Malware

Win32/GenCBL.APZ removal guide

Malware Removal

The Win32/GenCBL.APZ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Win32/GenCBL.APZ virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Sample contains Overlay data
  • Presents an Authenticode digital signature
  • Performs HTTP requests potentially not found in PCAP.
  • CAPE extracted potentially suspicious content
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Attempts to modify proxy settings
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Win32/GenCBL.APZ?



File Info:

name: B38503D32238453E6E3F.mlw
path: /opt/CAPEv2/storage/binaries/abd004a5d2ee1e879a27b0238d60bc3ff27939262b9066734360c534a3ea75ba
crc32: 4E0138C1
md5: b38503d32238453e6e3f6fb608e97d1d
sha1: 8456a1e70dc6186224b12ce9bdb23a1add2bf7f1
sha256: abd004a5d2ee1e879a27b0238d60bc3ff27939262b9066734360c534a3ea75ba
sha512: 64de28c0949258cb2d806b6c32188f5fde9057cb6ea58179321fec72d6923c838013b30768d9bf073ca76fd5c995946b8e20b0ebb2b0d841f750110dfe1e432f
ssdeep: 98304:AHFcJgDFNZ9exJEDuz4xAbekqL9bh4RM3uInBm53TbDPu:UFcEFVfDBxASkE9FWM3xi3DG
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FC0633E21E2C9B0DC08EBD74A1ABC98D7765F7B1B31E090B1975E2054863F04DE5A1F8
sha3_384: 1bffeaf3dd9fddee5db138cd84563082d82b9c7a7be431b2f5a4bea03eab8ea84b6a5004e4d6614949ae495e3f9cc68d
ep_bytes: 6801908400e801000000c3c3b89fd962
timestamp: 2018-11-14 08:37:51


Version Info:

FileDescription: = One Updater Software =
FileVersion: 2.4.6.8
LegalCopyright: Copyright (c) 2018 Idea Advisers Ltd
LegalTrademarks: = One Updater Software =
OriginalFilename: Installer.exe
ProductName: One Updater Software
Translation: 0x0000 0x04e4

Win32/GenCBL.APZ also known as:

Elasticmalicious (high confidence)
CynetMalicious (score: 99)
MalwarebytesAdware.SpecialSearchOffer
SangforSuspicious.Win32.Save.ins
CyrenW32/Kryptik.EKW.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/GenCBL.APZ
APEXMalicious
Kasperskynot-a-virus:HEUR:Downloader.Win32.Generic
AvastWin32:TrojanX-gen [Trj]
EmsisoftApplication.Updater (A)
F-SecureHeuristic.HEUR/AGEN.1304128
DrWebTrojan.Siggen7.60065
FireEyeGeneric.mg.b38503d32238453e
SophosGeneric ML PUA (PUA)
SentinelOneStatic AI – Suspicious PE
WebrootW32.Adware.Gen
AviraHEUR/AGEN.1304128
MicrosoftPUADlManager:Win32/OpenDownloadManager
ZoneAlarmnot-a-virus:HEUR:Downloader.Win32.Generic
GoogleDetected
VBA32BScope.Adware.Downware
RisingTrojan.Generic@AI.100 (RDML:OdO4cN7i05KT3uolYzYPhw)
IkarusTrojan.Win32.Generic
AVGWin32:TrojanX-gen [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/grayware_confidence_90% (D)

How to remove Win32/GenCBL.APZ?

Win32/GenCBL.APZ removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment