Win32/Injector.EANV malicious file

The Win32/Injector.EANV is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.EANV virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Presents an Authenticode digital signature
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• A scripting utility was executed
• Uses Windows utilities to create a scheduled task
• Behavioural detection: Injection (Process Hollowing)
• CAPE detected the embedded win api malware family
• Creates a copy of itself
• Deletes executed files from disk
• Touches a file containing cookies, possibly for information gathering
• Harvests credentials from local FTP client softwares
• Harvests information related to installed mail clients
• Yara detections observed in process dumps, payloads or dropped files

How to determine Win32/Injector.EANV?

File Info:
name: ACFB318C245BED705105.mlw
path: /opt/CAPEv2/storage/binaries/b9c208b6be6097064844053e881b4de4e5a1bb17ef2b28de32961849f4710bfb
crc32: 9AFFF07E
md5: acfb318c245bed705105d113879b48f3
sha1: cca493f2a6a9b21d47efae938c86b9639df7d6d4
sha256: b9c208b6be6097064844053e881b4de4e5a1bb17ef2b28de32961849f4710bfb
sha512: 2d056d36ee0ecb56fc728466025a1843f7ce947ceca01cd5abe7abce6eef7a9b3d968c571428e381bb5e9870a00570c84aed0c244792c1b51ea6451f6ddabfca
ssdeep: 6144:b9qb84PX9tQC0KAqyRHwmR3ZksveNAOyVlD6Xolx5t9DmHYA23iq6NwzU7UV3:b9qj/Px0THR3mpNMbG1+GoV3
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F6B4D1B566C93660DEB78E748879B46531AAAC319F02CC0FA697784474FA4D28734F0F
sha3_384: 9d43818e8f55816682d61593cfaba8edbf178d2099ecfa2481a6634f2842497c23a767f3690aa804f3a322e6441f26cd
ep_bytes: 686c194000e8f0ffffff000000000000
timestamp: 2001-12-13 15:23:00

Version Info:
Translation: 0x0409 0x04b0
Comments: JTellar vta
CompanyName: the pIDGIN comMUNITY
LegalTrademarks: SYstems fne.
ProductName: asuS
FileVersion: 2.08
ProductVersion: 2.08
InternalName: Nonbulkhead
OriginalFilename: Nonbulkhead.exe

Win32/Injector.EANV also known as:

How to remove Win32/Injector.EANV?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.