About “Win32/Injector.AVVY” infection

The Win32/Injector.AVVY is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.AVVY virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Performs HTTP requests potentially not found in PCAP.
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Attempts to repeatedly call a single API many times in order to delay analysis time
• CAPE detected the shellcode get eip malware family
• Attempts to modify proxy settings
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Win32/Injector.AVVY?

File Info:
name: B86DF354CF5ABC98CE4D.mlw
path: /opt/CAPEv2/storage/binaries/3540f2f7ef7b21f729937f1a8c556589bb791b98fd4d8d05a864b0e8466aa313
crc32: 81C00809
md5: b86df354cf5abc98ce4d5710d17c0815
sha1: 8d58841387176a6617b6d3ed54a7736886f41296
sha256: 3540f2f7ef7b21f729937f1a8c556589bb791b98fd4d8d05a864b0e8466aa313
sha512: d57983576249234af1d2864a8f73207990ad4e9caeee28f9415f78e97ae1e9fa20c46fc032ad7cc802b1b6ecb7aa0a24f2e7c8e59eb6d6a96587b52285fe4622
ssdeep: 192:zZpvEkGlAsojjgcWiw2X3wM3lTPh8GynKqeKoMIVLASo8vojyvgekaUlJFA8vxu:zPGlPywfM1TPh8OqeJOSo1ndu
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D2B23C23BFCADA91C37756700472D67B2A3A7C253142533EEA96D72FCA1AD117E08136
sha3_384: 9c659361ad96e48bd194465d28976219874e8c8b1cc7a653ba3c7a0ccc0377f2963d7e3a9c17bda6c8c18c70ad72b417
ep_bytes: 837c240e08e9f16f000029d1e8ff3800
timestamp: 2004-05-20 05:59:45

Version Info:
0: [No Data]

Win32/Injector.AVVY also known as:

How to remove Win32/Injector.AVVY?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.