Categories: Malware

About “Win32/Farfli.CXE” infection

The Win32/Farfli.CXE is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Farfli.CXE virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Deletes its original binary from disk
Creates a copy of itself
Anomalous binary characteristics

How to determine Win32/Farfli.CXE?


File Info:
crc32: 9CCE7D02md5: 5ab3fc062060e9c79378820653da9133name: 5AB3FC062060E9C79378820653DA9133.mlwsha1: 9ee468e3946fac9a41a7cd155d9fa68458dcdaf8sha256: 797004de63aae483457083e9ac7df94b8de6b2f168b9c546a149aa4b3cf72133sha512: c6b1a4636d8ef4ade0dc024702e7c05c2bc876189b8a5d47724d557b850de4b2e0f31bcc56e77257c7286780cbd4fabd5f7429ae2507401c49d1c4f0cd7b6713ssdeep: 1536:rDdBjrLDxGax9ypf/0vBRBt9861yKRp8sQ/zLcT10:d9LFGaCpMXBXJCh/UT10type: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: x7248x6743x6240x6709 (C) 2005InternalName: StyleFileVersion: 1, 0, 0, 1CompanyName: LegalTrademarks: ProductName: Style x5e94x7528x7a0bx5e8fProductVersion: 1, 0, 0, 1FileDescription: Style Microsoft x57fax7840x7c7bx5e94x7528x7a0bx5e8fOriginalFilename: Style.EXETranslation: 0x0804 0x04b0

Win32/Farfli.CXE also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader34.44014
Cynet	Malicious (score: 100)
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_90% (D)
Cybereason	malicious.3946fa
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Farfli.CXE
APEX	Malicious
Avast	Win32:Evo-gen [Susp]
Kaspersky	HEUR:Trojan.Win32.Generic
NANO-Antivirus	Trojan.Win32.Ardamax.cojase
Sophos	ML/PE-A
Comodo	TrojWare.Win32.Magania.A@5wdy5u
BitDefenderTheta	Gen:NN.ZexaF.34722.fr3@aqlXtxeb
VIPRE	Trojan.Win32.Generic.pak!cobra
TrendMicro	Backdoor.Win32.ZEGOST.SMAL02
McAfee-GW-Edition	Generic Malware.dq
FireEye	Generic.mg.5ab3fc062060e9c7
SentinelOne	Static AI – Malicious PE
Jiangmin	Backdoor.Farfli.eak
Antiy-AVL	Trojan/Generic.ASMalwS.30F12ED
Kingsoft	Win32.Heur.KVMH008.a.(kcloud)
Microsoft	Trojan:Win32/Farfli.DSK!MTB
Gridinsoft	Malware.Win32.Gen.bot!se3406
AhnLab-V3	Malware/Win32.RL_Backdoor.R353637
McAfee	Generic Malware.dq
VBA32	BScope.Trojan.Fsysna
TrendMicro-HouseCall	Backdoor.Win32.ZEGOST.SMAL02
Rising	Malware.Heuristic!ET#100% (RDMK:cmRtazoyOtB/zFGVv2kK/67AVX1j)
Yandex	Trojan.GenAsa!h5z7SD0BGl0
Ikarus	Backdoor.Win32.Bifrose
Fortinet	W32/Generic.AC.235451!tr
AVG	Win32:Evo-gen [Susp]