Categories: Malware

What is “Win32/Injector.DLY”?

The Win32/Injector.DLY is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.DLY virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Behavioural detection: Injection (Process Hollowing)
Behavioural detection: Injection (inter-process)
CAPE detected the embedded win api malware family
Anomalous binary characteristics
Yara detections observed in process dumps, payloads or dropped files

How to determine Win32/Injector.DLY?


File Info:
name: B944E9001A2A256E375F.mlwpath: /opt/CAPEv2/storage/binaries/0225f4833513f6d6904445eca292deb4c30a30285429c4c4e8eca98b9b490945crc32: 3D6DEBE0md5: b944e9001a2a256e375fefa5ad8a21adsha1: f64e0af085e34048407571c52213a1e175905677sha256: 0225f4833513f6d6904445eca292deb4c30a30285429c4c4e8eca98b9b490945sha512: 73e1b26a883771e291ea99318b27760cc04d2072dc291867ec15648b4846200e6616e2b3cc4b8ddbffb0e06861eb3df7e19229a5b3f1c4bc70cd5deb266dae6dssdeep: 768:7q1UHIs/4TAuEnVc01/+Buis9zNGQAZJLA7q0SRK3SgabcgOEj1DFUH:u1UHr/4Tmn6a/au/9EQoJG2vgDajfUHtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T14633E09A290C5B3FF7D547B017C2ED7B8AB17D7CBF7284AC36843A1F202A5666007215sha3_384: 9a4fd85e02d878792e879eb53f56c34dc62e38d085bf8cff75c1762d2606f3286ed26594b41d63733644384c92d54db0ep_bytes: b8a4fe42005064ff3500000000648925timestamp: 2011-01-16 20:38:02
Version Info:
Translation: 0x0409 0x04b0Comments: bdmvqTkCQqkaCompanyName: gcnrFileDescription: koNCztLIfBLegalCopyright: DuISBBobBYlzhProductName: QIhwpZGJeGKZjFileVersion: 1.00ProductVersion: 1.00InternalName: 2OriginalFilename: 2.exe

Win32/Injector.DLY also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Refroso.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Heur.ManBat.1
FireEye	Generic.mg.b944e9001a2a256e
Skyhigh	GenericRXCO-IB!F6BC7BB45A4F
McAfee	Artemis!B944E9001A2A
Malwarebytes	Generic.Malware/Suspicious
VIPRE	Gen:Heur.ManBat.1
Sangfor	Trojan.Win32.Refroso.Vmwf
Alibaba	Trojan:Win32/Refroso.2d94fb4f
Cybereason	malicious.085e34
VirIT	Trojan.Win32.Generic.XQH
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Injector.DLY
APEX	Malicious
ClamAV	Legacy.Trojan.Agent-1388588
Kaspersky	Trojan.Win32.Refroso.fofu
BitDefender	Gen:Heur.ManBat.1
NANO-Antivirus	Trojan.Win32.Bifrost.euxfn
Avast	Win32:Trojan-gen
Tencent	Malware.Win32.Gencirc.114b1d33
Sophos	Mal/Generic-G
F-Secure	Trojan.TR/Crypt.CFI.Gen
DrWeb	BackDoor.Bifrost.16901
Zillya	Trojan.Injector.Win32.13397
TrendMicro	TROJ_AGENT_005872.TOMB
Trapmine	malicious.high.ml.score
Emsisoft	Gen:Heur.ManBat.1 (B)
Ikarus	Trojan.Win32.Refroso
GData	Gen:Heur.ManBat.1
Jiangmin	Trojan/Refroso.alkl
Webroot	Trojan.Dropper
Google	Detected
Avira	TR/Crypt.CFI.Gen
Varist	W32/VBInject.AH.gen!Eldorado
Antiy-AVL	Trojan/Win32.Refroso
Kingsoft	malware.kb.a.995
Xcitium	TrojWare.Win32.VB.GE@4pqh5b
Arcabit	Trojan.ManBat.1
ViRobot	Trojan.Win32.A.Refroso.56832
ZoneAlarm	Trojan.Win32.Refroso.fofu
Microsoft	VirTool:Win32/VBInject.OT
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Malco.R7759
VBA32	SScope.Trojan.VBRA.2678
MAX	malware (ai score=100)
Cylance	unsafe
Panda	Generic Malware
TrendMicro-HouseCall	TROJ_AGENT_005872.TOMB
Rising	Worm.VBInjectEx!1.99E6 (CLASSIC)
Yandex	Trojan.Refroso!+EKNU/vk3Bc
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Refroso.CVMB!tr
BitDefenderTheta	AI:Packer.FFF93B6E20
AVG	Win32:Trojan-gen
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)