Categories: Malware

Win32/Injector.EOXF removal

The Win32/Injector.EOXF is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.EOXF virus can do?

Behavioural detection: Executable code extraction – unpacking
Presents an Authenticode digital signature
Dynamic (imported) function loading detected
Unconventionial language used in binary resources: Chinese (Traditional)
Authenticode signature is invalid
Attempts to repeatedly call a single API many times in order to delay analysis time
Network activity detected but not expressed in API logs

Related domains:

wpad.local-net

How to determine Win32/Injector.EOXF?


File Info:
name: 6059537E8E293A5DA958.mlwpath: /opt/CAPEv2/storage/binaries/f3095cba58323c05c26faba0d24b2a25cdf6eae3fbd83dfba68fa9831095f469crc32: EC407F94md5: 6059537e8e293a5da958178c5e7f3bc6sha1: c58c0231cb60926c100641a2af53da166fecc88asha256: f3095cba58323c05c26faba0d24b2a25cdf6eae3fbd83dfba68fa9831095f469sha512: 80e751d65d0dfb60b1444fba5ae8f458f9cd8854fca5c52c3a49eb4ef4e1a4c05dba1400795f93999864b49cdd7ccaac4bf1a64eafcefb53cdb44f87cd8c660dssdeep: 3072:3tbHPhhbmlH79qvRy+XPH6K3Haqxhhbmlwln/:9bHP3e7svnx33ln/type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T192B4DD2D97335425DBEE8C35C8E9403C9AE43C312AC951C75BA6AA733DF2A8416B077Dsha3_384: e78e69bdf5c06b76609d81f11ec67d812c13f825d61aac8d9c65cbd73b4a1e29ed7893248fd0568b3386e6a5c1c3b1d7ep_bytes: 6898344600e8eeffffff000000000000timestamp: 2016-11-08 05:24:10
Version Info:
Translation: 0x0404 0x04b0CompanyName: Virual InstrumentsLegalTrademarks: Virual Pvt. Ltd.ProductName: Project1FileVersion: 1.00ProductVersion: 1.00InternalName: GraanvinkelstuesOriginalFilename: Graanvinkelstues.exe

Win32/Injector.EOXF also known as:

Elastic	malicious (high confidence)
DrWeb	Trojan.VbCrypt.2194
MicroWorld-eScan	Gen:Variant.Razy.851173
FireEye	Gen:Variant.Razy.851173
McAfee	AgentTesla-FDAN!6059537E8E29
Cylance	Unsafe
Zillya	Trojan.Injector.Win32.866394
Sangfor	Trojan.Win32.VBObfuse.SS
K7AntiVirus	Trojan ( 005790e51 )
Alibaba	Backdoor:Win32/Remcos.efe4e2d1
K7GW	Trojan ( 005790e51 )
Cybereason	malicious.e8e293
BitDefenderTheta	Gen:NN.ZevbaF.34294.Gm1@a8p!Anlb
Cyren	W32/VBKrypt.ASS.gen!Eldorado
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win32/Injector.EOXF
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Backdoor.Win32.Remcos.sma
BitDefender	Gen:Variant.Razy.851173
NANO-Antivirus	Trojan.Win32.Inject.ipmhzv
Avast	Win32:Trojan-gen
Tencent	Win32.Backdoor.Remcos.Wlph
Ad-Aware	Gen:Variant.Razy.851173
Sophos	Mal/Generic-R + Troj/Zbot-PID
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	AgentTesla-FDAN!6059537E8E29
Emsisoft	Gen:Variant.Razy.851173 (B)
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Razy.851173
MaxSecure	Trojan.Malware.1728101.susgen
Avira	TR/Injector.fbfis
Antiy-AVL	Trojan/Generic.ASMalwS.31DF3E3
Microsoft	Trojan:Win32/VBObfuse.SS!MTB
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.GuLoader.R371562
VBA32	BScope.Trojan.Azden
ALYac	Gen:Variant.Razy.851173
MAX	malware (ai score=87)
Malwarebytes	Trojan.GuLoader
Rising	Trojan.Injector!1.D3D1 (CLASSIC)
Yandex	Backdoor.Remcos!NofQpplmV/E
Ikarus	Trojan.VB.Crypt
Fortinet	W32/Injector.EOWD!tr
AVG	Win32:Trojan-gen
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)