Win32/GenCBL.BNH (file analysis)

The Win32/GenCBL.BNH is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/GenCBL.BNH virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Presents an Authenticode digital signature
• Creates RWX memory
• NtSetInformationThread: attempt to hide thread from debugger
• Dynamic (imported) function loading detected
• Enumerates running processes
• Expresses interest in specific running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Checks for the presence of known windows from debuggers and forensic tools
• Checks for the presence of known devices from debuggers and forensic tools
• Detects VirtualBox through the presence of a device
• Anomalous binary characteristics
• Binary compilation timestomping detected

How to determine Win32/GenCBL.BNH?

File Info:
name: AE39CE4FDD9FB1ECCC65.mlw
path: /opt/CAPEv2/storage/binaries/c51ea66420e1b15334e4a51498bbd40efed934192f3c327df3eb5ea073a19480
crc32: FEE4CDA4
md5: ae39ce4fdd9fb1eccc65999da018f82b
sha1: 8767db59093fb4bc558859866d8ba59818c52088
sha256: c51ea66420e1b15334e4a51498bbd40efed934192f3c327df3eb5ea073a19480
sha512: 6913b2fbcedcdcf964ddc76980ed5463452f4820c151a358ec59c676329a6d7bf41876d1e8715565b7180e814014fc73cd85d091b732fce480d14d9f1539c9b8
ssdeep: 12288:wfq7ReLNvydFzsphhYeZ8m0krHWiZxkC+Q3utn3YWnthpiLds:wi7Rely7ShZrye+Gmn3dnthgS
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T143D412C1E5C51181E41E8731C8770F59A236BF6AADF8BB8B6D8DB2170E332D1982651B
sha3_384: a06cac477c879396cb2088286ecfd4ac356a06e5e26ef5c87a150ac7c52150f4650e45f8ef66c15b0f6e9f38c974f5d9
ep_bytes: eb05c53554543a50eb01dbe812000000
timestamp: 2086-07-25 02:32:36

Version Info:
FileDescription: WhatsApp
FileVersion: 2.2147.16
InternalName: Setup.exe
LegalCopyright: Copyright © 2021 WhatsApp
OriginalFilename: Setup.exe
ProductName: WhatsApp
ProductVersion: 2.2147.16
SquirrelAwareVersion: 1
CompanyName: WhatsApp
Translation: 0x0409 0x04b0

Win32/GenCBL.BNH also known as:

How to remove Win32/GenCBL.BNH?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.