About “Win32/Boaxxe.BL” infection

The Win32/Boaxxe.BL is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Boaxxe.BL virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• Enumerates running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Chinese (Simplified)
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)

How to determine Win32/Boaxxe.BL?

File Info:
name: F33D2DE2F298492F7B3F.mlw
path: /opt/CAPEv2/storage/binaries/cf83162ebfb69eabcf1e0c93b94dfab8cfd6f5af1810ae91454ec8f698497fec
crc32: 33D5A0C4
md5: f33d2de2f298492f7b3f9b45e8835f7c
sha1: 74d84e88df7b5493fff03b20ea0d2331555fb670
sha256: cf83162ebfb69eabcf1e0c93b94dfab8cfd6f5af1810ae91454ec8f698497fec
sha512: ffd210c66626a096d1e81efcf0e1eb159cc484aa07825069aaaf406e7d8649aef2345d6bac26ae6efbbaf8779ac1e54540ea8223b64f6d588c91d79928410e4f
ssdeep: 3072:o2HG41xnyc97drkr3k1p4s55deDxIku9W:RG41xnyc9pf/5dehuo
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13DA37C937867801BE25085B0CCAE7B9BB37391641B224F9657904EBCA976F11ED04F3D
sha3_384: 79207650f11a1b872d2823e9bf8e9908dccbe87ac62557204b538f2d5aa62225a1fceff4a372805c26cef6d1d6ea0fdc
ep_bytes: 558bec6aff6808a3400068f270400064
timestamp: 2014-05-26 11:17:24

Version Info:
Comments: 
CompanyName:  
FileDescription: CDocument
FileVersion: 1, 0, 0, 1
InternalName: CDocument
LegalCopyright: Copyright ? 2011
LegalTrademarks: 
OriginalFilename: CDocument.exe
PrivateBuild: 
ProductName: CDocument
ProductVersion: 1, 0, 0, 1
SpecialBuild: 
Translation: 0x0400 0x03b5

Win32/Boaxxe.BL also known as:

How to remove Win32/Boaxxe.BL?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.