Categories: Malware

Win32/Injector.DXYL (file analysis)

The Win32/Injector.DXYL is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.DXYL virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
The binary likely contains encrypted or compressed data.
Executed a process and injected code into it, probably while unpacking
Steals private information from local Internet browsers
Network activity detected but not expressed in API logs
Attempts to access Bitcoin/ALTCoin wallets
Harvests credentials from local FTP client softwares
Collects information to fingerprint the system
Anomalous binary characteristics

How to determine Win32/Injector.DXYL?


File Info:
crc32: B847C218md5: 95beb671d2e11672dd4d101abfe8a7ffname: 95BEB671D2E11672DD4D101ABFE8A7FF.mlwsha1: 9d05336f9df72a337777211375b754cdf4ba5225sha256: 15b7a448c86f24b3656f9c8f34d1018f1c86f669822bcc5023234deff22be4f9sha512: a95c471b23692d5c34eb8245f0586683813e00e4a87738407643d0e429998f722b1c569c75ab5122109bb5047853810a08a48020f888488d1132767ec9c0817bssdeep: 24576:P7Abk1PGHa4xegXjvkAOVLlbpqJmEwKKKC6CTKGtQu:P7VeH6gXjcAi6nwL4KTtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
Translation: 0x0409 0x04b0LegalCopyright: HIc rro Noj- Twik ZEELaoInternalName: Voluminous3FileVersion: 1.00CompanyName: golahA jERA Mtn:Comments: GoyProductName: VTELLIe INDARMaTOOL gySTEMA GTTProductVersion: 1.00OriginalFilename: Voluminous3.exe

Win32/Injector.DXYL also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 005317941 )
Lionic	Trojan.Win32.Androm.m!c
Elastic	malicious (high confidence)
DrWeb	Trojan.Packed2.41151
Cynet	Malicious (score: 100)
ALYac	Gen:Heur.PonyStealer.on0@d4gMq1ei
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
K7GW	Trojan ( 005317941 )
Cybereason	malicious.1d2e11
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.DXYL
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Malware.Deliric-7108514-0
Kaspersky	Backdoor.Win32.Androm.pvaq
BitDefender	Gen:Heur.PonyStealer.on0@d4gMq1ei
NANO-Antivirus	Trojan.Win32.Androm.fbtueu
MicroWorld-eScan	Gen:Heur.PonyStealer.on0@d4gMq1ei
Tencent	Win32.Backdoor.Androm.Hupq
Ad-Aware	Gen:Heur.PonyStealer.on0@d4gMq1ei
Sophos	Mal/Generic-R + Mal/FareitVB-L
Comodo	Malware@#3i42l8e90610g
BitDefenderTheta	Gen:NN.ZevbaF.34170.on0@a4gMq1ei
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TSPY_HPLOKI.SMVBMP0
McAfee-GW-Edition	BehavesLike.Win32.Fareit.th
FireEye	Generic.mg.95beb671d2e11672
Emsisoft	Gen:Heur.PonyStealer.on0@d4gMq1ei (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Backdoor.Androm.zby
Avira	HEUR/AGEN.1121803
eGambit	Unsafe.AI_Score_99%
Antiy-AVL	Trojan/Generic.ASMalwS.261AA2A
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Gen:Heur.PonyStealer.on0@d4gMq1ei
AhnLab-V3	Win-Trojan/VBKrypt.RP08.X1976
McAfee	Fareit-FKM!95BEB671D2E1
MAX	malware (ai score=99)
VBA32	BScope.Trojan.VBKrypt
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TSPY_HPLOKI.SMVBMP0
Rising	Trojan.Injector!1.B459 (CLASSIC)
Yandex	Trojan.GenAsa!q5TOtmcLfNg
Ikarus	Trojan.Win32.Injector
Fortinet	W32/GenKryptik.DTJE!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml