What is “Win32:Delf-DDI [Wrm]”?

The Win32:Delf-DDI [Wrm] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32:Delf-DDI [Wrm] virus can do?

Presents an Authenticode digital signature
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Win32:Delf-DDI [Wrm]?


File Info:
name: 0032331E060B2ABAA4EB.mlw
path: /opt/CAPEv2/storage/binaries/d6d1f88deef75ef616ceeca7f4947977f6fd8be1d86b9a0a80a49be531832c9a
crc32: 10A72BF6
md5: 0032331e060b2abaa4ebe59ff59cc0e5
sha1: 8e539dafec1d1a633a1f7a4202a007ee03ddf29e
sha256: d6d1f88deef75ef616ceeca7f4947977f6fd8be1d86b9a0a80a49be531832c9a
sha512: 5644a5b057946443e90c3c5109f23d1120e78a72cfba93454fe3d4a1dca49decf096507d84ef37e231b8c896c583a553494249dc4b091476f390b8fc36b90df3
ssdeep: 3072:J2DOBV+z1SauywUaKovDmhZFPWue6ro7RKbDpEDy:yOBV+hSaXwUtoLmVWuVraRUMy
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13476D052A1088DF4EE054EB0962BD6E461B07F3109F4588FAEC4FC5FC8B12AAB16135E
sha3_384: 9e35e4f2d5dbec90aa686dea7d701c3303c90bb5956e22c39be63f1d26585705423fc69082a712f4b6c213787b770151
ep_bytes: e868040000e93afdffff538a5c2408f6
timestamp: 2011-06-17 12:14:43

Version Info:
CompanyName: Tencent
FileDescription: QQ2011
FileVersion: 1.65.2221.488
InternalName: uninstall.exe
LegalCopyright: Copyright ?2011 Tencent All Rights Reserved
OriginalFilename: uninstall.exe
ProductName: QQ2011
ProductVersion: 1.65.2221.488
Translation: 0x0409 0x04e4

Win32:Delf-DDI [Wrm] also known as:

Bkav	W32.AIDetect.malware2
DrWeb	Win32.HLLP.Padora
FireEye	Gen:Trojan.Heur.PT.fq0@bWBh2jkb
McAfee	Artemis!0032331E060B
Cybereason	malicious.e060b2
BitDefenderTheta	AI:Packer.7E89F0A41F
Cyren	W32/Wuke.A.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ClamAV	Win.Trojan.Wuke-9
BitDefender	Gen:Trojan.Heur.PT.fq0@bWBh2jkb
Avast	Win32:Delf-DDI [Wrm]
McAfee-GW-Edition	BehavesLike.Win32.BadFile.wz
Emsisoft	Gen:Trojan.Heur.PT.fq0@bWBh2jkb (B)
GData	Gen:Trojan.Heur.PT.fq0@bWBh2jkb
Gridinsoft	Ransom.Win32.Wacatac.sa
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
ALYac	Gen:Trojan.Heur.PT.fq0@bWBh2jkb
APEX	Malicious
MAX	malware (ai score=84)
Fortinet	W32/PossibleThreat
AVG	Win32:Delf-DDI [Wrm]

How to remove Win32:Delf-DDI [Wrm]?

Win32:Delf-DDI [Wrm] removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X