Worm

Worm:Win32/Eggnog!pz (file analysis)

Malware Removal

The Worm:Win32/Eggnog!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Worm:Win32/Eggnog!pz virus can do?

  • Sample contains Overlay data
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Attempts to identify installed AV products by installation directory

How to determine Worm:Win32/Eggnog!pz?


File Info:

name: 1C4CF9A57B838D7B4E44.mlw
path: /opt/CAPEv2/storage/binaries/082c4200e40689eac7a35828b5d0a21476f7a1347395a5e04ab92cfa636e78ca
crc32: C059DC17
md5: 1c4cf9a57b838d7b4e4497da4518cdbc
sha1: 24f746aebd9c5d939ccd73027d820bc8dff9cf4d
sha256: 082c4200e40689eac7a35828b5d0a21476f7a1347395a5e04ab92cfa636e78ca
sha512: 19ca2affab00a46d93a2021d275707e823e93d816d279e1e5fdecb731af07bae4f9ec3042e3f8aebcd4f1d3563c077f4cec05cb0b8e59cec6d4c271c2202e638
ssdeep: 1536:ovKqZZQs1ShQi7+q0birvqVO9yuzDRNNBIDWtuiq3VG8hO1qvGLvy5zmNc:ovZx1UGpiWVO9yuPRTBIytuZfyqvUm
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F083E043F6D1D972C2608ABD6E06B538EF6F7E203E49009219F95FCD2C262912D1D0AB
sha3_384: 92b6aa8cf8d866d2c439f658f9166ac29c868cae093dcc31315b5b22456265d894dae9ef09e676e017987f74e588be02
ep_bytes: 558bec83c4f053b8346f4000e85fd4ff
timestamp: 1992-06-19 22:22:17

Version Info:

0: [No Data]

Worm:Win32/Eggnog!pz also known as:

BkavW32.FamVT.EggogK.Worm
MicroWorld-eScanGen:Trojan.P2P-Worm.fGZ@aa4wiCi
CAT-QuickHealWorm.Eggnog.S28830318
SkyhighBehavesLike.Win32.Eggnog.mc
McAfeeW32/Eggnog.worm.gen
MalwarebytesGeneric.Trojan.Delf.DDS
VIPREGen:Trojan.P2P-Worm.fGZ@aa4wiCi
SangforTrojan.Win32.Save.a
K7AntiVirusEmailWorm ( 005a7b871 )
K7GWTrojan ( 000a4e6a1 )
CrowdStrikewin/malicious_confidence_100% (D)
ArcabitTrojan.P2P-Worm.E6556B
BaiduWin32.Worm.Eggnog.a
VirITTrojan.Win32.Generic.BBBU
SymantecW32.Nofer.A@mm
Elasticmalicious (high confidence)
ESET-NOD32Win32/Eggnog.E
CynetMalicious (score: 100)
APEXMalicious
ClamAVWin.Worm.Eggnog-1
KasperskyP2P-Worm.Win32.Eggnog.f
BitDefenderGen:Trojan.P2P-Worm.fGZ@aa4wiCi
NANO-AntivirusTrojan.Win32.Eggnog.qxemv
AvastWin32:WormX-gen [Wrm]
TencentWorm.Win32.Eggnog.a
SophosW32/Eggnog-Fam
F-SecureDropper.DR/Delphi.Gen
DrWebWin32.HLLW.Google.24577
ZillyaTrojan.Cospet.Win32.221
TrendMicroWORM_EGGNOG.SMI
EmsisoftGen:Trojan.P2P-Worm.fGZ@aa4wiCi (B)
IkarusWorm.Win32.Eggnog
JiangminTrojan/Cospet.gv
WebrootW32.Worm.Eggnog.Gen
VaristW32/Eggnog.A.gen!Eldorado
AviraDR/Delphi.Gen
Antiy-AVLWorm[P2P]/Win32.Eggnog
Kingsoftmalware.kb.a.1000
XcitiumTrojWare.Win32.Cospet.X0@1mafpo
MicrosoftWorm:Win32/Eggnog!pz
ViRobotWorm.Win32.A.P2P-Eggnog.36850
ZoneAlarmP2P-Worm.Win32.Eggnog.f
GDataWin32.Worm.Fearso.A
GoogleDetected
AhnLab-V3Worm/Win32.Eggnog.R66977
Acronissuspicious
BitDefenderThetaAI:Packer.775760F121
ALYacGen:Trojan.P2P-Worm.fGZ@aa4wiCi
VBA32BScope.Worm.Pluto
Cylanceunsafe
PandaGeneric Malware
TrendMicro-HouseCallWORM_EGGNOG.SMI
RisingWorm.Eggnog!1.E840 (CLASSIC)
YandexTrojan.GenAsa!9WQyNROzKr8
SentinelOneStatic AI – Malicious PE
MaxSecureWorm.W32.Eggnog.F
FortinetW32/Eggnog.E!worm
AVGWin32:WormX-gen [Wrm]
Cybereasonmalicious.ebd9c5
DeepInstinctMALICIOUS

How to remove Worm:Win32/Eggnog!pz?

Worm:Win32/Eggnog!pz removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment