Mal/EncPk-AGE

Posted: October 11, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	16,804
Threat Level:	9/10
Infected PCs:	274

First Seen:	October 11, 2012
Last Seen:	September 4, 2023
OS(es) Affected:	Windows

Mal/EncPk-AGE is a Trojan dropper that's designed to install other malicious programs by connecting to a wide range of criminal-operated servers. The latest Mal/EncPk-AGE attacks all have involved Mal/EncPk-AGE being promoted as a fraudulent Adobe update. Redirects to Mal/EncPk-AGE start at fraudulent CNN news links, work through a JavaScript redirect (Mal/JSRedir-H) and then use the ignominious Blackhole Exploit Kit to expose you to the web page that hosts Mal/EncPk-AGE. Both social engineering techniques (to make you install Mal/EncPk-AGE willingly) and drive-by-downloads (exploits that install Mal/EncPk-AGE automatically) can be used during this series of attacks. SpywareRemove.com malware analysts suggest that you pay attention to potentially mislabeled links from unusual sources and have anti-malware protection that can delete Mal/EncPk-AGE and its payload whenever necessary.

Mal/EncPk-AGE: the Headline You Shouldn't Be Reading

Mal/EncPk-AGE's tale starts with e-mail spam that's formatted to look identical to news updates from CNN. These fake article links include references to Mitt Romney's recent turnaround in the presidential election's polling numbers, as well as other general-interest articles, in hopes of acquiring a large number of unwary victims. After analyzing the included links, malware experts found that they lead to a malicious website with a JavaScript redirect (identified as Mal/JSRedir-H). If you've disabled JavaScript by default, then your browser isn't vulnerable to this attack, but computers that are vulnerable are exposed to a variant of the Blackhole Exploit Kit.

The Blackhole Exploit Kit, or BEK, is a configurable package of various exploits that detect security vulnerabilities that can be used to install malicious software without the victim's permission. Interestingly enough, SpywareRemove.com malware experts have also noticed that this version of Blackhole Exploit Kit can use social engineering attacks to make victims infect themselves – apparently, only if other attack methods aren't available. BEK does this by displaying Mal/EncPk-AGE as a forged update for Adobe Flash Player, complete with an Adobe-clone web page. However, computers with outdated software or poor web-browsing security are likely to have Mal/EncPk-AGE installed without any warning.

How Mal/EncPk-AGE is the Start of Further PC Problems

After Mal/EncPk-AGE is been launched, Mal/EncPk-AGE contacts remote servers to install additional malicious software onto your hard drive. SpywareRemove.com malware researchers have yet to analyze Mal/EncPk-AGE's payload, although common BEK-related attacks often involve banking Trojans and/or rootkits that are high-level threats to your computer. Anti-malware programs should be able to identify Mal/EncPk-AGE, although they may detect Mal/EncPk-AGE by an alias (such as Trojan.Generic.KDV.683493 or PAK_Generic.001). Because Mal/EncPk-AGE was widely identified in August of this year, SpywareRemove.com malware researchers suggest possessing updated anti-malware software for the highest chance of detecting Mal/EncPk-AGE attacks.

Mal/EncPk-AGE attacks also emphasize the importance of being knowledge of the basic scams that are used to trick PC users into compromising their own computers. SpywareRemove.com malware experts discourage trusting links from unusual sources regardless of how authentic they look. As a safety precaution, you always should inspect the URLs in web links before trying to navigate to a new website, and use anti-malware programs with web security features to guard your computer against exploits like the Blackhole Exploit Kit.

Aliases

Trj/Genetic.gen [Panda]TR/Rogue.kdz.887452 [AntiVir]TrojWare.Win32.PWS.ZBot.ATB [Comodo]HEUR:Trojan.Win32.Generic [Kaspersky]Packed.Generic.397 [Symantec]Trj/Dtcontx.A [Panda]Suspicion: unknown virus [AVG]Dropper/Win32.Dapato [AhnLab-V3]Trojan.PWS.Stealer.2155 [DrWeb]Trojan.Win32.Yakes.bxfb [Kaspersky]Win32:Karagany-PS [Trj] [Avast]Downloader-FGY!AB05E06E2D2E [McAfee]Trj/OCJ.A [Panda]PSW.Generic10.AEUH [AVG]W32/Zbot.AMX!tr [Fortinet]
More aliases (132)

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%USERPROFILE%\gmexwbrvazfmravermyqnfnan.exe

File name: gmexwbrvazfmravermyqnfnan.exe
Size: 103.93 KB (103936 bytes)
MD5: 1dbb6ef3abf86afd978c662e2ad99292
Detection count: 66
File type: Executable File
Mime Type: unknown/exe
Path: %USERPROFILE%
Group: Malware file
Last Updated: December 2, 2013

%APPDATA%\skype.dat

File name: skype.dat
Size: 82.43 KB (82432 bytes)
MD5: ab05e06e2d2e56b05912117ee77661ec
Detection count: 56
File type: Data file
Mime Type: unknown/dat
Path: %APPDATA%
Group: Malware file
Last Updated: March 4, 2013

%ALLUSERSPROFILE%\Local Settings\Temp\mscjeiph.com

File name: mscjeiph.com
Size: 46.08 KB (46080 bytes)
MD5: a98b67b13660886013ebef16acde7146
Detection count: 53
File type: Command, executable file
Mime Type: unknown/com
Path: %ALLUSERSPROFILE%\Local Settings\Temp
Group: Malware file
Last Updated: February 7, 2013

%USERPROFILE%\Local Settings\Temp\msnxoh.exe

File name: msnxoh.exe
Size: 44.54 KB (44544 bytes)
MD5: 4da43762ebf84404c38b9f2632a62ab2
Detection count: 51
File type: Executable File
Mime Type: unknown/exe
Path: %USERPROFILE%\Local Settings\Temp
Group: Malware file
Last Updated: January 14, 2013

%APPDATA%\skype.dat

File name: skype.dat
Size: 94.72 KB (94720 bytes)
MD5: aa86c0a2364b344b9bde2c36b96b6ca8
Detection count: 14
File type: Data file
Mime Type: unknown/dat
Path: %APPDATA%
Group: Malware file
Last Updated: February 8, 2013

%APPDATA%\System32\svchost.exe

File name: svchost.exe
Size: 117.31 KB (117317 bytes)
MD5: ddf94649574babbd544d4feb5ebf0cdd
Detection count: 7
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\System32
Group: Malware file
Last Updated: June 27, 2014