Win32/Injector.ESBM (file analysis)

The Win32/Injector.ESBM is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Injector.ESBM virus can do?

Reads data out of its own binary image
Unconventionial language used in binary resources: Russian
Authenticode signature is invalid

How to determine Win32/Injector.ESBM?


File Info:
name: B37A9E34617B635C24EA.mlw
path: /opt/CAPEv2/storage/binaries/086c240aa8033ce79613199a68263841f9dd2dffa8a2cbbbef607d4e8a82f2ae
crc32: B995B4A5
md5: b37a9e34617b635c24eaf8ad9319aff0
sha1: e3bb1529d71e0afe6a8ef4244ed97bf650d72720
sha256: 086c240aa8033ce79613199a68263841f9dd2dffa8a2cbbbef607d4e8a82f2ae
sha512: eadad5ed575381879ca547e6e45c6513e048f0ab26f14e118c67e9f85cf2aeb67cbf0d8a88891f89b1bca1d0bce42d3dece379cc7848367db72e7bc79b4e3f8b
ssdeep: 768:bjNL6EqIjHaHX9OZ3c0KJtfQXkID64uju:fNu6jOX9OZ3SJtf934uj
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T186E2A3727545C2F1D3D55AF488E7A6F9417BAD30EBD4A193A680F91A2A302D36CE334C
sha3_384: 9818b4cf786c1dbc3089d7cd1e7dfb6e74cb9c0eb3b113569473079d22eb577d9505ff150e0e69f1e4f4092f40a7aa3b
ep_bytes: e818060000e97afeffffc20000558bec
timestamp: 2022-09-28 14:22:19

Version Info:
CompanyName: MicroSoft
FileDescription: MicroSoft Company
FileVersion: 2.2.0.1
InternalName: MicroSoft.exe
LegalCopyright: Copyright (C) 2014-2022
OriginalFilename: MicroSoft.exe
ProductName: GettaPrig
ProductVersion: 8.7.2.0
Translation: 0x044f 0x04b0

Win32/Injector.ESBM also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (moderate confidence)
MicroWorld-eScan	Trojan.GenericKD.62382872
FireEye	Generic.mg.b37a9e34617b635c
ALYac	Gen:Variant.Fugrafa.265601
VIPRE	Trojan.GenericKD.62382872
Sangfor	Trojan.Win32.Agent.V6uc
Cyren	W32/Injector.BBZ.gen!Eldorado
ESET-NOD32	a variant of Win32/Injector.ESBM
APEX	Malicious
Cynet	Malicious (score: 100)
BitDefender	Trojan.GenericKD.62382872
Avast	Win32:Evo-gen [Trj]
Ad-Aware	Trojan.GenericKD.62382872
Emsisoft	Trojan.GenericKD.62382872 (B)
McAfee-GW-Edition	Artemis
MAX	malware (ai score=85)
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Trojan.GenericKD.62382872
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5260461
McAfee	Artemis!B37A9E34617B
Rising	Trojan.Inject!8.103 (CLOUD)
Fortinet	Malicious_Behavior.SB
AVG	Win32:Evo-gen [Trj]
CrowdStrike	win/malicious_confidence_90% (W)

How to remove Win32/Injector.ESBM?

Win32/Injector.ESBM removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X