Categories: Worm

Worm.Win32.WhiteIce.a (file analysis)

The Worm.Win32.WhiteIce.a is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm.Win32.WhiteIce.a virus can do?

Unconventionial binary language: Russian
Unconventionial language used in binary resources: Russian
The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Worm.Win32.WhiteIce.a?


File Info:
crc32: 967F6C76md5: 04f8d99151c39a6d418bb48d83a078a0name: 04F8D99151C39A6D418BB48D83A078A0.mlwsha1: f8693e959c578b5b5c5da8e40ddad6d68f34fb90sha256: 56028e5ba656e1d7c1f68f1d79f48e6849d15a8830eb447e03d1b32832aa3fa9sha512: ab5e7dcba61b4839704aff8ff84634c319560ef1b1d2d3b0cdd99eeb0ecaa60c65dc591afc9a82acb6ec874b378ca103c42b60c07982560fe0202988cbcdbe5essdeep: 6144:CSNaPM4lof5ZxfiAjJPzQ8aY/LCaY/LCaY/LCaY/LCaY/LCaY/LCaY/LCaY/LCap:CSIhq5LfiA1occccccccc8type: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: xa9 x41ax43ex440x43fx43ex440x430x446x438x44f x41cx430x439x43ax440x43ex441x43ex444x442. x412x441x435 x43fx440x430x432x430 x437x430x449x438x449x435x43dx44b.InternalName: CALCFileVersion: 5.1.2600.0 (xpclient.010817-1148)CompanyName: x41ax43ex440x43fx43ex440x430x446x438x44f x41cx430x439x43ax440x43ex441x43ex444x442ProductName: x41ex43fx435x440x430x446x438x43ex43dx43dx430x44f x441x438x441x442x435x43cx430 Microsoftxae WindowsxaeProductVersion: 5.1.2600.0FileDescription: x41ax430x43bx44cx43ax443x43bx44fx442x43ex440 x434x43bx44f WindowsOriginalFilename: CALC.EXETranslation: 0x0419 0x04b0

Worm.Win32.WhiteIce.a also known as:

K7AntiVirus	Trojan ( 00012f681 )
DrWeb	Win32.HLLW.Bice
Cynet	Malicious (score: 100)
McAfee	Artemis!04F8D99151C3
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_70% (D)
Alibaba	Worm:Win32/WhiteIce.caccf8fa
K7GW	Trojan ( 00012f681 )
Cybereason	malicious.151c39
Baidu	Win32.Worm.WhiteIce.a
Cyren	W32/FakeFolder.P.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Whiteice.A
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Worm.Whiteice-4
Kaspersky	Worm.Win32.WhiteIce.a
BitDefender	Trojan.GenericKD.40672298
NANO-Antivirus	Trojan.Win32.WhiteIce.bvbtc
MicroWorld-eScan	Trojan.GenericKD.40672298
Tencent	Trojan.Win32.Genome.aad
Ad-Aware	Trojan.GenericKD.40672298
Sophos	Mal/Generic-S
F-Secure	Worm.WORM/Rbot.Gen
VIPRE	Virus.Win32.Tufik.ab (v)
McAfee-GW-Edition	BehavesLike.Win32.VirRansom.hc
FireEye	Generic.mg.04f8d99151c39a6d
Emsisoft	Trojan.GenericKD.40672298 (B)
SentinelOne	Static AI – Malicious PE
Avira	WORM/Rbot.Gen
eGambit	Unsafe.AI_Score_85%
Microsoft	Worm:Win32/DarkSnow.A
GData	Trojan.GenericKD.40672298
MAX	malware (ai score=100)
Malwarebytes	Trojan.FakeAlert
Panda	Trj/CI.A
Rising	Worm.Win32.BlackIce.a (CLASSIC)
Yandex	Trojan.GenAsa!UB9012DAiL8
Ikarus	Virus.Win32.Whiteice
Fortinet	W32/PossibleThreat
AVG	Win32:Malware-gen
Paloalto	generic.ml