What is “Win32/Injector.CMYQ”?

The Win32/Injector.CMYQ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.CMYQ virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• Enumerates running processes
• Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Attempts to remove evidence of file being downloaded from the Internet
• Code injection with CreateRemoteThread in a remote process
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Attempts to stop active services
• Created a process from a suspicious location
• Installs itself for autorun at Windows startup
• CAPE detected the Ramnit malware family
• Operates on local firewall’s policies and settings
• Creates a copy of itself
• Attempts to disable UAC
• Attempts to disable Windows Defender
• Attempts to modify or disable Security Center warnings
• Registers an application compatibility shim database for persistence
• Anomalous binary characteristics

How to determine Win32/Injector.CMYQ?

File Info:
name: 79E1AB62128859BD426D.mlw
path: /opt/CAPEv2/storage/binaries/af5066a63c0d4529d00c76937c406fa4ca0e18703b4e9d6919bdb5f3f72acb2e
crc32: C42D8AAE
md5: 79e1ab62128859bd426d5b09888c788e
sha1: 698655297c44881b1769a00fb67e2e1dfc072d92
sha256: af5066a63c0d4529d00c76937c406fa4ca0e18703b4e9d6919bdb5f3f72acb2e
sha512: d8a216be445a5243bd7af01c0776bfdc52226d8ab79e87c5579cf68e860e384f5d84116bc59572153202c17a27e9a5d567d3fe0ca65b1654f7c41e7b6eb50352
ssdeep: 3072:Wbn5/wuoEn8VwdUPG27A5yvc3Mfeu+Wnw/HlgPiAPapW+wi7yTJjIna37pTwi7aW:2nSFEmwWPoyvuTgPiAP+wi7uU27pwi7
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T112F3E0ED2BD50D6EE8EFC77AF0022F25A224FB4218528D4357EEBE50D4F9D91121528E
sha3_384: 0dca9c496964b363155dac3028ddc4dbd75a6d36f1e350a013481429886572415bfcc98bfa27c8f080ec8442209a59b4
ep_bytes: 68d89a4100e8f0ffffff000000000000
timestamp: 2015-11-20 12:42:41

Version Info:
Translation: 0x0409 0x04b0
FileDescription: Vision Labs Inc.
ProductName: Basisfläche2
FileVersion: 1.01.0002
ProductVersion: 1.01.0002
InternalName: Kindle of fire
OriginalFilename: Kindle of fire.exe

Win32/Injector.CMYQ also known as:

How to remove Win32/Injector.CMYQ?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.