Categories: Malware

Win32/Filecoder.Philadelphia.F removal guide

The Win32/Filecoder.Philadelphia.F is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Filecoder.Philadelphia.F virus can do?

Expresses interest in specific running processes
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Reads data out of its own binary image
Performs some HTTP requests
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Uses Windows utilities for basic functionality
Installs itself for autorun at Windows startup
Creates a hidden or system file
Attempts to modify proxy settings

Related domains:

z.whorecord.xyz

a.tomx.xyz

redirector.gvt1.com

r3—sn-4g5ednsd.gvt1.com

update.googleapis.com

How to determine Win32/Filecoder.Philadelphia.F?


File Info:
crc32: 6C75AAD8md5: 37e00842ee92467ac9081e63a2498b7dname: 37E00842EE92467AC9081E63A2498B7D.mlwsha1: c1b56330d46a7a57317b32710797b7aa553ad79fsha256: dd8f29fa9a82d58e2aafb00a87accc6e6014b326eae47799fd5b1f998f984c4dsha512: e4c93addcdd6e47912b898469284f50950d65e8fc51a7cddf3955032df4db3fdb59850a101dc6d114b5b90ca59a44d3eea0242f1a6f55c7b4c648394241af9dfssdeep: 12288:yTozGdX0M4ornOmZIzfMwHHQmRROXKKTz2E9LDkbvePAQn:e4GHnhIzOaKuaDXPtype: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Version Info:
Translation: 0x0809 0x04b0

Win32/Filecoder.Philadelphia.F also known as:

Bkav	W32.AIDetectVM.malware1
MicroWorld-eScan	Trojan.GenericKD.4644283
FireEye	Generic.mg.37e00842ee92467a
ALYac	Trojan.GenericKD.4644283
Cylance	Unsafe
Zillya	Downloader.Dapato.Win32.5532
Sangfor	Malware
K7AntiVirus	Trojan ( 00508b341 )
BitDefender	Trojan.GenericKD.4644283
K7GW	Trojan ( 00508b341 )
Cybereason	malicious.2ee924
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	AutoIt:Injector-IU [Trj]
Kaspersky	Trojan-Downloader.Win32.Dapato.ykm
NANO-Antivirus	Trojan.Win32.Dapato.emuabm
AegisLab	Trojan.Win32.Dapato.a!c
Ad-Aware	Trojan.GenericKD.4644283
Sophos	ML/PE-A + Troj/Stampado-A
F-Secure	Heuristic.HEUR/AGEN.1102700
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Ransom_STAMPADO.F117CM
McAfee-GW-Edition	BehavesLike.Win32.TrojanAitInject.hc
Emsisoft	Trojan.GenericKD.4644283 (B)
Ikarus	Worm.Win32.FileCrypter
Webroot	Pua.Yukleyici
Avira	HEUR/AGEN.1102700
MAX	malware (ai score=84)
Antiy-AVL	GrayWare/Autoit.Execute.a
Microsoft	Ransom:Win32/FileCryptor
Arcabit	Trojan.Generic.D46DDBB
ZoneAlarm	Trojan-Downloader.Win32.Dapato.ykm
GData	Trojan.GenericKD.4644283
Cynet	Malicious (score: 85)
AhnLab-V3	Malware/Win32.Generic.C1873730
McAfee	Artemis!37E00842EE92
Malwarebytes	Malware.Heuristic.1003
Panda	Trj/CI.A
ESET-NOD32	a variant of Win32/Filecoder.Philadelphia.F
TrendMicro-HouseCall	Ransom_STAMPADO.F117CM
Rising	Trojan.Obfus/Autoit!1.BEDE (CLASSIC)
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	AutoIt/Philadelphia.4936!tr.ransom
BitDefenderTheta	AI:Packer.B4380A1715
AVG	AutoIt:Injector-IU [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	Win32/Trojan.Downloader.76b