Malware

Win32/Packed.CAB.AV suspicious malicious file

Malware Removal

The Win32/Packed.CAB.AV suspicious is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32/Packed.CAB.AV suspicious virus can do?

  • Possible date expiration check, exits too soon after checking local time
  • Drops a binary and executes it
  • The binary likely contains encrypted or compressed data.
  • Uses Windows utilities for basic functionality
  • Installs itself for autorun at Windows startup
  • Anomalous binary characteristics

How to determine Win32/Packed.CAB.AV suspicious?


File Info:

crc32: ADFFE02B
md5: d612cf881fbc44862f97b3eda7b04ae5
name: D612CF881FBC44862F97B3EDA7B04AE5.mlw
sha1: b58c53bfe6110a2a393b5bebcba45c3e58dc3505
sha256: 80159ccc01a69e87746a7f9f0b79b097089e9513ba656e2036cfcaccf818eb2d
sha512: dde7b8e7f039428c9b48ad306e6639995accbfd9bc214a4774e2fa3df7ca80d3930be5e1326100df8477c857804850fcc05d9b081318f2d9e62493b04fc65b4a
ssdeep: 24576:jSFxok04goGscDhZ6fqKBgRvgGBJy6WCzlZr3t2pnxeb7FYIdiU:jV94goGsmneqdI4yTalZrt2KGv
type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MS CAB-Installer self-extracting archive

Version Info:

LegalCopyright: (c) 1997-2000 by Piotr Warezak and Rafal Wierzbicki
InternalName:
FileVersion: 1.20.3.236
CompanyName: Piotr Warezak, Rafal Wierzbicki
LegalTrademarks:
Comments:
ProductName: WWPack32
ProductVersion: 1.20
FileDescription: Windows 95/98/NT/2000 executable files compressor
OriginalFilename: wwpack.exe
Translation: 0x0409 0x04e4

Win32/Packed.CAB.AV suspicious also known as:

K7AntiVirusTrojan ( 00589abe1 )
LionicTrojan.Win32.Agent.m!c
CynetMalicious (score: 100)
ALYacTrojan.GenericKD.47262714
CylanceUnsafe
AlibabaPacked:Win32/AVEvader.d6c2c52e
K7GWTrojan ( 00589abe1 )
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Packed.CAB.AV suspicious
AvastWin32:Malware-gen
KasperskyBackdoor.Win32.Agent.myueom
BitDefenderTrojan.GenericKD.47262714
MicroWorld-eScanTrojan.GenericKD.47262714
Ad-AwareTrojan.GenericKD.47262714
SophosMal/Generic-S
McAfee-GW-EditionBehavesLike.Win32.BadFile.tc
FireEyeTrojan.GenericKD.47262714
EmsisoftTrojan.GenericKD.47262714 (B)
eGambitUnsafe.AI_Score_99%
KingsoftWin32.Hack.Agent.(kcloud)
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
ArcabitTrojan.Generic.D2D12BFA
ZoneAlarmBackdoor.Win32.Agent.myueom
GDataTrojan.GenericKD.47262714
McAfeeArtemis!D612CF881FBC
MAXmalware (ai score=88)
VBA32Backdoor.Agent
PandaTrj/CI.A
TrendMicro-HouseCallTROJ_GEN.R002H0CJU21
FortinetRiskware/Application
AVGWin32:Malware-gen
Paloaltogeneric.ml

How to remove Win32/Packed.CAB.AV suspicious?

Win32/Packed.CAB.AV suspicious removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment