Malware

Win32/Picsys.D (file analysis)

Malware Removal

The Win32/Picsys.D is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Win32/Picsys.D virus can do?

  • Sample contains Overlay data
  • Reads data out of its own binary image
  • The binary contains an unknown PE section name indicative of packing
  • The executable is compressed using UPX
  • Authenticode signature is invalid

How to determine Win32/Picsys.D?



File Info:

name: 5226A96CCEA85E434C24.mlw
path: /opt/CAPEv2/storage/binaries/5e27d9ba24a1ef3caa6442ef11edde43d0f02adbb9d9c9db7d84154107d09774
crc32: 19EDE4CB
md5: 5226a96ccea85e434c247d3aa0d00ce9
sha1: 6a9e30c5c618e4d8d652e3ec204331c7a629b88a
sha256: 5e27d9ba24a1ef3caa6442ef11edde43d0f02adbb9d9c9db7d84154107d09774
sha512: b20598a5612f1ad488dbb4da7872f531aae97e80d67e09386d23858b203c7978871a76450328a3e22b1dd565a162046572d230242d44718b615ef64f0b664a76
ssdeep: 3072:QmVW8iTX/3Rfl8Xq1+0cxxsWEL02fXcIp08Moe9DESZLYJDjQCoOzkgBif:JM7jJljxYTHYZM1vNC5a
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11BA4AE03B9A2E435E0D006B49E36FEE8AA3774F11F746187BAFC6F0D1A34590993D646
sha3_384: 647eebbdb9309c6f66c0361ac1d227d77f991de47152fe4fd756d8d23f2ee5736651a350ae91aff583f795c49bba996d
ep_bytes: 558bec83c4e433c08945e88945ecb8d8
timestamp: 1996-07-28 22:22:17


Version Info:

0: [No Data]

Win32/Picsys.D also known as:

BkavW32.AIDetectMalware
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Ransom.Phobos.154
CAT-QuickHealWorm.YoofIH.S26020738
SkyhighBehavesLike.Win32.Backdoor.gz
McAfeeW32/Picsys.worm!5226A96CCEA8
Cylanceunsafe
ZillyaWorm.Picsys.Win32.4
SangforSuspicious.Win32.Save.ins
AlibabaWorm:Win32/Picsys.10056
K7GWTrojan ( 7000000f1 )
K7AntiVirusTrojan ( 7000000f1 )
ArcabitTrojan.Ransom.Phobos.154
BitDefenderThetaAI:Packer.05341F0B19
VirITWorm.Win32.PicSys.A
SymantecW32.HLLW.Yoof
tehtrisGeneric.Malware
ESET-NOD32a variant of Win32/Picsys.D
APEXMalicious
TrendMicro-HouseCallTROJ_SPNR.30CU14
ClamAVWin.Worm.Picsys-1
KasperskyP2P-Worm.Win32.Picsys.c
BitDefenderGen:Variant.Ransom.Phobos.154
NANO-AntivirusTrojan.Win32.Sock4Proxy.jpdexe
AvastWin32:TrojanX-gen [Trj]
TencentWorm.Win32.Picsys.a
TACHYONWorm/W32.Picsys
EmsisoftGen:Variant.Ransom.Phobos.154 (B)
BaiduWin32.Worm.Picsys.a
F-SecureWorm.WORM/Picsys.C.53
DrWebWin32.HLLW.Morpheus.3
VIPREGen:Variant.Ransom.Phobos.154
TrendMicroTROJ_SPNR.30CU14
Trapminemalicious.high.ml.score
FireEyeGeneric.mg.5226a96ccea85e43
SophosW32/Picsys-C
IkarusTrojan.Win32.Ransom
JiangminWorm/Picsys.a
WebrootW32.Rogue.Gen
GoogleDetected
AviraWORM/Picsys.C.53
VaristW32/PicSys.A.gen!Eldorado
Antiy-AVLVirus/Win32.Expiro.imp
XcitiumPacked.Win32.MUPX.Gen@24tbus
MicrosoftWorm:Win32/Picsys.C
ZoneAlarmP2P-Worm.Win32.Picsys.c
GDataWin32.Worm.Picsys.B
CynetMalicious (score: 100)
AhnLab-V3Worm/Win.Picsys.C5398813
Acronissuspicious
VBA32Worm.Picsys
ALYacGen:Variant.Ransom.Phobos.154
MAXmalware (ai score=81)
MalwarebytesGeneric.Malware.AI.DDS
PandaTrj/Genetic.gen
RisingWorm.Picsys!1.C132 (CLASSIC)
YandexWorm.P2P.Picsys!kNpPqZJwNbw
SentinelOneStatic AI – Malicious PE
MaxSecureWorm.W32.Picsys.C
FortinetW32/Picsys.D!worm
AVGWin32:TrojanX-gen [Trj]
DeepInstinctMALICIOUS
alibabacloudWorm:Win/Picsys

How to remove Win32/Picsys.D?

Win32/Picsys.D removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment