Categories: Malware

What is “Win32/Packed.Enigma.AAF”?

The Win32/Packed.Enigma.AAF is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Packed.Enigma.AAF virus can do?

A file was accessed within the Public folder.
Sample contains Overlay data
Reads data out of its own binary image
Drops a binary and executes it
Authenticode signature is invalid
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Win32/Packed.Enigma.AAF?


File Info:
name: 401F3CAE00A83AECC0AE.mlwpath: /opt/CAPEv2/storage/binaries/e7dc7fe398fb975466d29b4bd464fb4f0b44eee2249280c36fc1ccf8adba5892crc32: 8A6A4D1Amd5: 401f3cae00a83aecc0ae7308e4f18c32sha1: 16d474918c9533db83d6922274863b83805f2f23sha256: e7dc7fe398fb975466d29b4bd464fb4f0b44eee2249280c36fc1ccf8adba5892sha512: dc9759a42d836bf39c717f53d23ca1aa6f5f8b828d0239ffb19117f19953042e8af927434637bc9ead73a3ab2f1645f6f45623ee4ff4ca73c12a7cc854bf1f7fssdeep: 98304:04G4IxiODW38TrJY0wHBb4D+YymxYAhnKU4B7y1p1fGzvFM0S1p:dLODWg6BC9ym2sW5y1Xfimptype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1F4363371FB440982F4BC61B26CFC8F07724FBF5172C7DB4A94A52A1B9DA06CAC517A06sha3_384: 225723d521a27bf1980b639653d338dab9b4b19203538cbcb6399d259077d71285068817bc09873848df02cf0ce98b3aep_bytes: 558bec6aff684851400068e435400064timestamp: 2000-02-23 18:51:14
Version Info:
Comments: This setup code is the property of Indigo Rose CorporationCompanyName: Indigo Rose Corporation http://www.indigorose.comFileDescription: Setup Factory setup launcherFileVersion: 5.0.1InternalName: setupLegalCopyright: Copyright © 2000 Indigo Rose CorporationLegalTrademarks: Setup Factory is a trademark of Indigo Rose Corporation.OriginalFilename: setup.exePrivateBuild: ProductName: setupProductVersion: 5.0.1SpecialBuild: Translation: 0x0409 0x04e4

Win32/Packed.Enigma.AAF also known as:

Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
Skyhigh	Artemis
Malwarebytes	Generic.Malware/Suspicious
Sangfor	Trojan.Win32.Generic.ky
K7AntiVirus	Trojan ( 000046bb1 )
Alibaba	Packed:Win32/Enigma.d0f22688
K7GW	Trojan ( 000046bb1 )
BitDefenderTheta	Gen:NN.ZevbaF.36792.2y3@a48k9umi
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win32/Packed.Enigma.AAF
Cynet	Malicious (score: 99)
ClamAV	Win.Trojan.Scar-6903583-0
Kaspersky	UDS:Trojan.Win32.Generic
Avast	WAT:Blacked-E
Tencent	Win32.Trojan.Generic.Tsmw
F-Secure	Trojan.TR/Agent.shqva
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Enigma
Avira	TR/Agent.shqva
Antiy-AVL	GrayWare/Win32.EnigmaProtect.a
Xcitium	Malware@#vqmxjtl4kp9r
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	HEUR:Trojan.Win32.Generic
Google	Detected
McAfee	Artemis!401F3CAE00A8
VBA32	Trojan.Tiggre
Cylance	unsafe
Panda	Trj/CI.A
Fortinet	W32/Generic!tr
AVG	WAT:Blacked-E
DeepInstinct	MALICIOUS