Malware

Win32/Packed.Themida.FJI (file analysis)

Malware Removal

The Win32/Packed.Themida.FJI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32/Packed.Themida.FJI virus can do?

  • Executable code extraction
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • Expresses interest in specific running processes
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Checks for the presence of known windows from debuggers and forensic tools
  • The following process appear to have been packed with Themida: intervpnmix2.exe
  • Writes a potential ransom message to disk
  • Checks for the presence of known devices from debuggers and forensic tools
  • Detects the presence of Wine emulator via registry key
  • Checks the version of Bios, possibly for anti-virtualization
  • Detects VirtualBox through the presence of a registry key
  • Anomalous binary characteristics

Related domains:

iplogger.org
jjload03.top

How to determine Win32/Packed.Themida.FJI?


File Info:

crc32: 219BDF7B
md5: dde14b5bc48b211d8fa75c1d76e02cdc
name: intervpnmix2.exe
sha1: b199b71d8b3569263da1c706641df4f0772dcea3
sha256: db49fb6c32d6214b2ca0e7045b1d1c18d5f07ddde690da8304d917cea96bbf57
sha512: 2ba86e04dccce3c71dc38ac08c5ef1512a4d1ea9c5658b946e9aa2f526684e4bfc012f34800b6d3586c2494d856a32bae87d42d2970651bacd92eacd194b668d
ssdeep: 196608:35G3oFXzSHflKvlz/1tcko57xBTJu7sbssCr3fVCZ08jEOI0Y8tnSmgG:3A3oFXzGflK9z17stldCBCZ0xfghgG
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Inter VPN SOFT Inc.
ProductVersion: 2.2.3.0
FileVersion: 2.2.3.0
FileDescription:
Translation: 0x0000 0x04b0

Win32/Packed.Themida.FJI also known as:

DrWebProgram.Unwanted.2892
MicroWorld-eScanTrojan.GenericKD.42876714
Qihoo-360Win32/Virus.RiskTool.c0f
McAfeeArtemis!DDE14B5BC48B
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
K7AntiVirusTrojan ( 005538c91 )
BitDefenderTrojan.GenericKD.42876714
K7GWTrojan ( 005538c91 )
CyrenW32/Trojan.OZXZ-2509
APEXMalicious
AvastWin32:Trojan-gen
ClamAVWin.Malware.Stralo-7590910-0
GDataWin32.Trojan.AutoHotkey.RQH2WC
KasperskyTrojan-Downloader.Win32.Stralo.hr
AegisLabRiskware.Win32.Generic.1!c
TencentWin32.Trojan-downloader.Stralo.Wwnx
Endgamemalicious (high confidence)
SophosMal/Generic-S
ComodoMalware@#qjehutmlb2jn
F-SecureHeuristic.HEUR/AGEN.1038489
ZillyaTrojan.GenericKD.Win32.30057
McAfee-GW-EditionBehavesLike.Win32.Dropper.rc
FireEyeGeneric.mg.dde14b5bc48b211d
EmsisoftTrojan.GenericKD.42876714 (B)
WebrootW32.Adware.Gen
AviraTR/RedCap.ytrwb
MicrosoftTrojan:Win32/Occamy.C
ArcabitTrojan.Generic.D28E3F2A
ZoneAlarmHEUR:Trojan-Downloader.Win32.Stralo.gen
Acronissuspicious
ALYacTrojan.GenericKD.42876714
MAXmalware (ai score=89)
Ad-AwareTrojan.GenericKD.42876714
MalwarebytesTrojan.Downloader.AHK.Themida
PandaTrj/CI.A
ESET-NOD32a variant of Win32/Packed.Themida.FJI
TrendMicro-HouseCallTROJ_GEN.R002H07CK20
RisingDownloader.Stralo!8.1147C (CLOUD)
YandexRiskware.Unwanted!
eGambitUnsafe.AI_Score_99%
FortinetW32/GenericKD.E3FB!tr
AVGWin32:Trojan-gen
Paloaltogeneric.ml

How to remove Win32/Packed.Themida.FJI?

Win32/Packed.Themida.FJI removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment