencent	Trojan.Win32.Klez.b
Emsisoft	Win32.Worm.Klez.DAR (B)
Baidu	Win32.Worm.Klez.b
F-Secure	Malware.W32/Elkern.C
DrWeb	Win32.HLLM.Klez.4
VIPRE	Win32.Worm.Klez.DAR
TrendMicro	WORM_KLEZ.H
McAfee-GW-Edition	BehavesLike.Win32.Klez.fm
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.6e50115c843c3f34
Sophos	W32/Klez-H
SentinelOne	Static AI – Suspicious PE
GData	Win32.Worm.Klez.H
Jiangmin	I-Worm/Klez.h
Avira	W32/Elkern.C
Antiy-AVL	Worm[Email]/Win32.Klez.h
Xcitium	Worm.Win32.Klez.J@2msa
Arcabit	Win32.Worm.Klez.DAR
ViRobot	I-Worm.Win32.Klez.H
ZoneAlarm	Email-Worm.Win32.Klez.h
Microsoft	Worm:Win32/Klez.H@mm
Google	Detected
AhnLab-V3	Win32/Klez.H
VBA32	MalwareScope.Worm.Klez.1
ALYac	Win32.Worm.Klez.DAR
MAX	malware (ai score=88)
Cylance	unsafe
Panda	W32/Klez.I
TrendMicro-HouseCall	WORM_KLEZ.H
Rising	Worm.Klez!1.A1CB (CLASSIC)
Yandex	Trojan.GenAsa!URVqVkT3TU0
Ikarus	Trojan.Win32.Crypt
MaxSecure	Worm.W32.Klez.h
Fortinet	W32/Wacatac.B!tr
AVG	Win32:Injected-AZ
Cybereason	malicious.c843c3
DeepInstinct	MALICIOUS