Win32/Packed.Enigma.EM removal guide

The Win32/Packed.Enigma.EM is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Packed.Enigma.EM virus can do?

Executable code extraction
Creates RWX memory
Unconventionial binary language: Polish
The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Win32/Packed.Enigma.EM?


File Info:
crc32: FA7C32A0
md5: 3b4db322f08c2297f3d7e9d0bb55d5c1
name: 3B4DB322F08C2297F3D7E9D0BB55D5C1.mlw
sha1: 46e2033ee01f9cfa668f6f4afe933b872578a8d8
sha256: 01a4e5718af96f7cef877b1ae647b5a2f992e52e534caa072f795d15509ba5c4
sha512: a25195196fffe92662b413490d375e22f38149376b11587b84afb8f4fe565a9829fc15c9ff30dfcd12e28aba0dc653c09fc3f166ed1d72f8599182d7279347e5
ssdeep: 49152:hoXxCmTIMw9zsUbbzGNUIFvS2Wt4hyw/OfBrPXxh88fW7EWdJZT/UYiSb6xO5p:hoXxCmT3oXzG2IlRhoPXMEWJlMYJb2O
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyrights (C) 2021 Tomasz Smolarek
InternalName: GeniuszZUA.exe
FileVersion: 4.0.1.1
CompanyName: Biuro Rachunkowe SMOLAREK
LegalTrademarks: Trademarks (R) 2021 Tomasz Smolarek
Comments: https://smolarek.biz.pl/sklep
ProductName: Geniusz ZUA
ProductVersion: 4.0.1.1
FileDescription: GeniuszZUA - ma go ksix119gowa kolegi
OriginalFilename: geniuszzua.exe
Translation: 0x0415 0x04b0

Win32/Packed.Enigma.EM also known as:

Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
Cylance	Unsafe
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Packed.Enigma.EM
Zoner	Probably Heur.ExeHeaderH
APEX	Malicious
Avast	FileRepMalware
Sophos	Generic ML PUA (PUA)
McAfee-GW-Edition	BehavesLike.Win32.Dropper.vc
FireEye	Generic.mg.3b4db322f08c2297
SentinelOne	Static AI – Malicious PE
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
AhnLab-V3	Malware/Win.Generic.C4572607
McAfee	Artemis!3B4DB322F08C
VBA32	BScope.Trojan.Tasker
Rising	Malware.Heuristic!ET#100% (RDMK:cmRtazqeWBmjQIiqP/XW9qiXYoaY)
Ikarus	PUA.EnigmaProtector
Fortinet	W32/Agent.81BB!tr
AVG	FileRepMalware

How to remove Win32/Packed.Enigma.EM?

Win32/Packed.Enigma.EM removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X