Win32/Injector.BKAO (file analysis)

The Win32/Injector.BKAO is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.BKAO virus can do?

• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Behavioural detection: Injection (inter-process)
• CAPE detected the shellcode get eip malware family
• Yara detections observed in process dumps, payloads or dropped files

How to determine Win32/Injector.BKAO?

File Info:
name: 6B3475655BF4FA943014.mlw
path: /opt/CAPEv2/storage/binaries/98bb1721e48b4e8f7229b7a7858e6772cab99a13e0bcd09f87e71e8ab1b562c0
crc32: 48B0DF20
md5: 6b3475655bf4fa9430140524c6632567
sha1: 813212673bd3de27e848dd2ce2cc2757cdb8f567
sha256: 98bb1721e48b4e8f7229b7a7858e6772cab99a13e0bcd09f87e71e8ab1b562c0
sha512: 10f9c25b7a5cb3aeffc3eef738418afd466022c7492390d236065755ef31753f9091ed42acf2cd7dff7ef1962acc7f375b4b7e6608121aac58c4d28bdabe8dbb
ssdeep: 3072:FeB68C3SxEyR2hIzCyfWiGrKfRblLEvCwAY+IbNZH3j1M6RUA3W:cB03oKQffWYfRblwvC9Y+IbNd3j1M6RK
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13EF3E103B1D0C0B3E8BB46742D32CD958A3B7C25BA7291EF27554A6E5E307D18D6A31B
sha3_384: 87e848a1a795c3dc146ce9c03595a625df0b5531396144df2c5ba254126f7ca295f0187b6648ed9628d5b17a0d5528c3
ep_bytes: e83c1c0000e91efeffffcccccccccccc
timestamp: 2014-08-16 04:04:55

Version Info:
Comments: April pan production 
CompanyName: Adjective gift stronger powder 
FileDescription: Lack swing Eddy tax fifth July tape curve 
FileVersion: 7.61.48.0
InternalName: Pen.exe
LegalCopyright: Copyright (C) Johnson influence excellent pen curious thee 
LegalTrademarks: Piano task becoming 
OriginalFilename: Pen.exe
ProductName: Mighty
ProductVersion: 7.61.48.0
Translation: 0x081a 0x081a

Win32/Injector.BKAO also known as:

How to remove Win32/Injector.BKAO?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.