Categories: Malware

Win32/Filecoder.NSF (file analysis)

The Win32/Filecoder.NSF is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Filecoder.NSF virus can do?

The binary contains an unknown PE section name indicative of packing
Executable file is packed/obfuscated with ASPack
Authenticode signature is invalid
CAPE detected the MedusaLocker malware family

How to determine Win32/Filecoder.NSF?


File Info:
name: 17EDCD07BDC26D656213.mlwpath: /opt/CAPEv2/storage/binaries/05578f7423b0d085dda02f6131b394b9d9b49b1da02e6c8fdc74358405a77ae5crc32: 8DAC3F3Dmd5: 17edcd07bdc26d6562137c518f6fde14sha1: 41cc0a973883bad0305301d571fc7eb2999a29c5sha256: 05578f7423b0d085dda02f6131b394b9d9b49b1da02e6c8fdc74358405a77ae5sha512: ebc7a51d9327d52b5b0bd196c1323e1170abcc8072b17a9b11816ebea92af84d7982a9172534c346b69f1071317f992390849ac7cd1322941268c650c1119580ssdeep: 12288:+uTDGc6yBGGLg9PNrh05IT7/GR+B+OeO+OeNhBBhhBBA0jF6B9v2zp47CUSqpQsE:+uTSc6yEGU9PNrhwIT7jkFdG7lSAtHtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1E7C47C10F362F271D46398F44A7DAA66A42C7D340B2456FBB3D82E295A315D08B31FB7sha3_384: daec9f7bb9c8015c313824a3e69cf860e50f7469e6caa12bfe07028360b8c4ae62874ce056421ef552051f277daec582ep_bytes: e8c0040000e97afeffffcccccccccccctimestamp: 2022-06-20 13:56:44
Version Info:
0: [No Data]

Win32/Filecoder.NSF also known as:

Bkav	W32.AIDetect.malware1
MicroWorld-eScan	Gen:Heur.Ransom.REntS.Gen.1
FireEye	Generic.mg.17edcd07bdc26d65
ALYac	Gen:Heur.Ransom.REntS.Gen.1
Cylance	Unsafe
VIPRE	Gen:Heur.Ransom.REntS.Gen.1
Sangfor	[ASPACK V2.12]
Cybereason	malicious.7bdc26
Symantec	ML.Attribute.HighConfidence
Elastic	Windows.Ransomware.Magniber
ESET-NOD32	a variant of Win32/Filecoder.NSF
APEX	Malicious
Kaspersky	HEUR:Trojan-Ransom.Win32.Generic
BitDefender	Gen:Heur.Ransom.REntS.Gen.1
Avast	Win32:Evo-gen [Susp]
Ad-Aware	Gen:Heur.Ransom.REntS.Gen.1
Emsisoft	Gen:Heur.Ransom.REntS.Gen.1 (B)
F-Secure	Trojan.TR/Crypt.ASPM.Gen
DrWeb	Trojan.Encoder.34948
Trapmine	malicious.high.ml.score
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI – Malicious PE
GData	Win32.Trojan-Ransom.Filecoder.BO
Avira	TR/Crypt.ASPM.Gen
Arcabit	Trojan.Ransom.REntS.Gen.1
ZoneAlarm	HEUR:Trojan-Ransom.Win32.Generic
Microsoft	Ransom:Win32/MedusaLocker.A!MTB
Cynet	Malicious (score: 100)
Acronis	suspicious
MAX	malware (ai score=82)
VBA32	BScope.Trojan.Garvi
Malwarebytes	Malware.AI.1291672231
Rising	Ransom.Curator!1.D838 (CLASSIC)
MaxSecure	Trojan.Malware.300983.susgen
BitDefenderTheta	Gen:NN.ZexaF.34742.HyW@a4poic
AVG	Win32:Evo-gen [Susp]
CrowdStrike	win/malicious_confidence_100% (W)