Win32/Injector.ERYQ (file analysis)

The Win32/Injector.ERYQ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.ERYQ virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• HTTPS urls from behavior.
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Attempts to modify proxy settings

How to determine Win32/Injector.ERYQ?

File Info:
name: 3F459E0B263C7ED71559.mlw
path: /opt/CAPEv2/storage/binaries/6a147da6ac0eec13aeaf08e385f27f58132562980c1ff628f4a4dc98ed70e202
crc32: 8CB294B2
md5: 3f459e0b263c7ed71559eb0f326b5733
sha1: f079e61f2783cd548d9f3dc7f177c10c73dfa39a
sha256: 6a147da6ac0eec13aeaf08e385f27f58132562980c1ff628f4a4dc98ed70e202
sha512: 3c146dc604065a9902329dd10b10d39e17c09079fb0d0689a3eca87ed04a9be9957116b4c05d824c2093408e6222c1203aa8182e1eee79c42eeb0f450dd63211
ssdeep: 12288:QodKmNUsu8OHrlJZuCYOTW1Z2fWC9dAMEXU4nSz7eIa3f6:pYmAPrDMCYOCJCvAMEXU4nSz
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T185F49E26B2FBFA32CA6E44B3DF3AC564C4556E085DBCE1C12BE03B685BB2559650F043
sha3_384: 9a9e43410d71f0b48dd6edf40326b0d6033e9cec11c37c379fecbd17630e265b6ec048223890a4e3e61b6dd8694c1f2d
ep_bytes: 558bec83c4f0b8fc424600e8f40ffaff
timestamp: 1992-06-19 22:22:17

Version Info:
CompanyName: e-m-Factory
FileDescription: Factory.wi3.com
FileVersion: 2.69.0.0
InternalName: 
LegalCopyright: 1997-2007 ACE Compression Software & e-merge GmbH
LegalTrademarks: 1997-2007 ACE Compression Software & e-merge GmbH
OriginalFilename: 
ProductName: Wi2ce
ProductVersion: 02.69.00.00
Comments: Factory!,(c) 1997-2005 e-merge GmbH, http://www.emerge.de
Translation: 0x0407 0x04e4

Win32/Injector.ERYQ also known as:

How to remove Win32/Injector.ERYQ?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.