Possible malware sample

[Mike123]

Filename: SiMPLEX.exe / installproject.exe

URL reports: "https://www.virustotal.com/#/file/f6501a5b7612d10d3fd6594e730c07e0f9384e182e2682b4f752cfb6ddb6a56e/detection"

MD5: 378e021cdd0ce052595061b0d32370ab

MalwareBytes says: MachineLearning/Anomalous.97%

What did it do/install? No uninstall created that I can see. MalwareBytes scan says PC is "clean". Could it be cause for PC fan going up when PC is left alone?

Thanks in advance!

sample.zip

[Emphyrio]

Sample is too old.

Creation Time 2017-04-17 10:15:14

First Seen In The Wild 2010-11-20 23:29:33

First Submission 2017-04-27 19:47:16

Please reference the following on how to provide sample submissions such that Malwarebytes' Anti-Malware (MBAM) can detect targeted but presently undetected threats.

 

Malware Hunters group

Purpose of this forum

Edited July 19, 2018 by Emphyrio

[Mike123]

Hi, I read those info beforehand and before posting I checked:

Searched the web on how to send in suspected files to malwarebytes. An official MWB page told me to register on these forums and post here. Before that I read those infos of what was needed and only new files.

I searched these forums for MD5 and found nothing before my first post.

The three different virustoolcheck webpages were used and 3 links were added (although had to remove 2 because forum thought I was posting spam).

Info I found was June 24th, 2018 on reddit as release date, so only 24 days old. So maybe older installer but new package with it (installation files etc). So it is at the least a brand new re-relase of a previous installer. Either originally so or tampered by unknown so the June 24th installer has been exchanged with something similar but older (I don't know).

"MachineLearning/Anomalous.97%" on MWB app means heuristic algorithm thinks it might be suspicious but nothing has been done about it: i.e. new.

 

 

If it is so old, then can you please tell me what it is? What it did and how to remove all traces of it? (some kind of install log it might have left) i.e. where I can look for info about it.

Or a sandbox tool I can use myself to capture what it does.

Or to which place post in MalwareBytes forums (or elsewhere). As what I've read the "MachineLearning/Anomalous.97%" with different numbers means that its a heuristic algorithm that thinks its fishy but doesn't know for sure. So a 2010 file to still not have been identified seems... odd.

Thanks in advance!

Edited July 19, 2018 by Mike123

[David H. Lipman]

You are misinterpreting the data.

From the Virus Total Report URL it is reported that the First Seen In The Wild date was in 2010 and the Virus Total First Submission date was April  '17

That indicates that this is old malware.  It is not when you find the file that counts but when it was seen by the anti malware community.  Both of the above dates are older than the maximum file age requirements for submission which is 3 months.

 

[AdvancedSetup]

Hello @Mike123 and

Let me have you run the following and we'll check and see if your computer is infected or not.

 

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan.
• When finished, please click Clean.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks