About “Win32/OfferCore.E potentially unwanted” infection

The Win32/OfferCore.E potentially unwanted is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/OfferCore.E potentially unwanted virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Presents an Authenticode digital signature
• Reads data out of its own binary image
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Deletes executed files from disk
• Collects information to fingerprint the system

How to determine Win32/OfferCore.E potentially unwanted?

File Info:
name: 311C8C8B0A7969C5A2DD.mlw
path: /opt/CAPEv2/storage/binaries/902b9776c55d4faa546f79fbeebc5fab3eb66fe8f9f956371a85c61301eeb942
crc32: A87C0FA4
md5: 311c8c8b0a7969c5a2dd5d7b5cc780c8
sha1: 48bd88286d89df764444975f16d5a452c1cfa91f
sha256: 902b9776c55d4faa546f79fbeebc5fab3eb66fe8f9f956371a85c61301eeb942
sha512: 8bab5dce949ebd6a8c5061f0e3211ed02532c81ef61b3fef9b7609aeeb05f2549db2aa7c8ae8812988fdac3628c6d6130675c390f2bfb3d8de1bcefd3d6b4975
ssdeep: 49152:WBuZrEU5FrLJu5mLufLhrKoQ+9V2AB3HUF9V:gkL5FrI5mm1rKmRUFL
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19385CF3FB268653ED5AE0B3245B39320997B7E61B81B8C1E47F0680CCF765601E3B656
sha3_384: dea4e87c4464048a3e26878890ccb73aef7e7fc03f675a44ee6b3b091a6b579be58d6f19d6ba82725818a9e479d738ff
ep_bytes: 558bec83c4a453565733c08945c48945
timestamp: 2022-04-14 16:10:23

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName:                                                             
FileDescription: uTorrеnt Web®                                               
FileVersion: 1.4                 
LegalCopyright: ©2022 RainBerry Inc. All Rights Reserved                                                            
OriginalFileName:                                                   
ProductName: uTorrеnt Web®                                               
ProductVersion: 1.4                                               
Translation: 0x0000 0x04b0

Win32/OfferCore.E potentially unwanted also known as:

How to remove Win32/OfferCore.E potentially unwanted?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.