Categories: Risk

Win64/Riskware.TDL.A (file analysis)

The Win64/Riskware.TDL.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win64/Riskware.TDL.A virus can do?

Possible date expiration check, exits too soon after checking local time
Unconventionial language used in binary resources: Russian
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Win64/Riskware.TDL.A?


File Info:
name: DB2DD103473439F84174.mlwpath: /opt/CAPEv2/storage/binaries/5d47d62efafb7e3ff0464b52b326f5878f12e0348cc878a00a83a81b6d9ca091crc32: 8F44973Emd5: db2dd103473439f84174c281e61ffb6dsha1: 34cefca792461f354a517ee39e92002f6feb387fsha256: 5d47d62efafb7e3ff0464b52b326f5878f12e0348cc878a00a83a81b6d9ca091sha512: 3cc6924d788ccd48b48027d0d9a238c73141602aba7e83b3b0f4762a641096d0d997b5a67f8930eff231f5ad766e4a62470bd39418b54b73016fc94541757cc7ssdeep: 1536:+E/IljXEBzRnaGK3d38uezp0Dw+49tKMgVxAlIiCNdE4kx5P9Kp2:+0uTENRndK3d38uezp0U9vgLAvp5P9type: PE32+ executable (console) x86-64, for MS Windowstlsh: T127C37D4333D91CC1F2A7823A96E66AA6D1B6BC601B71D7CF1390852B0D677D0AE37702sha3_384: 87308092c0f04da2559645e79dd20eaa9c301be3685ad4b7dafd91f6daf0383005ee9ec725cf70e3ceb9f15041a416feep_bytes: 48895c240848897c241055488dac2490timestamp: 2016-02-03 18:11:04
Version Info:
CompanyName: UG NorthFileDescription: Turla Driver LoaderFileVersion: 1.0.0.1InternalName: Loader.exeLegalCopyright: Copyright (C) 2014 - 2016 EP_X0FF, MP_ART, N.RinOriginalFilename: Furutaka.exeProductName: TurlaDriverLoaderProductVersion: 1.0.0.1Translation: 0x0400 0x04b0

Win64/Riskware.TDL.A also known as:

Lionic	Riskware.Win64.Agent.1!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Generic.30306918
ALYac	Trojan.Generic.30306918
Zillya	Tool.TDL.Win64.57
K7AntiVirus	Trojan ( 00513c691 )
K7GW	Trojan ( 00513c691 )
Cybereason	malicious.792461
Symantec	PUA.Gen.2
ESET-NOD32	a variant of Win64/Riskware.TDL.A
APEX	Malicious
Kaspersky	not-a-virus:HEUR:RiskTool.Win64.Agent.gen
NANO-Antivirus	Riskware.Win64.BadBox.gnyzpd
Avast	Win64:Malware-gen
McAfee-GW-Edition	Exploit-SigOverrider
FireEye	Generic.mg.db2dd103473439f8
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI – Suspicious PE
GData	Win64.Trojan.AntiVBox.A
Jiangmin	RiskTool.Agent.bnr
Avira	SPR/DrvTDL.A
Antiy-AVL	Trojan/Generic.ASMalwS.2989912
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 99)
McAfee	Artemis!DB2DD1034734
VBA32	Trojan.Ymacco
Malwarebytes	RiskWare.Agent
TrendMicro-HouseCall	TROJ_GEN.R002H07KQ21
Tencent	Malware.Win32.Gencirc.11498b4f
Yandex	Riskware.Agent!/0gCzJfji4s
MaxSecure	Trojan.Malware.74730711.susgen
Fortinet	Riskware/TDL
AVG	Win64:Malware-gen