Win32/Injector.ERPK removal

The Win32/Injector.ERPK is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.ERPK virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Checks adapter addresses which can be used to detect virtual network interfaces
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• HTTPS urls from behavior.
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Attempts to modify proxy settings
• Harvests cookies for information gathering

How to determine Win32/Injector.ERPK?

File Info:
name: 10F6C378747E31740997.mlw
path: /opt/CAPEv2/storage/binaries/c5c7b29aaed1bce08a14120b9fd1f605243a9abec3b1d1cf30bc0813d855dc0e
crc32: 1A4FF8A0
md5: 10f6c378747e317409971e10a6c2aeb7
sha1: 29ef81f963b5c7272441da55aedea24bd716738b
sha256: c5c7b29aaed1bce08a14120b9fd1f605243a9abec3b1d1cf30bc0813d855dc0e
sha512: e9333389db80f43786002089905685e58b69099ba1b460f3640cf185fcf12a86e5ba709475f69865c45dd968177131772afbafd739f254a28f951f18268c1f31
ssdeep: 24576:Bm61dayOdUWInvCsMX3aHkJmpxoPs5zd52Ep8r:BVDVEXuor
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T177258D22B7B0DC33D1721A7B5C1BB2A59C2DBE502D29BC4A6BE53E485E3974078341E7
sha3_384: 22416fa5075a6d760bfd5edec040019d4e2007c7ef172f1f6d801679be9bf59e8d0e226e51a7da101e6304440f2d0727
ep_bytes: 558bec83c4f0b840754900e8bce9f6ff
timestamp: 1992-06-19 22:22:17

Version Info:
CompanyName: Maël Hörz
FileDescription: HxD Hex Editor
FileVersion: 2.4.0.0
InternalName: HxD
LegalCopyright: Copyright © 2002-2020  Maël Hörz
OriginalFilename: HxD.exe
ProductName: HxD Hex Editor
ProductVersion: 2.4.0.0
Translation: 0x0409 0x04b0

Win32/Injector.ERPK also known as:

How to remove Win32/Injector.ERPK?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.