What is “Win32/Injector.EKUM”?

The Win32/Injector.EKUM is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Injector.EKUM virus can do?

Executable code extraction
Creates RWX memory
Drops a binary and executes it
Uses Windows utilities for basic functionality
Installs itself for autorun at Windows startup
Network activity detected but not expressed in API logs

How to determine Win32/Injector.EKUM?


File Info:
crc32: 1E81D1C0
md5: 46479e966974d28232640ecc8081fcc5
name: drop.bin
sha1: 6fe626e782dd29fe5fb0211254865f07a1619623
sha256: fdc7887075348c904369719c79b49e6449d0cff9ece8c5e87879dd75872f20d6
sha512: 970fd6f364372da8045ac2b5774c6597dca43a23b92ec4935d1604e6dc390d8aa949ae4827be008a016959388f6b71e8435776f1735a7ca937ea0072c4e8e48e
ssdeep: 3072:Kfy+bnr+O1y5GWp1icKAArDZz4N9GhbkrNEk1bV/Ugo/:Kfy+bnr+Fp0yN90QEcV/W
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: Wextract                
FileVersion: 11.00.17763.1 (WinBuild.160101.0800)
CompanyName: Microsoft Corporation
ProductName: Internet Explorer
ProductVersion: 11.00.17763.1
FileDescription: Win32 Cabinet Self-Extractor                                           
OriginalFilename: WEXTRACT.EXE            .MUI
Translation: 0x0409 0x04b0

Win32/Injector.EKUM also known as:

MicroWorld-eScan	Trojan.GenericKD.42703659
McAfee	Artemis!46479E966974
Cylance	Unsafe
AegisLab	Trojan.Win32.Dorifel.b!c
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Trojan.GenericKD.42703659
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_60% (W)
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
GData	Trojan.GenericKD.42703659
Kaspersky	HEUR:Trojan-Dropper.Win32.Dorifel.vho
Rising	Dropper.Dorifel!8.31E (CLOUD)
Ad-Aware	Trojan.GenericKD.42703659
F-Secure	Trojan.TR/Dropper.VB.Gen
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.BadFile.dm
FireEye	Generic.mg.46479e966974d282
Emsisoft	Trojan.GenericKD.42703659 (B)
Webroot	W32.Trojan.Gen
Avira	TR/Dropper.VB.Gen
Endgame	malicious (high confidence)
Arcabit	Trojan.Generic.D28B9B2B
ZoneAlarm	HEUR:Trojan-Dropper.Win32.Dorifel.vho
Microsoft	Trojan:Win32/Occamy.C
MAX	malware (ai score=80)
Malwarebytes	Trojan.Dropper.WXT.Generic
ESET-NOD32	a variant of Win32/Injector.EKUM
Tencent	Win32.Trojan-dropper.Dorifel.Pbpf
Ikarus	Trojan-Spy.Agent
Fortinet	W32/Generik.EQCGIHG!tr
AVG	FileRepMalware
Cybereason	malicious.782dd2
Qihoo-360	Win32/Trojan.Dropper.528

How to remove Win32/Injector.EKUM?

Win32/Injector.EKUM removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X