Categories: Worm

What is “Worm:Win32/Mofei.P”?

The Worm:Win32/Mofei.P is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/Mofei.P virus can do?

Sample contains Overlay data
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Attempts to identify installed AV products by registry key
Deletes executed files from disk

How to determine Worm:Win32/Mofei.P?


File Info:
name: CAFB584976ECE3C6159B.mlwpath: /opt/CAPEv2/storage/binaries/0a9d9a389d0eb6161220b5c820f016b5189b5c911c744c67da2e7c9fda4e2a4ecrc32: 90FFB100md5: cafb584976ece3c6159b0f14f7b35f20sha1: b1d0f3bb862d78b4a814a42aca66b7b7bb60354fsha256: 0a9d9a389d0eb6161220b5c820f016b5189b5c911c744c67da2e7c9fda4e2a4esha512: b6472752dc6fa00c9e5fe471d25bf04ca56dd04170717a357ed1a1c3c42abfcd43419104ce27846179c3531f085e1104bb809a24269c7817c291980553f2bbb8ssdeep: 1536:+z8erPJC9O8ziPaArrK6LOhKvgEVPiGmBgZgqGIL/plNgWjzRcBRMxjxT3auc:CPJN8zY9XXOcgqQyWqj7NgWj2B+pxuuctype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T14393ACFCAA6B2894E9D17D70D017AB5CE5B47220D4663C28EFB17AA10B3F771902DE05sha3_384: 91926d9061ee82cd81ba885248219fc4eab738c808f812911d51379d17ade0860292f4352d27a5dc05aa1a7508e50b93ep_bytes: 558bec6aff684041400068463c400064timestamp: 2012-05-23 00:34:45
Version Info:
CompanyName: Microsoft CorporationFileDescription: Windows Media Core ServiceFileVersion: 5.1.2600.5512InternalName: Windows Media Core ServiceLegalCopyright: ? Microsoft Corporation. All rights reserved.OriginalFilename: wmcserv.exeProductName: Microsoft? Windows? Operating SystemProductVersion: 5.1.2600.5512Translation: 0x0409 0x04b0

Worm:Win32/Mofei.P also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Ardamax.ltGG
MicroWorld-eScan	Gen:Variant.Cerbu.78739
FireEye	Generic.mg.cafb584976ece3c6
CAT-QuickHeal	Trojan.Dynamer.9030
Skyhigh	BehavesLike.Win32.Generic.nc
ALYac	Gen:Variant.Cerbu.78739
Malwarebytes	Generic.Malware.AI.DDS
VIPRE	Gen:Variant.Cerbu.78739
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	EmailWorm ( 0053272c1 )
BitDefender	Gen:Variant.Cerbu.78739
K7GW	EmailWorm ( 0053272c1 )
Cybereason	malicious.b862d7
BitDefenderTheta	Gen:NN.ZexaF.36792.fq1@a0V36Tdj
VirIT	Trojan.Win32.Generic.ATVS
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	Win32/Mofei.NBA
APEX	Malicious
ClamAV	Win.Trojan.Losabel-2
Kaspersky	Trojan-Downloader.Win32.Losabel.cep
Alibaba	Worm:Win32/Mofei.dc89d17b
NANO-Antivirus	Trojan.Win32.Dwn.wefvz
Rising	Worm.Mofei!1.9D64 (CLASSIC)
TACHYON	Trojan-Downloader/W32.Losabel.96454
Sophos	Mal/Generic-S
F-Secure	Worm.WORM/Mofei.ocnbp
DrWeb	Trojan.DownLoader6.39375
Zillya	Downloader.Losabel.Win32.1072
TrendMicro	TROJ_GEN.R002C0CK123
Trapmine	malicious.high.ml.score
Emsisoft	Gen:Variant.Cerbu.78739 (B)
Ikarus	Net-Worm.Win32.Mofeir
Jiangmin	TrojanDownloader.Losabel.va
Webroot	W32.Malware.Gen
Google	Detected
Avira	WORM/Mofei.ocnbp
Varist	W32/A-ca7796fb!Eldorado
Antiy-AVL	Trojan[Downloader]/Win32.Losabel
Kingsoft	malware.kb.a.1000
Microsoft	Worm:Win32/Mofei.P
Arcabit	Trojan.Cerbu.D13393
ZoneAlarm	Trojan-Downloader.Win32.Losabel.cep
GData	Gen:Variant.Cerbu.78739
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Losabel.R35179
McAfee	GenericRXNF-UR!CAFB584976EC
MAX	malware (ai score=81)
DeepInstinct	MALICIOUS
VBA32	BScope.Trojan.Downloader
Cylance	unsafe
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R002C0CK123
Tencent	Malware.Win32.Gencirc.10bdbb8d
Yandex	Trojan.GenAsa!hLlLHuEIq64
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Mofei.NAY!tr
AVG	Win32:WormX-gen [Wrm]
Avast	Win32:WormX-gen [Wrm]
CrowdStrike	win/malicious_confidence_100% (W)