Categories: Spy

Win32/Spy.Delf.NEH removal instruction

The Win32/Spy.Delf.NEH is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Spy.Delf.NEH virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
Yara rule detections observed from a process memory dump/dropped files/CAPE
The binary contains an unknown PE section name indicative of packing
Executable file is packed/obfuscated with ASPack
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Checks for the presence of known devices from debuggers and forensic tools
Checks for the presence of known devices from debuggers and forensic tools
Anomalous binary characteristics

How to determine Win32/Spy.Delf.NEH?


File Info:
name: 987AB74DCC270A54AA9B.mlwpath: /opt/CAPEv2/storage/binaries/0d874318c1291384a74d3288aeba0718f6df9127934822b4ba8ed5032513a0aacrc32: 5DC4618Cmd5: 987ab74dcc270a54aa9b74423fa7ecf0sha1: 1c3b133d98e3568d60d1306a006d606989791f27sha256: 0d874318c1291384a74d3288aeba0718f6df9127934822b4ba8ed5032513a0aasha512: 5f695e5d0a840db9ed54d698932ff4afb69fa14968b330aba3882bb6cb6f131bf35a1f89f577c0b219f9525c6661238b711a30e19a7552c1c603266017db370cssdeep: 12288:/4W8MA3eR1vWv7XLhOUL3Qwz9v/M2YMdmr:/bAODev7XdHL3QwBv/M2Htype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T16B84230B67A048B0DA9D423B445D4AE823FCEDDD077AF131A69E04BDF8134854FB5A8Esha3_384: e184d1251f7944900cea5c47fbc8fd730612ccbab7bd4d9b6fc1d0f12e3247d7dc5e57dfd4866758cd086e3d9567ba6fep_bytes: 60e803000000e9eb045d4555c3e80100timestamp: 2007-05-16 05:05:22
Version Info:
0: [No Data]

Win32/Spy.Delf.NEH also known as:

MicroWorld-eScan	Packer.Malware.NSAnti.A
FireEye	Generic.mg.987ab74dcc270a54
ALYac	Packer.Malware.NSAnti.A
Cylance	Unsafe
VIPRE	Packer.Malware.NSAnti.A
Sangfor	Trojan.Win32.Hupigon.atAML
BitDefender	Packer.Malware.NSAnti.A
CrowdStrike	win/malicious_confidence_70% (W)
Arcabit	Packer.Malware.NSAnti.A
Cyren	W32/Hupigon.WPKB-1170
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Spy.Delf.NEH
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	Packed.Win32.NSAnti.r
Alibaba	TrojanDropper:Win32/NSAnti.5ae0377d
NANO-Antivirus	Trojan.Win32.NSAnti.mhgy
Rising	Trojan.Win32.NSAnti.bm (CLASSIC)
Ad-Aware	Packer.Malware.NSAnti.A
Sophos	ML/PE-A + Mal/Behav-270
Comodo	Packed.Win32.Aspack.AB@1s8lrk
DrWeb	Trojan.MulDrop.7869
Zillya	Backdoor.PePatch.Win32.31134
TrendMicro	TROJ_NSANTI.CF
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
Trapmine	malicious.high.ml.score
Emsisoft	Packer.Malware.NSAnti.A (B)
Ikarus	Virus.Win32.Delf.EJK
Jiangmin	Backdoor/Huigezi.2007.wix
Avira	TR/ATRAPS.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.126
Kingsoft	Win32.Hack.NsAnti.r.(kcloud)
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Packer.Malware.NSAnti.A
Google	Detected
McAfee	Artemis!987AB74DCC27
MAX	malware (ai score=100)
VBA32	BScope.TrojanDownloader.Delf
Malwarebytes	Malware.Heuristic.1004
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_NSANTI.CF
Tencent	Win32.Packed.Black.Cdhl
Yandex	Trojan.GenAsa!n9SWd+dD/P0
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/OnlineGames!tr
BitDefenderTheta	AI:Packer.26AA100F1F
AVG	Win32:Evo-gen [Trj]
Cybereason	malicious.dcc270
Avast	Win32:Evo-gen [Trj]