About “Win32/Packed.Themida.HIG” infection

Malware Removal

The Win32/Packed.Themida.HIG is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

ribbon

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
THANK YOU!
DOWNLOAD NOW
On Going Offer

What Win32/Packed.Themida.HIG virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • Expresses interest in specific running processes
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • The binary likely contains encrypted or compressed data.
  • Deletes its original binary from disk
  • Checks for the presence of known windows from debuggers and forensic tools
  • The following process appear to have been packed with Themida: 4.exe, plugin.exe
  • Installs itself for autorun at Windows startup
  • Checks for the presence of known devices from debuggers and forensic tools
  • Detects the presence of Wine emulator via registry key
  • Checks the version of Bios, possibly for anti-virtualization
  • Detects VirtualBox through the presence of a registry key
  • Creates a copy of itself
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
lodddd01.info
a.tomx.xyz
lodddd02.info

How to determine Win32/Packed.Themida.HIG?


File Info:

crc32: C69E8E6E
md5: 88638b8607fb76f12f098fa1deaa9429
name: 4.exe
sha1: 2238d9f4bb6d697f852dd2bd87d7c2f7cf0b3f72
sha256: 2bc00428f4ec31b8c6ea615edeaf78ac2bd86939410d93b91579770e2038905c
sha512: 796b80cdf32e45c014da51caf79bcd7929afa29f0935c83a378c0f659af2d0c62cbef8cba122ed5fa83d65f1850632b90bed1967d28a26242dce8ff8530b92f0
ssdeep: 24576:CUa7mdi5aEikkUBoaJ1VWMT3mL6RUHT/m2+PeRdl84VuH9DzWkBDAQNEPFkp:CUS5hFBoK2L6RUz/2PIl84gr9NuFkp
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Win32/Packed.Themida.HIG also known as:

BkavW32.HfsAutoB.
MicroWorld-eScanGen:Variant.Zusy.299365
McAfeeArtemis!88638B8607FB
CylanceUnsafe
AegisLabTrojan.Win32.DarkKomet.m!c
SangforMalware
K7AntiVirusTrojan ( 0040f4ef1 )
BitDefenderGen:Variant.Zusy.299365
K7GWTrojan ( 0040f4ef1 )
Cybereasonmalicious.4bb6d6
Invinceaheuristic
F-ProtW32/S-1a32a0f0!Eldorado
SymantecML.Attribute.HighConfidence
APEXMalicious
AvastWin32:PWSX-gen [Trj]
GDataGen:Variant.Zusy.299365
KasperskyHEUR:Backdoor.Win32.DarkKomet.gen
AlibabaPacked:Win32/Themida.5a1598ae
RisingMalware.Heuristic!ET#100% (RDMK:cmRtazrfNDQbCtSO9nZw4Dd3Z2WQ)
Endgamemalicious (high confidence)
SophosMal/Generic-S
F-SecureTrojan.TR/Crypt.TPM.Gen
VIPREBackdoor.Win32.Ircbot.gen (v)
McAfee-GW-EditionBehavesLike.Win32.Backdoor.tc
MaxSecureTrojan.Malware.300983.susgen
Trapminemalicious.high.ml.score
FireEyeGeneric.mg.88638b8607fb76f1
EmsisoftGen:Variant.Zusy.299365 (B)
CyrenW32/S-1a32a0f0!Eldorado
WebrootW32.Malware.Gen
AviraTR/Crypt.TPM.Gen
MicrosoftTrojan:Win32/Tiggre!rfn
ArcabitTrojan.Zusy.D49165
ZoneAlarmHEUR:Backdoor.Win32.DarkKomet.gen
AhnLab-V3Trojan/Win32.Agent.C3641777
Acronissuspicious
VBA32BScope.Trojan-Dropper.Inject
ALYacGen:Variant.Zusy.299365
MAXmalware (ai score=84)
Ad-AwareGen:Variant.Zusy.299365
MalwarebytesSpyware.PasswordStealer
PandaTrj/CI.A
ESET-NOD32a variant of Win32/Packed.Themida.HIG
TencentWin32.Trojan.Agent.Eawx
SentinelOneDFI – Malicious PE
eGambitUnsafe.AI_Score_99%
BitDefenderThetaGen:NN.ZexaF.34090.PzWaaKWPGxd
AVGWin32:PWSX-gen [Trj]
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_100% (W)
Qihoo-360Win32/Backdoor.34d

How to remove Win32/Packed.Themida.HIG?

Win32/Packed.Themida.HIG removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment