Categories: Malware

Win32/Injector.ELFM malicious file

The Win32/Injector.ELFM is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.ELFM virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
A process attempted to delay the analysis task.
The binary likely contains encrypted or compressed data.
Executed a process and injected code into it, probably while unpacking
Tries to unhook or modify Windows functions monitored by Cuckoo
Network activity detected but not expressed in API logs
Checks the CPU name from registry, possibly for anti-virtualization
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Win32/Injector.ELFM?


File Info:
crc32: 11C74DA9md5: 4651edf8f5af1f7cd9ac26f3e6833305name: dutchz.exesha1: 5b2e0425dfc818ecfa618f2abfe2b8b13a336a76sha256: c2db4f53f12bb523d38f7f18230dbbfec5dbcd40bac5c1c06677ffe815af22eesha512: 5512a7eb8e2739bbed01ff1126a84abc3f19254fbc3a518d8e0e7410ffb1b3ad381dff2068edc67d17dabff291c8e1017c40cd3ed1acb51c4b35d296d788ff31ssdeep: 24576:f0D3f35XsjrmvoCUOYI/IEg5jF3FHMRYIwBUA:8DBzvYOd/uj26+Atype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

Win32/Injector.ELFM also known as:

DrWeb	Trojan.PWS.Siggen2.45242
MicroWorld-eScan	Trojan.GenericKD.42869074
Qihoo-360	Win32/Trojan.PSW.086
ALYac	Trojan.GenericKD.42869074
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Trojan.GenericKD.42869074
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.5dfc81
TrendMicro	TrojanSpy.Win32.LOKI.SMDF.hp
BitDefenderTheta	Gen:NN.ZelphiF.34104.7GW@aibclJii
F-Prot	W32/Delf.AFC
TrendMicro-HouseCall	TrojanSpy.Win32.LOKI.SMDF.hp
Avast	Win32:Malware-gen
GData	Trojan.GenericKD.42869074
Kaspersky	HEUR:Trojan-PSW.Win32.Agensla.gen
Alibaba	TrojanPSW:Win32/Lokibot.5c68db5f
AegisLab	Trojan.Multi.Generic.4!c
Rising	Trojan.Injector!1.AF18 (CLASSIC)
Ad-Aware	Trojan.GenericKD.42869074
Emsisoft	Trojan.GenericKD.42869074 (B)
Comodo	Malware@#1pa7ktffkgeew
F-Secure	Trojan.TR/Injector.qfpkl
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Fareit.dc
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.4651edf8f5af1f7c
Sophos	Mal/Fareit-V
Ikarus	Trojan.Inject
Cyren	W32/Delf.AAHN-3671
Jiangmin	Backdoor.MSIL.csnh
Webroot	W32.Malware.gen
Avira	TR/Injector.qfpkl
MAX	malware (ai score=86)
Antiy-AVL	GrayWare/Win32.Generic
Endgame	malicious (high confidence)
Arcabit	Trojan.Generic.D28E2152
ZoneAlarm	HEUR:Trojan-PSW.Win32.Agensla.gen
Microsoft	Trojan:Win32/Lokibot.G!MTB
AhnLab-V3	Suspicious/Win.Delphiless.X2059
Acronis	suspicious
McAfee	Artemis!4651EDF8F5AF
VBA32	Trojan.Sonbokli
Malwarebytes	Backdoor.NanoCore
Panda	Trj/CI.A
APEX	Malicious
ESET-NOD32	a variant of Win32/Injector.ELFM
Tencent	Win32.Trojan-qqpass.Qqrob.Pbyv
SentinelOne	DFI – Malicious PE
eGambit	Unsafe.AI_Score_90%
Fortinet	W32/Injector.ELDL!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (W)
MaxSecure	Trojan.Malware.300983.susgen