Win32/Injector.EISS (file analysis)

The Win32/Injector.EISS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.EISS virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• NtSetInformationThread: attempt to hide thread from debugger
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Created a process from a suspicious location
• Collects information to fingerprint the system

How to determine Win32/Injector.EISS?

File Info:
name: 65F463C3C7BB16E74735.mlw
path: /opt/CAPEv2/storage/binaries/b4b32e7403ef72edf6c5bd2b107031e63c981d98c7b997f4076efeadcd44b2d6
crc32: 8BD6A99E
md5: 65f463c3c7bb16e7473542cf8b36f764
sha1: fbc1dfc974a843d2944072d0d4cb74bf369ac25a
sha256: b4b32e7403ef72edf6c5bd2b107031e63c981d98c7b997f4076efeadcd44b2d6
sha512: 0d9b5011134da1dfd00863b6619953a1936889a613322df50631dc81ba3ce7bbfede7481432eac904ccf9e15d80230d0f7fc8381eec4238514802d4797be266a
ssdeep: 24576:zIv1mcembWsOVGI5kk6iEsTp/POx/bqX+Fk:zwocL6sbkkkJItmXD
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12B25CFD6EAD87EFDF11222B461E4C11142C67511F08345ABF1ECF0DA6D9D98EA34EE22
sha3_384: cc9f3f9c3e74cf8cbfd58b42193b1d4f3d04d3f2713e9c74d2413f8aac1cfde77da3e9d69c5a805d0387237d2f9a67bb
ep_bytes: 6888144000e8eeffffff000000000000
timestamp: 2008-01-22 12:38:27

Version Info:
Translation: 0x0409 0x04b0
ProductName: bsoneRA
FileVersion: 2.09.0009
ProductVersion: 2.09.0009
InternalName: pIEM
OriginalFilename: pIEM.exe

Win32/Injector.EISS also known as:

How to remove Win32/Injector.EISS?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.