Win32/Packed.AutoIt.OR removal guide

The Win32/Packed.AutoIt.OR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Packed.AutoIt.OR virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Installs itself for autorun at Windows startup
• Exhibits behavior characteristics of BlackRemote/BlackRAT RAT
• Attempts to bypass application whitelisting by executing .NET utility in a suspended state, potentially for injection
• CAPE detected the LimeRAT malware family
• Checks the version of Bios, possibly for anti-virtualization
• Checks the CPU name from registry, possibly for anti-virtualization
• Collects information to fingerprint the system

How to determine Win32/Packed.AutoIt.OR?

File Info:
name: 446F6ACD6D7D2C7A2FF8.mlw
path: /opt/CAPEv2/storage/binaries/16f4dd43cfb521ff3b30834f1510873c20d4a5711677653109586d4f7bb03c97
crc32: 47FB1C2E
md5: 446f6acd6d7d2c7a2ff8a44d073ee702
sha1: 23f000469a59bc3a31817c046d2213f5b4574dda
sha256: 16f4dd43cfb521ff3b30834f1510873c20d4a5711677653109586d4f7bb03c97
sha512: f7a9b313a7b6191a258464b0b2bf4a84fbb8722d8c924e496a9f1352410b93196fd339d46c2f03c0df78f3cc26dd230efc773019833f9fa8d7dde9afb90218cf
ssdeep: 12288:YYV6MorX7qzuC3QHO9FQVHPF51jgceju5/vn0yxC+8V80SGO:3BXu9HGaVHhHn0yxIoGO
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FBE4BFE06AB809B0FD561F77D9F06C7809967F51399C945BBCB4B02F04328C9E9296B3
sha3_384: 09440439fee73c8a04233e502378a4d849431ab0fc7e7acd791af8b75578bc7f132941012c378f65c9fb977400dc6874
ep_bytes: 60be00904d008dbe0080f2ff57eb0b90
timestamp: 2019-05-06 15:06:57

Version Info:
Translation: 0x0809 0x04b0

Win32/Packed.AutoIt.OR also known as:

How to remove Win32/Packed.AutoIt.OR?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.