Categories: Spy

Win32/Spy.KeyLogger.OHL (file analysis)

The Win32/Spy.KeyLogger.OHL is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Spy.KeyLogger.OHL virus can do?

Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Authenticode signature is invalid
Attempts to modify proxy settings
Harvests cookies for information gathering

How to determine Win32/Spy.KeyLogger.OHL?


File Info:
name: 4586B14C03BCEB497886.mlwpath: /opt/CAPEv2/storage/binaries/62d5a6aac81c99952c9a7ab8952a6a11a9e88b4467a7c7ee478bfb1d290ce49ccrc32: F27DE11Emd5: 4586b14c03bceb497886eb42a0763108sha1: ea9e5d3e42e96bf74ca499028f30f526fa8f356dsha256: 62d5a6aac81c99952c9a7ab8952a6a11a9e88b4467a7c7ee478bfb1d290ce49csha512: d1b527bdef8726797030728cc31de43a5e36be3450ecddce0dc796353b8a60267b27bad0eca97e95d2b63542f8cbdcadadc4beddc4d023907874707fb0b12c90ssdeep: 6144:LHLeMy1FVxcghRll+H8m8Dxgbt1yc7WN34Mp4u+XNSn9MJPuwY+NIPBMjqwhh5gP:L9yVxZRlUIq8type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T11294B6C2C732104CF76259349DCB9125E8353C66AB65AA477289E52CB3F817B3E7620Fsha3_384: 8ff595d30cb28628cd29ebf99d910f65306d245641385a50c31ab9e39591de86213131119f9151cf6d9a314f4e50848eep_bytes: 6894b94000e8f0ffffff000000000000timestamp: 2011-11-19 17:11:52
Version Info:
Translation: 0x0409 0x04b0Comments: http://anthneic.blogspot.com/CompanyName: http://anthneic.blogspot.com/FileDescription: Cheat PB InjectorLegalCopyright: © 2011 aNtHProductName: Suntik LibFileVersion: 6.00ProductVersion: 6.00InternalName: suntikOriginalFilename: suntik.exe

Win32/Spy.KeyLogger.OHL also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Multi.Generic.4!c
MicroWorld-eScan	Gen:Trojan.Heur.zm0@fzqlI6ci
McAfee	Artemis!4586B14C03BC
Cylance	Unsafe
VIPRE	Gen:Trojan.Heur.zm0@fzqlI6ci
Sangfor	Suspicious.Win32.Save.vb
K7AntiVirus	Spyware ( 0055e3db1 )
Alibaba	TrojanSpy:Win32/KeyLogger.11b8a1ad
K7GW	Spyware ( 0055e3db1 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Spy.KeyLogger.OHL
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Dropper.Cloud-6605913-0
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Trojan.Heur.zm0@fzqlI6ci
NANO-Antivirus	Trojan.Win32.Skeeyah.ecdqfn
Avast	Win32:Malware-gen
Tencent	Win32.Trojan.Generic.Ogil
Ad-Aware	Gen:Trojan.Heur.zm0@fzqlI6ci
Sophos	Generic ML PUA (PUA)
Comodo	Malware@#1yy457lzgtclj
DrWeb	BACKDOOR.Trojan
Zillya	Trojan.Keylogger.Win32.66714
McAfee-GW-Edition	BehavesLike.Win32.Trojan.gh
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.4586b14c03bceb49
Emsisoft	Gen:Trojan.Heur.zm0@fzqlI6ci (B)
SentinelOne	Static AI – Suspicious PE
GData	Gen:Trojan.Heur.zm0@fzqlI6ci
Jiangmin	Trojan.Generic.etinv
Google	Detected
Avira	TR/Spy.Skeeyah.mpoj
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Generic.ASMalwS.3C54
Microsoft	TrojanSpy:Win32/Skeeyah.A!rfn
Cynet	Malicious (score: 100)
BitDefenderTheta	AI:Packer.763125151C
ALYac	Gen:Trojan.Heur.zm0@fzqlI6ci
VBA32	BScope.Trojan.Click
Rising	Spyware.KeyLogger!8.12F (CLOUD)
Yandex	TrojanSpy.KeyLogger!Clx97cbLPOk
Ikarus	Gen.Backdoor.Heur
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	Riskware/Injector.O
AVG	Win32:Malware-gen
Cybereason	malicious.c03bce
Panda	Trj/CI.A