What is “Win32/Injector.BAIY”?

The Win32/Injector.BAIY is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.BAIY virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Deletes executed files from disk
• Collects information to fingerprint the system
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Win32/Injector.BAIY?

File Info:
name: 01F1C833A2FA5258C7A4.mlw
path: /opt/CAPEv2/storage/binaries/501cac02742afccb41b9495e8e4d5f70f32c5afb302e1d47a8add0f7eb938a22
crc32: 47BBBC57
md5: 01f1c833a2fa5258c7a40c4bb4f70640
sha1: 6223d378b59795fa1f0280d4a38842d911edcd8a
sha256: 501cac02742afccb41b9495e8e4d5f70f32c5afb302e1d47a8add0f7eb938a22
sha512: 7b8029df18bd7ee072556cf0001d9026cdaa7688c15bdbcb4a4e24f099b1fdb95096fdf3df8824278f8217fc90815fa26036e95d5296536dad7d08c67892f918
ssdeep: 6144:ondH5KoDevAQ9g/Otw63MlZDicKG3HdhecEdoog:EZ8oDevAQEnicKEHd6dw
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13534E10277E58595E9AB8A3248762B731B26BC769F34DFEF23A4FD0D4539780186230D
sha3_384: 10f957d713177dbfefd5d52a0f51ec3900cead3284bb1cc16559caa1d0bec69bcc1ce5414f02197e14e56f60341c6a86
ep_bytes: 908bec6aff68707b4000685c51400064
timestamp: 2014-03-21 17:17:29

Version Info:
Comments: 
CompanyName: 
FileDescription: SdiMulti Application
FileVersion: 1, 0, 0, 1
InternalName: SdiMulti
LegalCopyright: Copyright (C) 1999
LegalTrademarks: 
OriginalFilename: SdiMulti.EXE
PrivateBuild: 
ProductName: SdiMulti Application
ProductVersion: 1, 0, 0, 1
SpecialBuild: 
Translation: 0x0409 0x04b0

Win32/Injector.BAIY also known as:

How to remove Win32/Injector.BAIY?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.