Win32/Packed.Themida.CLW malicious file

The Win32/Packed.Themida.CLW is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Packed.Themida.CLW virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Checks for the presence of known windows from debuggers and forensic tools
• Checks for the presence of known devices from debuggers and forensic tools
• Checks for the presence of known devices from debuggers and forensic tools
• Detects the presence of Wine emulator via registry key
• Checks the version of Bios, possibly for anti-virtualization
• Detects VirtualBox through the presence of a registry key

How to determine Win32/Packed.Themida.CLW?

File Info:
name: FEDBF6841538DA02A28B.mlw
path: /opt/CAPEv2/storage/binaries/09275192480be10469bb7efbb59137a6d864f3584a2a3a149ceda9579b4db2e4
crc32: 04CE1179
md5: fedbf6841538da02a28b41fcceb3ce2e
sha1: 5dba5e39aed4b4fb2646f83d41df40a5f1a161ae
sha256: 09275192480be10469bb7efbb59137a6d864f3584a2a3a149ceda9579b4db2e4
sha512: 72c7b6be4286be12c0e3a6c77d1c9e7e64a98cb1fe725e5ca894ebcaeed6944d4a0ff53bde722b97e4a0ce479dc1274ad8937f0f68dd0199da77b9ad920e6b20
ssdeep: 98304:G2cPK83psgVRDzqcsxu/isHl32Ab9csP2Hrpowqsoqk:pCKWpOcsxuRHYAbbkqsTk
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T199361213A3A6D031FFABA2739FA5F20556BD7C250133852F12AC1D79BD701B1626E623
sha3_384: 99a85ebd0ffa3555d25cbf4c3424de58e8fd380e0a6486789fdb5b1cca7cd4bad8316f5de497d11382c44ebcfa7204d8
ep_bytes: e8c8d00000e97ffeffffcccccccccccc
timestamp: 2020-06-11 11:37:02

Version Info:
CompanyName: RadiXX11
FileDescription: Keygen for High-Logic Products
FileVersion: 1.0.0.0
InternalName: Keygen.exe
LegalCopyright: © 2019, RadiXX11
LegalTrademarks: 
OriginalFilename: Keygen.exe
ProductName: High-Logic Products Keygen
ProductVersion: 1.0.0.0
Comments: 
Translation: 0x0409 0x04e4

Win32/Packed.Themida.CLW also known as:

How to remove Win32/Packed.Themida.CLW?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.