Categories: Adware

What is “Win32/Adware.Neoreklami.MB”?

The Win32/Adware.Neoreklami.MB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Adware.Neoreklami.MB virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
At least one process apparently crashed during execution
Checks adapter addresses which can be used to detect virtual network interfaces
Dynamic (imported) function loading detected
Performs HTTP requests potentially not found in PCAP.
Authenticode signature is invalid
Attempts to modify proxy settings
Anomalous binary characteristics

How to determine Win32/Adware.Neoreklami.MB?


File Info:
name: 787212E8C3B3B031D977.mlwpath: /opt/CAPEv2/storage/binaries/b5553902fcaece25312cc82d72e16e50f30c9176e62ef0869293b0a007726d71crc32: 2AD145ACmd5: 787212e8c3b3b031d977a260a964a466sha1: c85d565c5d9bd5dd84d691f54efc4bab6a6f284asha256: b5553902fcaece25312cc82d72e16e50f30c9176e62ef0869293b0a007726d71sha512: a38599d87d43dc40a9b8ba0a8444b7150b11ed0f016a4e960b325a88e3253dbf1be3e24f2160cdd4d92f547ecd28731be240920b173be25d8e339446cad0165bssdeep: 12288:scTo1D/BQg9xhtQ5cvpI7ThyzmP2f0ya0Bt2J8tSDbliT6:4NBQexhtQ5cxsym2f0yRBt2mwnliTtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T17F051A35B2E2F122C4A200F31355AE6542BC3F741836158F7FA46F2C6AB89E5DE1A717sha3_384: 7aae3af870394c6d37228ce321f09a4b3b319e1d1d2a8d4a1ef7b05727d63bca3ad802937d062b90af6b1d7059814ebdep_bytes: e8ab8e0000e97ffeffffe82d7000008btimestamp: 2019-11-26 21:59:08
Version Info:
0: [No Data]

Win32/Adware.Neoreklami.MB also known as:

Bkav	W32.AIDetect.malware2
MicroWorld-eScan	Gen:Variant.Ransom.GandCrab.1521
FireEye	Generic.mg.787212e8c3b3b031
ALYac	Gen:Variant.Ransom.GandCrab.1521
Sangfor	Trojan.Win32.Save.a
BitDefender	Gen:Variant.Ransom.GandCrab.1521
Cybereason	malicious.8c3b3b
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Adware.Neoreklami.MB
APEX	Malicious
Kaspersky	not-a-virus:VHO:AdWare.Win32.Neoreklami.gen
Ad-Aware	Gen:Variant.Ransom.GandCrab.1521
Sophos	Generic ML PUA (PUA)
VIPRE	Gen:Variant.Ransom.GandCrab.1521
McAfee-GW-Edition	BehavesLike.Win32.Generic.ch
Avira	HEUR/AGEN.1209702
Microsoft	Program:Win32/Wacapew.C!ml
GData	Gen:Variant.Ransom.GandCrab.1521
Cynet	Malicious (score: 100)
MAX	malware (ai score=89)
VBA32	BScope.Backdoor.Androm
Rising	Trojan.Generic@AI.88 (RDML:hvnTfFdSdM+in1nbhYtMSw)
Fortinet	Adware/Neoreklami
BitDefenderTheta	Gen:NN.ZexaF.34582.0uW@aGBrwyc
CrowdStrike	win/grayware_confidence_70% (W)