Categories: Malware

Win32/Injector.YHN removal tips

The Win32/Injector.YHN is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.YHN virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Creates RWX memory
Dynamic (imported) function loading detected
Reads data out of its own binary image
A process created a hidden window
Drops a binary and executes it
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Created a process from a suspicious location
Installs itself for autorun at Windows startup

How to determine Win32/Injector.YHN?


File Info:
name: F9DAF45029523C674A02.mlwpath: /opt/CAPEv2/storage/binaries/c32ced14a1d4dc3fd306cf55d7f65c29007ab00c29b8b3f08bd992b99ece2269crc32: B2E39B2Emd5: f9daf45029523c674a02c4348fafca1asha1: 670525e8804f9a38d51b2ed0a44f3d5416ef95bcsha256: c32ced14a1d4dc3fd306cf55d7f65c29007ab00c29b8b3f08bd992b99ece2269sha512: b3973aecb9670af5c1e3d884591d1af760eee98eebb9c8906e056bb4bf2912c6657177f374d0df316c03dbf509e2219262548acecd2c496786e03830a6556c33ssdeep: 24576:CZkcYXyOjbvkEhkmWbay5h1XYQOQQ5rtwD24BXcO9hbj0d:CZkXjbJkmu1XYn7/wyVebjtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T11265BEA6FA908437EF230B7C8C7A99359475BDA21D35144D6BD87F889B373823932187sha3_384: 58193b6f555e8028a749c86ad2cbde703d5f0853e68d0f0c5e4edbb8733dfeaa268592c0ad911fe9f7708e7fb5e813a0ep_bytes: 558becb9280000006a006a004975f953timestamp: 1992-06-19 22:22:17
Version Info:
0: [No Data]

Win32/Injector.YHN also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Delf.152
FireEye	Generic.mg.f9daf45029523c67
CAT-QuickHeal	Trojan.Agent.9917
ALYac	Gen:Variant.Delf.152
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 7000000f1 )
BitDefender	Gen:Variant.Delf.152
K7GW	Trojan ( 7000000f1 )
Cybereason	malicious.029523
Arcabit	Trojan.Delf.152
BitDefenderTheta	AI:Packer.68042D5919
Cyren	W32/DelfInject.FN.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Injector.YHN
ClamAV	Win.Malware.Midie-9816731-0
Kaspersky	Trojan.Win32.Agent.yznq
NANO-Antivirus	Trojan.Win32.Agent.csknzu
Rising	Trojan.Generic@AI.100 (RDMK:627e+gDQBiQRAcJN4gouuA)
Ad-Aware	Gen:Variant.Delf.152
TACHYON	Trojan/W32.DP-Agent.1485312.B
Emsisoft	Gen:Variant.Delf.152 (B)
DrWeb	Trojan.Inject1.23160
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
SentinelOne	Static AI – Malicious PE
Trapmine	malicious.high.ml.score
Sophos	ML/PE-A
APEX	Malicious
Jiangmin	Trojan/Agent.hlyg
Avira	TR/Delf.Crypted.ME
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	Trojan.Win32.Agent.yznq
GData	Gen:Variant.Delf.152
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Agent.R500431
Acronis	suspicious
McAfee	GenericRXFP-ZY!F9DAF4502952
MAX	malware (ai score=83)
VBA32	Trojan.Agent
Malwarebytes	Malware.AI.1541142593
Panda	Trj/Genetic.gen
Tencent	Trojan-ransom.Win32.Blocker.kjb
Yandex	Trojan.GenAsa!FITyXrvPyyU
Ikarus	Trojan.Win32.Agent
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Dropper.XUQ!tr
AVG	Win32:MBRlock-DV [Trj]
Avast	Win32:MBRlock-DV [Trj]
CrowdStrike	win/malicious_confidence_90% (D)