Trojan.MSIL.Agent.SKF

The detection of Trojan.MSIL.Agent.SKF on your system indicates a potential security threat. This report aims to provide you with general guidance on understanding and removing the detected threat. It's essential to approach this situation with caution and follow the recommended steps to ensure your system's security and integrity.

What Is Trojan.MSIL.Agent.SKF?

Trojan.MSIL.Agent.SKF is identified as a Trojan-type threat, which means it is designed to infiltrate your system without being detected and can cause various types of harm. Trojans are known for their ability to disguise themselves as legitimate programs, making them particularly dangerous. The name "Trojan.MSIL.Agent.SKF" suggests it is written in MSIL (Microsoft Intermediate Language), which is a platform-agnostic intermediate representation of the.NET Common Intermediate Language (CIL). This implies the malware could potentially be executed on systems supporting the.NET framework.

How Trojan.MSIL.Agent.SKF Operates

While specific details about Trojan.MSIL.Agent.SKF's operation are not available, Trojans generally operate by exploiting vulnerabilities in software or tricking users into installing them. Once installed, they can perform a wide range of malicious activities, including but not limited to, stealing sensitive information, installing additional malware, providing unauthorized access to the attacker, and disrupting system operation. The exact mechanisms used by Trojan.MSIL.Agent.SKF would depend on its design and purpose, which could range from data theft to using the infected system as part of a botnet for malicious activities.

Symptoms of Infection

Symptoms of a Trojan infection can be subtle and may not always be immediately apparent. Common indicators include unexpected changes to your system, such as new programs or icons appearing, unusual network activity, slow system performance, and frequent crashes or freezes. Additionally, you might notice that your browser settings have been altered, such as changes to your homepage or the appearance of unwanted toolbars. If you suspect your system has been infected, it's crucial to take action promptly to minimize potential damage.

How to Remove Trojan.MSIL.Agent.SKF

1. Enter Safe Mode with Networking to prevent the malware from loading and to allow for internet access to download removal tools if necessary.
2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove the threat. Ensure your anti-malware software is updated with the latest definitions before running the scan.
3. Uninstall suspicious programs that you do not recognize or that were installed around the time the malware was detected. Be cautious and only uninstall programs you are certain are not essential to your system's operation.
4. Reset your browsers (Chrome, Firefox, Edge, etc.) to their default settings to remove any malicious extensions or settings changes made by the Trojan.
5. After completing the above steps, reboot your system and then perform another full scan to ensure that the threat has been successfully removed and no additional threats are present.

Conclusion

Removing Trojan.MSIL.Agent.SKF requires careful and methodical steps to ensure your system is thoroughly cleaned and protected. It's also important to take preventive measures to avoid future infections, such as keeping your operating system and software up to date, using strong antivirus software, being cautious with email attachments and downloads, and avoiding suspicious websites. By following these guidelines and maintaining vigilance, you can significantly reduce the risk of your system being compromised by malware and other cyber threats.

Analysis Report

General information

Family Name:	Trojan.MSIL.Agent.SKF
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 67932be1e6a0ea14b41b02983d5074d6 SHA1: 073478638f8409adf63c5174c48233b3b21d882a File Size: 237.65 KB, 237654 bytes

MD5: 558a71f1b983707f15c40a17a3808d44 SHA1: 94fb95ca54c3e5f2d303cb7405cbbb58480460c0 SHA256: 2C6FB0DE044B31B81257DC0EB0196DC76C6566C62789D499DF0B4CD299DA8CA6 File Size: 16.90 KB, 16896 bytes

MD5: 0131ba17bdbe44faed12d127d2b345ff SHA1: 0e3e4c1b4873a24f0b32b36e591b61d36a14724f SHA256: 9459A434BC9C7EEBCD626BD94D685692D4E8ADA335F04DA452FAE9C83B6938CF File Size: 16.90 KB, 16896 bytes

MD5: 6b88041630bd510ec3777cb3a4e1a599 SHA1: c43925574d78fa6c1ef8e81f475b3ed30b323468 SHA256: 3EEB4BF51B0EA73E2905792918261994BAB55C13409E63FE46323CB0609B5D59 File Size: 235.51 KB, 235509 bytes

MD5: f5ffb2b3a94275f6dc16914a535cb57a SHA1: 15d56bf1c6b9442c69016b1b8bfe15162af99f26 SHA256: A2C6C5219064BADB94353F479AC88C363CBFDA9BAEB8F2333C55E7F7FE061400 File Size: 16.90 KB, 16896 bytes

Show More

MD5: 36f8bd0fc950c3edfb62bb995136389c SHA1: df6108a90416b21f0023e2638cda4fbc0131c27b SHA256: 45DD96FE13E7FF3823D93167DBC976E3D15E9778933C052B928BFD63C5412098 File Size: 237.65 KB, 237649 bytes

MD5: a7cf0758b52ce867063949096af7c101 SHA1: 7bfef938f55b8f2fb690e1b6b050c81b54588d65 SHA256: E42C9A697686A844628547D3CE696667F688C433157257F2CD4005D5D654F5CE File Size: 16.90 KB, 16896 bytes

MD5: 470e386270a3a45d0beec97764307cb9 SHA1: 0cd39f6e78d4f2111dc2329d6398556527d79ef2 SHA256: 37311D70ADD35C04C02C7CE9542288DF288A22698D28FFFD03841BFD09E04F69 File Size: 237.67 KB, 237670 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File is .NET application
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)

Show More

• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Assembly Version	1.0.0.0
File Description	burgos grimsley Gujuvi Layelo mishra Ruheyo succesfully Uxicum
File Version	5.5.9.197 3.9.4.161 3.7.4.21 3.6.2.138 1.0.0.0
Internal Name	Gujuvi.exe Layelo.exe Ruheyo.exe Uxicum.exe
Legal Copyright	burgos burgos Copyright © 2025 grimsley grimsley mishra mishra succesfully succesfully
Original Filename	acer.exe faldo.exe Gujuvi.exe Layelo.exe piney.exe Ruheyo.exe shatters.exe Uxicum.exe
Product Name	burgos 3.6.2.138 grimsley 5.5.9.197 Gujuvi Layelo mishra 3.7.4.21 Ruheyo succesfully 3.9.4.161 Uxicum
Product Version	5.5.9.197 3.9.4.161 3.7.4.21 3.6.2.138 1.0.0.0

File Traits

• .NET
• x86

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• MSIL.Agent.SKF

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\temp\nsk4ac.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsk4ac.tmp\locating.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsk4ac.tmp\locating.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsk4ac.tmp\locating.exe.config	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsk4ac.tmp\locating.exe.config	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsk4ac.tmp\microsoft.web.webview2.core.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsk4ac.tmp\microsoft.web.webview2.core.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsk4ac.tmp\microsoft.web.webview2.winforms.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsk4ac.tmp\microsoft.web.webview2.winforms.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsk4ac.tmp\microsoft.web.webview2.wpf.dll	Generic Write,Read Attributes

Show More

c:\users\user\appdata\local\temp\nsk4ac.tmp\microsoft.web.webview2.wpf.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsk4ac.tmp\webview2loader.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsk4ac.tmp\webview2loader.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nss41e4.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nss41e4.tmp\microsoft.web.webview2.core.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nss41e4.tmp\microsoft.web.webview2.core.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nss41e4.tmp\microsoft.web.webview2.winforms.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nss41e4.tmp\microsoft.web.webview2.winforms.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nss41e4.tmp\microsoft.web.webview2.wpf.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nss41e4.tmp\microsoft.web.webview2.wpf.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nss41e4.tmp\pa.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nss41e4.tmp\pa.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nss41e4.tmp\pa.exe.config	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nss41e4.tmp\pa.exe.config	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nss41e4.tmp\webview2loader.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nss41e4.tmp\webview2loader.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nssd550.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nssd550.tmp\microsoft.web.webview2.core.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nssd550.tmp\microsoft.web.webview2.core.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nssd550.tmp\microsoft.web.webview2.winforms.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nssd550.tmp\microsoft.web.webview2.winforms.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nssd550.tmp\microsoft.web.webview2.wpf.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nssd550.tmp\microsoft.web.webview2.wpf.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nssd550.tmp\spiff.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nssd550.tmp\spiff.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nssd550.tmp\spiff.exe.config	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nssd550.tmp\spiff.exe.config	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nssd550.tmp\webview2loader.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nssd550.tmp\webview2loader.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsx519c.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsx519c.tmp\dissembled.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsx519c.tmp\dissembled.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsx519c.tmp\dissembled.exe.config	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsx519c.tmp\dissembled.exe.config	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsx519c.tmp\microsoft.web.webview2.core.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsx519c.tmp\microsoft.web.webview2.core.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsx519c.tmp\microsoft.web.webview2.winforms.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsx519c.tmp\microsoft.web.webview2.winforms.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsx519c.tmp\microsoft.web.webview2.wpf.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsx519c.tmp\microsoft.web.webview2.wpf.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsx519c.tmp\webview2loader.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsx519c.tmp\webview2loader.dll	Synchronize,Write Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Users\Hqavherc\AppData\Local\Temp\nssD550.tmp\spiff.exe	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Users\Hqavherc\AppData\Local\Temp\nssD550.tmp\spiff.exe\??\C:\Users\Hqavherc\AppData\Local\Temp\nssD550.tmp\	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Users\Mtiyoxrx\AppData\Local\Temp\nsx519C.tmp\dissembled.exe	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Users\Mtiyoxrx\AppData\Local\Temp\nsx519C.tmp\dissembled.exe\??\C:\Users\Mtiyoxrx\AppData\Local\Temp\nsx519C.tmp\	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\??\C:\Windows\SystemTemp\b1a39cca-eadf-4949-a384-a0ef6a3b3fd2.tmp\	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	*1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old122e4*1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old12352*1\??\C:\P	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Anti Debug	IsDebuggerPresent
User Data Access	GetComputerNameEx GetUserDefaultLocaleName GetUserName GetUserObjectInformation
Process Manipulation Evasion	NtUnmapViewOfSection ZwMapViewOfSection
Process Shell Execute	CreateProcess
Syscall Use	ntdll.dll!NtAlertThreadByThreadId ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtClearEvent ntdll.dll!NtClose ntdll.dll!NtCreateEvent ntdll.dll!NtCreateFile ntdll.dll!NtCreateMutant ntdll.dll!NtCreatePrivateNamespace ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore Show More ntdll.dll!NtCreateThreadEx ntdll.dll!NtDuplicateObject ntdll.dll!NtEnumerateKey ntdll.dll!NtEnumerateValueKey ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenDirectoryObject ntdll.dll!NtOpenEvent ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcess ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenSection ntdll.dll!NtOpenThreadToken ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryDefaultLocale ntdll.dll!NtQueryDirectoryFileEx ntdll.dll!NtQueryFullAttributesFile ntdll.dll!NtQueryInformationFile ntdll.dll!NtQueryInformationJobObject ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryLicenseValue ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQuerySecurityObject ntdll.dll!NtQuerySystemInformation ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReadFile ntdll.dll!NtReadRequestData ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtResumeThread ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationFile ntdll.dll!NtSetInformationKey ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationThread ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSubscribeWnfStateChange ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForAlertByThreadId ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWorkerFactoryWorkerReady ntdll.dll!NtWriteFile UNKNOWN

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

C:\Users\Hqavherc\AppData\Local\Temp\nssD550.tmp\Spiff.exe ""

C:\Users\Mtiyoxrx\AppData\Local\Temp\nsx519C.tmp\Dissembled.exe ""

C:\Users\Hrlwkvwn\AppData\Local\Temp\nsk4AC.tmp\Locating.exe ""

C:\Users\Ucbmpyjb\AppData\Local\Temp\nss41E4.tmp\Pa.exe ""