Trojan.MSIL.DllInject.HA
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 21,054 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 64 |
| First Seen: | December 13, 2021 |
| Last Seen: | November 10, 2026 |
| OS(es) Affected: | Windows |
Trojan.MSIL.DllInject.HA is a detection name for a Windows Trojan written for the .NET framework. The name suggests DLL injection, a technique where code is loaded into another running program. The feed data does not describe the injection mechanism in detail. It rates the threat at 8 out of 10 for danger. It was first seen on 2021-12-13, was last seen on 2026-11-10, and has 64 recorded detections.
Table of Contents
What the threat does
According to the feed, this Trojan installs itself stealthily and runs silently in the background while performing malicious functions. It may give attackers complete control over an infected system. The description also says it may covertly delete files. Trojans of this type typically go further, such as installing other malware, collecting personal data or changing system settings, but the feed does not confirm those actions for this threat.
The analyzed file has these characteristics:
- It is a 64-bit .NET executable with a graphical (GUI) subsystem, not a DLL.
- It is not packed and has no digital signature.
- It uses low-level Windows system calls through ntdll.dll, including calls that write files, free memory and query or enumerate registry keys.
- It reads basic system details, such as the computer name and default locale.
- It calls a debugger-detection function, which malware commonly uses to avoid analysis.
- It uses a Windows cryptography function. The feed does not say what it encrypts.
Of 59 analyzed code blocks, 1 was flagged as potentially malicious, 28 were whitelisted and 30 were unknown. This means the detection rests on a small amount of suspicious behavior within a mostly unclassified file.
A note on the file’s version information
The sample carries version information that names a software company and describes itself as a system-check tool. This does not prove the file is safe. Version details are easy to copy or fake, and malware often imitates legitimate programs. The file also has no digital signature, so its origin cannot be verified from the file alone. Detections like this can also occasionally be false positives. If you recognize the program and got it directly from its publisher, confirm with the publisher before you delete it. If you do not recognize it, treat it as dangerous.
How it usually gets onto computers
The feed says this Trojan most often spreads by:
- Exploiting system vulnerabilities and security flaws.
- Software downloads from malicious websites.
- Email attachments from untrusted sources, usually .exe, .pif, .avi and even .jpg files.
Files with media-style names or extensions can be disguised executables, so a file that looks like a picture or video is not necessarily harmless.
Risks for the user
- Remote attackers may take full control of your PC.
- Files may be deleted without your knowledge.
- Typical Trojan activity, such as data theft or further malware downloads, may follow.
- Because it runs quietly, it can stay on a system for a long time without obvious symptoms.
Signs of infection
The feed notes that the Trojan works silently, so there may be no clear warning. These signs are typical of Trojan infections in general:
- Unfamiliar programs or processes running in the background.
- Missing files or settings that changed on their own.
- Unexpected slowdowns, crashes or network activity.
- Security warnings that appear after opening a downloaded file or an email attachment.
How to stay protected
- Keep Windows and all installed software updated so known vulnerabilities are closed.
- Download programs only from the official publisher's website and avoid unknown download sites.
- Do not open email attachments from unknown senders, especially .exe or .pif files, or media files with unusual behavior.
- Be careful with unsigned executables, and check where a file came from before running it.
- Run a full scan with an up-to-date, reputable security tool and quarantine anything it flags.
- Keep regular backups on a disconnected drive or separate storage so you can recover deleted files.
- If you suspect an infection, disconnect from the internet, scan the system, and change important passwords from a clean device afterward.
Analysis Report
General information
| Family Name: | Trojan.MSIL.DllInject.HA |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
42acc78ac1fae632dc2461365e0d344e
SHA1:
b18490894022179ebf092e0fedc93f8050ce5d30
SHA256:
5A0828AE3869045A6B639D4752F1A328EC18970C255AF998EF084DAFBDAD677D
File Size:
308.22 KB, 308224 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File is .NET application
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
Show 1 more
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version | 26.129.9525.16200 |
| Company Name | BÜHLER Informatik GmbH, Durmersheim |
| File Description | BÜHLER Informatik GmbH: System-Check |
| File Version | 26.129.9525.16200 |
| Internal Name | BI-Check.exe |
| Legal Copyright | Copyright © 2026 by BÜHLER Informatik GmbH |
| Original Filename | BI-Check.exe |
| Product Name | BÜHLER Informatik GmbH |
| Product Version | 26.129.9525.16200 |
File Traits
- .NET
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 59 |
|---|---|
| Potentially Malicious Blocks: | 1 |
| Whitelisted Blocks: | 28 |
| Unknown Blocks: | 30 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show 61 more
|
| User Data Access |
|
| Anti Debug |
|
| Encryption Used |
|
