Trojan

Should I remove “Win32/TrojanDownloader.Agent.PMF”?

Malware Removal

The Win32/TrojanDownloader.Agent.PMF is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Win32/TrojanDownloader.Agent.PMF virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Behavioural detection: Executable code extraction – unpacking
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • Enumerates running processes
  • Expresses interest in specific running processes
  • CAPE extracted potentially suspicious content
  • Unconventionial language used in binary resources: Russian
  • Authenticode signature is invalid
  • Installs itself for autorun at Windows startup
  • Attempts to modify proxy settings

How to determine Win32/TrojanDownloader.Agent.PMF?



File Info:

name: F4C73F16CF8AE4E19D89.mlw
path: /opt/CAPEv2/storage/binaries/9a01cb51305b4647db9cdaeb53758c1e56eba2602b57d1987d6d331395670a1f
crc32: 1DC9BDF0
md5: f4c73f16cf8ae4e19d896b7eabeb505f
sha1: bfc6a77490806b62d5945333f0df238436d4ccdd
sha256: 9a01cb51305b4647db9cdaeb53758c1e56eba2602b57d1987d6d331395670a1f
sha512: 5e0dbe9828df6bfbabb17c2836c26bd8f745ba38d1334fa2f99750866d5313bbba0c1c10e94404eaa3e0f4e4325e8385cb7e906736735b06ce865cfd2e3f7c70
ssdeep: 1536:4KE1wAvZZduqJsLr7oOPTZpxE3MonEm5Pfk9g8jBfr/QVhlQJ7:PsBbuqW0mTecoEm5U9guqnw
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DAB38EC740B29CE5C177BBBBA93C4F91D52C270509A5315366F46C9233D9A8EA0CB39B
sha3_384: 8a537a48e5acf57f01d1cc494dbf47ae56e763972cccbbaea280034147288b26e92eca187ba525ba9c36dd07445134fd
ep_bytes: 558bec81c4c8feffffba6a6700006821
timestamp: 2007-12-19 20:08:40


Version Info:

CompanyName: ЩрЯтчфЗбшвЯбдИсьжжпХчУяШоЕ
FileDescription: эйЫгхЫБкпмИЗвоВУПмХдшорЫЧюуР
FileVersion: 57.0.108.13
InternalName: ХППыцт␓ВэСДЩОЗЕУФЪЭИФФьэХШ
LegalCopyright: 7602-2983
OriginalFilename: q6Gbi8I.exe
ProductName: ьГВЬЙДЭЛЪЙЮФдТЧУКТефОфФм
ProductVersion: 57.0.108.13
Translation: 0x04b0 0x0417

Win32/TrojanDownloader.Agent.PMF also known as:

BkavW32.AIDetect.malware2
LionicHacktool.Win32.Krap.x!c
Elasticmalicious (high confidence)
DrWebTrojan.Packed.20343
ClamAVWin.Trojan.Agent-784671
FireEyeGeneric.mg.f4c73f16cf8ae4e1
McAfeePWS-Zbot.gen.aum
CylanceUnsafe
VIPRETrojan.Win32.Nedsym.f (v)
SangforTrojan.Win32.Generic.8
K7AntiVirusTrojan-Downloader ( 0055e3da1 )
AlibabaVirTool:Win32/Obfuscator.4c778a89
K7GWTrojan-Downloader ( 0055e3da1 )
CrowdStrikewin/malicious_confidence_100% (W)
BitDefenderThetaAI:Packer.39FCBB141F
VirITTrojan.Win32.Packed.BECL
CyrenW32/Zbot.AK.gen!Eldorado
SymantecTrojan.Gen.MBT
ESET-NOD32Win32/TrojanDownloader.Agent.PMF
TrendMicro-HouseCallBKDR_QAKBOT.SMC
Paloaltogeneric.ml
CynetMalicious (score: 100)
KasperskyPacked.Win32.Krap.gx
BitDefenderGen:Variant.Oficla.3
NANO-AntivirusTrojan.Win32.Agent.bjtdr
MicroWorld-eScanGen:Variant.Oficla.3
TencentWin32.Trojan-downloader.Agent.Eehb
Ad-AwareGen:Variant.Oficla.3
SophosMal/Generic-R + Mal/Qbot-B
ComodoMalCrypt.Indus!@1qrzi1
ZillyaDownloader.Agent.Win32.63448
TrendMicroBKDR_QAKBOT.SMC
McAfee-GW-EditionPWS-Zbot.gen.aum
EmsisoftGen:Variant.Oficla.3 (B)
IkarusTrojan-Spy.Win32.Zbot
GDataGen:Variant.Oficla.3
JiangminTrojan/Generic.myv
AviraTR/Dropper.Gen
Antiy-AVLTrojan[Packed]/Win32.Krap
ArcabitTrojan.Oficla.3
ZoneAlarmPacked.Win32.Krap.gx
MicrosoftTrojan:Win32/Occamy.C9A
Acronissuspicious
ALYacGen:Variant.Oficla.3
MAXmalware (ai score=99)
MalwarebytesGeneric.Malware/Suspicious
APEXMalicious
RisingDropper.Generic!8.35E (CLOUD)
YandexTrojan.GenAsa!e6V5/ehlDCc
SentinelOneStatic AI – Malicious PE
eGambitUnsafe.AI_Score_100%
FortinetW32/Krap.B!tr.bdr
Cybereasonmalicious.6cf8ae
PandaTrj/Krapack.gen

How to remove Win32/TrojanDownloader.Agent.PMF?

Win32/TrojanDownloader.Agent.PMF removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment