Categories: Malware

Win32/Injector.ERWL malicious file

The Win32/Injector.ERWL is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.ERWL virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Dynamic (imported) function loading detected
Creates RWX memory
Authenticode signature is invalid
Detects Avast Antivirus through the presence of a library
Created a process from a suspicious location

How to determine Win32/Injector.ERWL?


File Info:
name: 9B9DCEF209C757D595F4.mlwpath: /opt/CAPEv2/storage/binaries/8d99491ece8ae70f97dbfdcda18bbc65808cab5e1a052620733a772828ebb6e6crc32: A61EFC8Dmd5: 9b9dcef209c757d595f4074f0b2b4e89sha1: a45833ca85ce78e10ba7ed035e0e675f71a86843sha256: 8d99491ece8ae70f97dbfdcda18bbc65808cab5e1a052620733a772828ebb6e6sha512: 14be2af54adbc3c1384009630fae112bc155bce431842a9ae31741c18b4a5abc3aa7bda716955d7d2547300451f1a0cf46c3a1318845247affd960d3857594a7ssdeep: 3072:5bXai1TjWseCwLQ9sPswH0/zd45rmqs2STvFVp9K3sPR1:5+mjWmigomqs5TvFlftype: PE32 executable (console) Intel 80386, for MS Windowstlsh: T14A046C27B48CCD5BDE888479C4A1A0F582013D79FED64A573FA436CDE9BB240A387B45sha3_384: cbfdf7b32dcf90afb8868b418b0c42250122466f31714650ff06bc9bcfdaa3fb751b8bb35309eb8b3b098f4b8bbeb6d1ep_bytes: e8c5030000e974feffff558bec6a00fftimestamp: 2022-07-19 21:27:31
Version Info:
0: [No Data]

Win32/Injector.ERWL also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Bladabindi.m!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Razy.880768
ALYac	Gen:Variant.Razy.880768
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (W)
Alibaba	Backdoor:Win32/Bladabindi.260c739e
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.ERWL
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Backdoor.Win32.Bladabindi.gen
BitDefender	Gen:Variant.Razy.880768
Tencent	Win32.Backdoor.Bladabindi.Hwcz
Ad-Aware	Gen:Variant.Razy.880768
Emsisoft	Gen:Variant.Razy.880768 (B)
VIPRE	Gen:Variant.Razy.880768
TrendMicro	Mal_HPGen-50
McAfee-GW-Edition	Artemis!Trojan
Trapmine	suspicious.low.ml.score
FireEye	Generic.mg.9b9dcef209c757d5
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Razy.880768
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	Program:Win32/Wacapew.C!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.BackDoor.C5198443
McAfee	Artemis!9B9DCEF209C7
MAX	malware (ai score=84)
TrendMicro-HouseCall	Mal_HPGen-50
Rising	Trojan.Generic@AI.100 (RDML:RX6QK2Fcp7hTqANIAxHv6A)