Categories: Trojan

Win32/TrojanDownloader.Small.PSD (file analysis)

The Win32/TrojanDownloader.Small.PSD is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/TrojanDownloader.Small.PSD virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction – unpacking
Attempts to connect to a dead IP:Port (1 unique times)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Attempts to modify proxy settings

How to determine Win32/TrojanDownloader.Small.PSD?


File Info:
name: 54438055C68BA083EF0F.mlwpath: /opt/CAPEv2/storage/binaries/035e6fe00cde8393934233300f8f749d2f0faf28ef7050af168eeb3b7b484760crc32: 93BA84D0md5: 54438055c68ba083ef0f55768a7aa435sha1: 49b48c8e954b8e894adafef1aa62066e3c5bbaa5sha256: 035e6fe00cde8393934233300f8f749d2f0faf28ef7050af168eeb3b7b484760sha512: 2006944c70cabfc4ea0d43048818180c1c4024ff6349e2d5fe8d003da992feee6cef6b565af5ae663d6b08bb597a86ba73a16591d06ef38f3952dc667c56abc1ssdeep: 1536:pc2YPcjRYjC3jogmwJZScLwdiT1YchKpTbwJVY14fTcuolHJl9ZsCMpV:pzY/GucLwdK6vpPwD64fTcuEj9Utype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T19A837A23F6D24572E549067548E79B06537EBC928B604FC36A9C368E3A733E55E3B302sha3_384: 314a1fa7fd2a0385e607668e7decdf53cfc6058c968f73a0f1f2c53f33d641cce3782f8d579ff680e6202d1923a26538ep_bytes: 6a606838924000e88c0f0000bf940000timestamp: 2014-05-20 10:23:26
Version Info:
URL: http://www.seemtone.orgCompanyName: WorkdayFileDescription: Practicefather fiFileVersion: 6.6.307.884InternalName: theyDev.exeLegalCopyright: © 2010 WorkdayOriginalFilename: theyDev.exeProductName: Practicefather dogProductVersion: 6.6.307.884Translation: 0x0000 0x04b0

Win32/TrojanDownloader.Small.PSD also known as:

Bkav	W32.GenericNyamaC.Trojan
Lionic	Trojan.Win32.Small.a!c
tehtris	Generic.Malware
DrWeb	Trojan.DownLoad3.32784
MicroWorld-eScan	Trojan.GenericKD.1687537
FireEye	Trojan.GenericKD.1687537
ALYac	Trojan.GenericKD.1687537
Cylance	Unsafe
Sangfor	Trojan.Win32.Small.PSD
K7AntiVirus	Trojan-Downloader ( 004977f41 )
Alibaba	TrojanDownloader:Win32/Lerspeng.52b7a107
K7GW	Trojan-Downloader ( 004977f41 )
Cybereason	malicious.5c68ba
BitDefenderTheta	Gen:NN.ZexaCO.34606.fu0@aaS7kyl
VirIT	Trojan.Win32.Generic.CDZL
Cyren	W32/Trojan.NTDR-0867
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	Win32/TrojanDownloader.Small.PSD
TrendMicro-HouseCall	TROJ_UPATRE.THD
Paloalto	generic.ml
Kaspersky	Trojan-Downloader.Win32.Small.cyue
BitDefender	Trojan.GenericKD.1687537
NANO-Antivirus	Trojan.Win32.DownLoad3.cyrkqi
Avast	Win32:Trojan-gen
Tencent	Win32.Trojan.Downloader.Wctq
Ad-Aware	Trojan.GenericKD.1687537
Sophos	Mal/Generic-R + Troj/DwnLdr-LOV
Comodo	Malware@#17cqlx5gy1zkf
Zillya	Downloader.Agent.Win32.186673
TrendMicro	TROJ_UPATRE.THD
McAfee-GW-Edition	Generic.ta
Emsisoft	Trojan.GenericKD.1687537 (B)
Ikarus	Trojan-Spy.Zbot
GData	Win32.Trojan.Agent.6GMAVP
Jiangmin	TrojanDownloader.Small.bxbe
Webroot	W32.Trojan.Gen
Avira	TR/Rogue.88576.3
Kingsoft	Win32.TrojDownloader.Small.cy.(kcloud)
ViRobot	Trojan.Win32.Zbot.88576.T
Microsoft	TrojanDownloader:Win32/Lerspeng.B
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Zbot.C167669
McAfee	Generic.ta
VBA32	TrojanDownloader.Small
APEX	Malicious
MAX	malware (ai score=100)
Fortinet	W32/Kryptik.BXXO!tr
AVG	Win32:Trojan-gen
Panda	Trj/WLT.A