Win32/Pronny.DI (file analysis)

The Win32/Pronny.DI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Pronny.DI virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Attempts to disable Windows Auto Updates
• Anomalous binary characteristics
• Attempts to modify Explorer settings to prevent hidden files from being displayed
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Win32/Pronny.DI?

File Info:
name: 070C4459C54E442BFA32.mlw
path: /opt/CAPEv2/storage/binaries/fafc52ccb7898aec11b10cb650652d83a2a30bec075933634e8f3c0ca118625c
crc32: AE7D4CDF
md5: 070c4459c54e442bfa325db2b2b198e1
sha1: 71104ebfb18a286624faad08c4763f7a19f91018
sha256: fafc52ccb7898aec11b10cb650652d83a2a30bec075933634e8f3c0ca118625c
sha512: 8c5769b98dca0fbaed4fe74784691b404696d97d1ae41dac6be1c3d5043bdb9355e84c3387e16a1d4373a11b0c53a45d92bddfd16b51a2643b8f1a3c23aedc0b
ssdeep: 3072:Uq9+ZLNxfYuD7mEVSuekhGkYrQRVZq3eFo4ejLnlQISQLpyhZu6qyKdYWOQqabc:T9+hNx32WGk1Y3nmQcuyKaWO5d
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T171647461BF66FD83E049163ED3E98BB601056DFE2E06D2CBC631359A5EF1E170806636
sha3_384: 31db762682ee79df9f58e50030fbdad44817b549bdd71f7dea1daa705257baa44279d2d9da24adb37575babd1ee4180e
ep_bytes: 6868134000e8f0ffffff000000000000
timestamp: 2012-09-01 17:35:21

Version Info:
Translation: 0x0409 0x04b0
ProductName: Periosteitis
FileVersion: 1.98
ProductVersion: 1.98
InternalName: isomyarian
OriginalFilename: isomyarian.exe

Win32/Pronny.DI also known as:

How to remove Win32/Pronny.DI?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.