What is “Worm.Win32.Pajetbin.hfc”?

The Worm.Win32.Pajetbin.hfc is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm.Win32.Pajetbin.hfc virus can do?

• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• Drops a binary and executes it
• Authenticode signature is invalid
• Deletes its original binary from disk
• Creates a copy of itself
• Anomalous binary characteristics

How to determine Worm.Win32.Pajetbin.hfc?

File Info:
name: DCD3DC068FE423F7A364.mlw
path: /opt/CAPEv2/storage/binaries/38a46d0dc3b4ac5d8e839a9ad72a415b5cb8a111d32a3339d16fc24c30ad2c0a
crc32: 6C1EAF2E
md5: dcd3dc068fe423f7a36482bc9eda4964
sha1: 0230ee56eb88098a832e285d5a9d4c94b8ed1d8c
sha256: 38a46d0dc3b4ac5d8e839a9ad72a415b5cb8a111d32a3339d16fc24c30ad2c0a
sha512: a458fc7570a9d61cd2fee6989a5ca6d6fa78cb9a2072240e720036bce9974376d4535c16a3fcd688bebe7db44b9ca7623281893b0a28af729fe789b7fbe733d7
ssdeep: 3072:/cL0bUTppDAYzIMUNRD5b0zs7y4JTrjg8nVh2t8nVh2xt:bbUTp1VUjD5as7y4JTrjhVPVG
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F9F36C03FB9481A7F9A142B22C3746655E36BC3214918F4F6795BA5E6C32783F8B431B
sha3_384: 39e004e67902a1413e4b225e815b9b6f4d6edc9b9a6f073eed39d5dd16898a9680c29afd57cf9c5901d739144d9662ec
ep_bytes: 81ecd4020000535556576a2033ed5e89
timestamp: 2013-12-25 05:01:44

Version Info:
CompanyName: Mozilla Corporation
FileDescription: Mozilla Maintenance Service Installer
FileVersion: 43.0.1
LegalCopyright: Mozilla Corporation
LegalTrademarks: Firefox is a Trademark of The Mozilla Foundation.
OriginalFilename: maintenanceservice_installer.exe
ProductName: Firefox
ProductVersion: 43.0.1
Translation: 0x0409 0x04b0

Worm.Win32.Pajetbin.hfc also known as:

How to remove Worm.Win32.Pajetbin.hfc?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.