Win64/Packed.Enigma.CA malicious file

The Win64/Packed.Enigma.CA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win64/Packed.Enigma.CA virus can do?

• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• Reads data out of its own binary image
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the EnigmaStub malware family
• Anomalous binary characteristics

How to determine Win64/Packed.Enigma.CA?

File Info:
name: 63F120EEA3AA9D7BD8E9.mlw
path: /opt/CAPEv2/storage/binaries/0a7e221cd4bfd215be9049fb4076cf8c64def2857e79d2487f0db90cbb533250
crc32: 0D4D55B8
md5: 63f120eea3aa9d7bd8e9dcabb7df6c14
sha1: 7fba54e1d5ee1b97f22d9b9aff3e0333935912f2
sha256: 0a7e221cd4bfd215be9049fb4076cf8c64def2857e79d2487f0db90cbb533250
sha512: 9aa54638c9d1fabdf9dc4aef675e80908a1e580a169326985b12f3a8e2aa52d8dc0f2116697f5aed5d6829a68a04e99077a33de3886ce611a54949d8385b31e2
ssdeep: 24576:uovOFlilmPNM/QS3mYBX8FQqoBuXKxmOpz1vUOaGLJTqLaYaBlSv0L:/OKlmPzMBX8/Opz1vgqJm2YuMw
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T198653310E7BC5E51FE2629FB9B6E031E1D1DE407A8700D67307DDF64A83E868A9D9E40
sha3_384: 2ef16e2b6615adc2d7c444e6cf1b19529260987494b28c13e59588511ca218110ecb6de1f7b65f2df222ec0ed1c0d67e
ep_bytes: 50515253555657415041514152415341
timestamp: 2021-07-28 16:17:59

Version Info:
Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 0.0.0.0
InternalName: 1.exe
LegalCopyright:  
OriginalFilename: 1.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

Win64/Packed.Enigma.CA also known as:

How to remove Win64/Packed.Enigma.CA?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.