What is “Win32.Almanahe.K.Dam (B)”?

The Win32.Almanahe.K.Dam (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32.Almanahe.K.Dam (B) virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Creates RWX memory
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Unconventionial binary language: Polish
• Unconventionial language used in binary resources: Polish
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Attempts to modify proxy settings
• Harvests cookies for information gathering
• Anomalous binary characteristics

How to determine Win32.Almanahe.K.Dam (B)?

File Info:
name: 5BECAF2A63FE907EF1F1.mlw
path: /opt/CAPEv2/storage/binaries/6e47d01602c4013542d55683f18af7d1d7f90e6c6bc6eabbfaf8615a771a928f
crc32: BABE6B64
md5: 5becaf2a63fe907ef1f1d5d4bd05a44c
sha1: c3ce12592b6c0e09c3952645c0b0e7d2c6a8d129
sha256: 6e47d01602c4013542d55683f18af7d1d7f90e6c6bc6eabbfaf8615a771a928f
sha512: c63ac66d55146eb902ebd6f33666b587e75b65322fee158e0422973dae2bfab5391506f126812c8a605a9ed06e92b78a5bfb97f945aa269757b1a793a38384ef
ssdeep: 49152:4ELsBFNPh+d004c67tV3YFZipdU+Pc2d26wsjyQTMhCT1oJsz0+:4SWOBmV3YHiHU+P3Tjy7IDh
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T197F57D25B7828837C4771A389D5B97DC593EBE102E38996B3BF42D4C1F397813928297
sha3_384: cd920d1180ec36dfbcce4dccc54d11e5fd5f143f6a5a7dd9795359a05e9eb4ca06d066f5240d54585e02c9ef94c20727
ep_bytes: 558bec83c4ec33c08945ecb830476900
timestamp: 1992-06-19 22:22:17

Version Info:
CompanyName: Karol Winnicki
FileDescription: BESTplayer - Sprytny odtwarzacz filmów
FileVersion: 2.1.30.296
InternalName: BESTplayer
LegalCopyright: Copyright 2000-2009 by Karol Winnicki
LegalTrademarks: 
OriginalFilename: BESTplayer.exe
ProductName: BESTplayer
ProductVersion: 2.x
Translation: 0x0415 0x04e2

Win32.Almanahe.K.Dam (B) also known as:

How to remove Win32.Almanahe.K.Dam (B)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.