Worm:Win32/Eggnog!pz malicious file

The Worm:Win32/Eggnog!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Worm:Win32/Eggnog!pz virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Worm:Win32/Eggnog!pz?


File Info:
name: 27E4A4DDE29BB767960B.mlw
path: /opt/CAPEv2/storage/binaries/b0cf33e53456333c3a017c111af043ab0cb0f8b6197e9c0b0ca3470206dc2753
crc32: 9477B5DF
md5: 27e4a4dde29bb767960b36fa1d756336
sha1: 2f564e6b42fbe0d5c658035d4f7c1d4a36af6070
sha256: b0cf33e53456333c3a017c111af043ab0cb0f8b6197e9c0b0ca3470206dc2753
sha512: c5b95908227f178df39cdbde8da70b7c6d14e6c0f9735efd0de0f0fb01a7e7564af5c6256a3ba88d7af5306e3fb0dd9142bf787b820bc88635e9e9433853a40b
ssdeep: 1536:4MvKqZZQs1ShQi7+q0birvqqO9yBIXclqeEyz4N3eu:ZvZx1UGpiWqO9yqNhFeu
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19463CF43F2C1CD73C18089FEAD47E528967F7A602E8558D228F13FCE5E1A690AD2D15B
sha3_384: ee4efc3699169aa3ad5c399b46c20c2b51da3982e877bf41cb881d02504a09835efcc88bd56f03a2a2a3ea7080c2f7c9
ep_bytes: 558bec83c4f053b8346f4000e85fd4ff
timestamp: 1992-06-19 22:22:17

Version Info:
0: [No Data]

Worm:Win32/Eggnog!pz also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Trojan.P2P-Worm.eKZ@au9m8eo
FireEye	Generic.mg.27e4a4dde29bb767
CAT-QuickHeal	Trojan.GenericPMF.S30437502
Skyhigh	BehavesLike.Win32.Eggnog.kc
McAfee	W32/Eggnog.worm.gen
Malwarebytes	Generic.Trojan.Delf.DDS
Zillya	Worm.Eggnog.Win32.52
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	EmailWorm ( 005a7b871 )
K7GW	Trojan ( 000a4e6a1 )
Cybereason	malicious.b42fbe
BitDefenderTheta	AI:Packer.705B547921
VirIT	Trojan.Win32.Generic.BBBU
Symantec	W32.Nofer.A@mm
ESET-NOD32	Win32/Eggnog.E
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	P2P-Worm.Win32.Eggnog.f
BitDefender	Gen:Trojan.P2P-Worm.eKZ@au9m8eo
NANO-Antivirus	Trojan.Win32.Eggnog.qxemv
Avast	Win32:Evo-gen [Trj]
Tencent	Worm.Win32.Eggnog.a
Sophos	W32/Eggnog-Fam
Baidu	Win32.Worm.Eggnog.a
F-Secure	Dropper.DR/Delphi.Gen
DrWeb	Win32.HLLW.Google.24577
VIPRE	Gen:Trojan.P2P-Worm.eKZ@au9m8eo
TrendMicro	WORM_EGGNOG.SMI
Emsisoft	Gen:Trojan.P2P-Worm.eKZ@au9m8eo (B)
Ikarus	Worm.Win32.Eggnog
Jiangmin	Trojan/Cospet.gv
Webroot	W32.Worm.Eggnog.Gen
Google	Detected
Avira	DR/Delphi.Gen
Antiy-AVL	Worm[P2P]/Win32.Eggnog
Microsoft	Worm:Win32/Eggnog!pz
Xcitium	TrojWare.Win32.Cospet.X0@1mafpo
Arcabit	Trojan.P2P-Worm.E921FE
ViRobot	Worm.Win32.A.P2P-Eggnog.36850
ZoneAlarm	P2P-Worm.Win32.Eggnog.f
GData	Win32.Worm.Fearso.A
Varist	W32/Eggnog.A2.gen!Eldorado
AhnLab-V3	Worm/Win32.Eggnog.C3534480
Acronis	suspicious
VBA32	BScope.Worm.Pluto
ALYac	Gen:Trojan.P2P-Worm.eKZ@au9m8eo
MAX	malware (ai score=82)
Cylance	unsafe
Panda	Generic Malware
TrendMicro-HouseCall	WORM_EGGNOG.SMI
Rising	Worm.Eggnog!1.E840 (CLASSIC)
Yandex	Trojan.GenAsa!9WQyNROzKr8
SentinelOne	Static AI – Malicious PE
MaxSecure	Worm.W32.Eggnog.F
Fortinet	W32/Eggnog.E!worm
AVG	Win32:Evo-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)

How to remove Worm:Win32/Eggnog!pz?

Worm:Win32/Eggnog!pz removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X