About “Win32/Injector.DMH” infection

The Win32/Injector.DMH is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.DMH virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Behavioural detection: Injection (inter-process)
• CAPE detected the embedded win api malware family
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Win32/Injector.DMH?

File Info:
name: 4B4C346A976D28CEA72D.mlw
path: /opt/CAPEv2/storage/binaries/036a9f83c38bccad44da8dfcf57bbe883b88cdbc85913f2d276810aad503735c
crc32: 46C3B189
md5: 4b4c346a976d28cea72d0ba1c3b3f4e3
sha1: 1e9d1b6a1eb13a0271a93be0cbd19729cbee5897
sha256: 036a9f83c38bccad44da8dfcf57bbe883b88cdbc85913f2d276810aad503735c
sha512: 722fa0ff5b38f971b25e1ff5d68721c4391ebcb85330ac1b23792c3c47e4287140121068e9907733210d84c226f7b67e7323860c125c58945c5e875f8c37ef79
ssdeep: 6144:OMFRED9uQy6zHqiERcG3+3wChK+amnT7KQwTdCZaG7Mscy4gmKrk:OMFG7iZB+1IrmPK9qaG7M7z
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DD7423CF52C87A86E9C9563189707741E11F4A8D1B228DDDF5CB1E4E3C78222F09ABD9
sha3_384: 7ff7497f819c75c3936b4cd8d67b2c8697304bd1bad87732a49b2ba77613ff954fbea33d6db31b64cbc59738053d3e68
ep_bytes: 9c60e80200000033c08bc483c004938b
timestamp: 2011-07-14 12:03:37

Version Info:
Translation: 0x0409 0x04b0
Comments: qxy0zSOz6
CompanyName: fgsyIts
FileDescription: Z0zX9qkRbv
LegalCopyright: wJdHm7
LegalTrademarks: AnKUC4r
ProductName: Urwas9V
FileVersion: 4.29.0035
ProductVersion: 4.29.0035
InternalName: Bakir
OriginalFilename: Bakir.exe

Win32/Injector.DMH also known as:

How to remove Win32/Injector.DMH?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.