Win32/Injector.EJGK (file analysis)

The Win32/Injector.EJGK is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.EJGK virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• A scripting utility was executed
• Behavioural detection: Injection (Process Hollowing)
• CAPE detected the Remcos malware family
• Creates a copy of itself
• Creates known Remcos mutexes
• Creates known Remcos registry keys
• Anomalous binary characteristics

How to determine Win32/Injector.EJGK?

File Info:
name: 125AE0A68660DB1692D9.mlw
path: /opt/CAPEv2/storage/binaries/00675bac1a88eb7ffb1c9ae34a9c752024e3d1a6d7a2cfd6b62e17b34464ea52
crc32: 04F668E1
md5: 125ae0a68660db1692d96957183913e0
sha1: 6edcc16952d1e1a9fd2a2cc2250c56bf16412994
sha256: 00675bac1a88eb7ffb1c9ae34a9c752024e3d1a6d7a2cfd6b62e17b34464ea52
sha512: 0e8a1b18131aee7d016019c3ea7cb5473de340644ca661bca444a9f008b2c950c651280917e3b0d9e8562e6b517eed286d60865da73bb0eac16e33cbd683e0fe
ssdeep: 196608:Ztp3QjkWCvA0B32s+81DLx13tsQk3cih6m:ZACYka81/x1dPihd
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F7662236301554E2F47D3BF166C2ABED5A9D7E3F48C144AA22D834F6D276220C1BCD6A
sha3_384: 021ba82a4111cedf2f3062fd6792da190c52f33f931d32ced669f98d669afc32f5d26741e28332765cd3a9c97a18fae1
ep_bytes: 68985e4900e8eeffffff000000000000
timestamp: 2006-09-11 22:11:35

Version Info:
Translation: 0x0409 0x04b0
CompanyName: Don HO don.h@free.fr
FileDescription: Notepad++ : a free (GNU) source code editor
LegalCopyright: Copyleft 1998-2016 by Don HO
ProductName: Notepad++
FileVersion: 7.71
ProductVersion: 7.71
InternalName: Notepad++
OriginalFilename: Notepad++.exe

Win32/Injector.EJGK also known as:

How to remove Win32/Injector.EJGK?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.