How to remove “Win32/Packed.Obsidium.LA”?

The Win32/Packed.Obsidium.LA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Packed.Obsidium.LA virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the shellcode get eip malware family
• Checks for the presence of known devices from debuggers and forensic tools
• Checks for the presence of known devices from debuggers and forensic tools
• Detects VirtualBox through the presence of a device
• Anomalous binary characteristics
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Win32/Packed.Obsidium.LA?

File Info:
name: DA080BFECD8406A88821.mlw
path: /opt/CAPEv2/storage/binaries/82ab2edb9e0110f7c61813423ac6218e24e9508c250c8edd56f47dc4ed2031db
crc32: 859EE1F0
md5: da080bfecd8406a88821d910026746bb
sha1: 9302e2028cb30b01de9077a3de548aa216d21c8d
sha256: 82ab2edb9e0110f7c61813423ac6218e24e9508c250c8edd56f47dc4ed2031db
sha512: a4a76f4d6e8d5d851cf2c1089269a03252ad3e2803d624d514f3e9b683d36dd94844686bc94ad9f4964d792baa176f226285e888291dcd14fa4cb43488eff010
ssdeep: 24576:d73jAg3lEgTJlRD9iIX4Rib/N2UDZ4anoN6j7W3QgDiLL6g/c0+P:dfF3lPnRi9Rib/7DZ9noZ3QAo9l+P
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T15E5533F2D3002612F57621B3689F6EB1CC5A9D40A1B3878E0666A6CDBF338D576141EE
sha3_384: a5d9759ab48094b8b93b50665ccf855a333343b1a38bec18483b0c662dc8a066d4a16ff4b7758198b5c7eefc8ea5a001
ep_bytes: eb0220ab50eb0383b3f0e818000000eb
timestamp: 2024-01-02 17:52:24

Version Info:
FileDescription: msedge_elf
FileVersion: 1.0.0.0
ProductName: msedge_elf
ProductVersion: 1.0.0.0
ProgramID: com.embarcadero.msedge_elf
Translation: 0x0409 0x04e4

Win32/Packed.Obsidium.LA also known as:

How to remove Win32/Packed.Obsidium.LA?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.