Risk

About “Win32/RiskWare.HangVote.A” infection

Malware Removal

The Win32/RiskWare.HangVote.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32/RiskWare.HangVote.A virus can do?

  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary contains an unknown PE section name indicative of packing
  • Executable file is packed/obfuscated with ASPack
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Anomalous binary characteristics

How to determine Win32/RiskWare.HangVote.A?


File Info:

name: 4AA856BF7C2464B82838.mlw
path: /opt/CAPEv2/storage/binaries/6602169adce5ccb7106cf4cfb379e08b154aff6e5ba43253d916816cda85d074
crc32: 3B2F2FB1
md5: 4aa856bf7c2464b8283856bc8e58ff7f
sha1: dc6eeb746b0915ee51188996184059bb59a432d8
sha256: 6602169adce5ccb7106cf4cfb379e08b154aff6e5ba43253d916816cda85d074
sha512: 2aec48d55d656b4bae92dda10d00226d90db944343b51b8ce7406ca7e5d028e1668046fe1804347ea526cb331a7dfadebf269dc33f7b0a4182987cce3e3ed55d
ssdeep: 6144:jbKoB7lTGDKxLy6P+vUoNnxDE72AjYmxo1M/VtsIOP/Ugdh:jbKoNVGDsiUunx0FYT1MNCvP/Ugd
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1617423E79D56CC8CD04950F0318617BA2B27DCDB926103D983E277982B77710B6EDA1B
sha3_384: da40ed66571a0a7695b49021064b2c0e42602ea78c66885edfc56dde0ac7de1cc298b18339e7ed70c7bfd70bcebdeda3
ep_bytes: 60e803000000e9eb045d4555c3e80100
timestamp: 1992-06-19 22:22:17

Version Info:

0: [No Data]

Win32/RiskWare.HangVote.A also known as:

Elasticmalicious (high confidence)
DrWebBackDoor.Pigeon1.15889
FireEyeGeneric.mg.4aa856bf7c2464b8
CylanceUnsafe
ZillyaTool.HangVote.Win32.1080
SangforSuspicious.Win32.Evo.atgen
K7AntiVirusTrojan ( 7000000f1 )
AlibabaRiskWare:Win32/HangVote.b31ea931
K7GWTrojan ( 7000000f1 )
BitDefenderThetaGen:NN.ZelphiF.34084.wOWbaGl3Arbb
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/RiskWare.HangVote.A
Paloaltogeneric.ml
NANO-AntivirusTrojan.Win32.Agent.ecthkm
AvastWin32:Malware-gen
TencentWin32.Risk.Riskware.Pfjs
SophosGeneric PUA NM (PUA)
ComodoMalware@#ajttjvbymp33
McAfee-GW-EditionBehavesLike.Win32.Generic.fc
IkarusBackdoor.Win32.Hupigon
MaxSecureTrojan.Malware.300983.susgen
AviraTR/Agent.364032.28
MAXmalware (ai score=98)
Antiy-AVLTrojan/Generic.ASMalwS.8E0CF5
MicrosoftTrojan:Win32/Wacatac.B!ml
CynetMalicious (score: 100)
McAfeeArtemis!4AA856BF7C24
VBA32BScope.Trojan.Bitrep
MalwarebytesMalware.AI.2387482594
APEXMalicious
RisingTrojan.Delf!1.BA15 (CLASSIC)
YandexTrojan.GenAsa!uc0D7CAlPTo
SentinelOneStatic AI – Suspicious PE
eGambitUnsafe.AI_Score_100%
FortinetRiskware/HangVote
AVGWin32:Malware-gen

How to remove Win32/RiskWare.HangVote.A?

Win32/RiskWare.HangVote.A removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment