Threat Database Trojans Trojan.MSIL.Dropper.DH

Trojan.MSIL.Dropper.DH

By CagedTech in Trojans
Published:
Last updated:

Threat Scorecard

Popularity Rank: 15,643
Threat Level: 80 % (High)
Infected Computers: 27
First Seen: January 24, 2024
Last Seen: October 11, 2026
OS(es) Affected: Windows

The detection of Trojan.MSIL.Dropper.DH on your system indicates a potential security threat that requires immediate attention. This type of malware is designed to cause harm to your computer and compromise your personal data. It is essential to understand the nature of this threat and take necessary steps to remove it from your system.

What Is Trojan.MSIL.Dropper.DH?

Trojan.MSIL.Dropper.DH is a type of Trojan horse malware that can infect your computer without your knowledge or consent. The name "Trojan" refers to the fact that this malware disguises itself as a legitimate program or file, allowing it to bypass security measures and gain access to your system. The "MSIL" part of the name suggests that this malware is written in Microsoft Intermediate Language, which is a platform-agnostic language used by the .NET framework.

How Trojan.MSIL.Dropper.DH Operates

Once installed on your system, Trojan.MSIL.Dropper.DH can operate in various ways, depending on its intended purpose. It may attempt to download and install additional malware, steal sensitive information such as login credentials or financial data, or provide unauthorized access to your computer. This type of malware can also modify system settings, disable security software, and create backdoors for remote access.

Symptoms of Infection

Infected systems may exhibit a range of symptoms, including slow performance, frequent crashes, and unusual network activity. You may also notice unfamiliar programs or icons on your desktop, or receive unexpected pop-ups and alerts. In some cases, Trojan.MSIL.Dropper.DH may not display any noticeable symptoms, making it difficult to detect without proper scanning tools.

  • Unexplained changes to system settings or configuration
  • Appearance of unfamiliar programs or files
  • Increased network activity or data usage
  • Slow system performance or frequent crashes

How to Remove Trojan.MSIL.Dropper.DH

  1. Boot your computer in Safe Mode with Networking to prevent the malware from loading and to allow for a more effective removal process.
  2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect any malware components.
  3. Uninstall any suspicious programs or applications that may be related to the infection.
  4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or add-ons.
  5. Reboot your computer and perform a follow-up scan to ensure that all malware components have been removed.

Conclusion

Removing Trojan.MSIL.Dropper.DH from your system requires careful attention to detail and a thorough understanding of the malware's behavior. By following the steps outlined above and using reputable security tools, you can effectively remove this threat and protect your personal data. It is essential to remain vigilant and take proactive measures to prevent future infections, such as keeping your operating system and software up to date, using strong antivirus protection, and avoiding suspicious downloads and links.

Analysis Report

General information

Family Name: Trojan.MSIL.Dropper.DH
Signature status: No Signature

Known Samples

MD5: 94c9b7d5ad62a37b0b1e6e9c8e8cc8ab
SHA1: 892eac74c7033dfabfae205f994155c319aa3179
SHA256: 72A04F53406239BA3929C689B0F74420DDCB5E044832B7561B80D124A0FE697B
File Size: 1.22 MB, 1218560 bytes
MD5: 660404ba72eaf8100e0c5ca1a1183e25
SHA1: 4b79e91b4b44607a6f7cf3bbe4bfcb3e12afeb0c
SHA256: 79F3D35539F738752B91C7602393CE40934FC289B0D2F91022A815FDB8D8ECF2
File Size: 638.46 KB, 638464 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have security information
  • File is .NET application
  • File is 32-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

Windows PE Version Information

Name Value
Assembly Version
  • 10.0.26100.4202
  • 1.0.0.0
Company Name Microsoft Corporation
File Description Windows Winhlp32 Stub
File Version
  • 10.0.26100.4202
  • 1.0.0.0
Internal Name
  • winhlp32.exe
  • xqzmed.exe
Legal Copyright © Microsoft Corporation. All rights reserved.
Original Filename
  • winhlp32.exe
  • xqzmed.exe
Product Name Microsoft® Windows® Operating System
Product Version
  • 10.0.26100.4202
  • 1.0.0.0

File Traits

  • .NET
  • HighEntropy
  • RijndaelManaged
  • x86

Block Information

Total Blocks: 18
Potentially Malicious Blocks: 6
Whitelisted Blocks: 12
Unknown Blocks: 0

Visual Map

0 0 0 0 0 0 0 0 0 0 0 0 x x x x x x
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • Kazy.QA
  • MSIL.Downloader.Tiny.X
  • MSIL.Dropper.XC
  • MSIL.Inject.AB
  • MSIL.Inject.YT
Show More
  • MSIL.Injector.MFA
  • MSIL.Injector.MFB
  • MSIL.Krypt.UBO
  • MSIL.Krypt.UJB
  • MSIL.Mardom.D
  • MSIL.XWorm.F

Files Modified

File Attributes
c:\users\user\appdata\roaming\xqzmed.exe Generic Write,Read Attributes

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAlertThreadByThreadId
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtClearEvent
  • ntdll.dll!NtClose
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreatePrivateNamespace
  • ntdll.dll!NtCreateSection
Show More
  • ntdll.dll!NtCreateThreadEx
  • ntdll.dll!NtDeviceIoControlFile
  • ntdll.dll!NtDuplicateObject
  • ntdll.dll!NtEnumerateKey
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenDirectoryObject
  • ntdll.dll!NtOpenEvent
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcess
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSymbolicLinkObject
  • ntdll.dll!NtOpenThreadToken
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDefaultLocale
  • ntdll.dll!NtQueryDirectoryFileEx
  • ntdll.dll!NtQueryFullAttributesFile
  • ntdll.dll!NtQueryInformationFile
  • ntdll.dll!NtQueryInformationJobObject
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryLicenseValue
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySymbolicLinkObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtReadRequestData
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtResumeThread
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationThread
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSubscribeWnfStateChange
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtUnmapViewOfSectionEx
  • ntdll.dll!NtWaitForAlertByThreadId
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWorkerFactoryWorkerReady
  • ntdll.dll!NtWriteFile
  • UNKNOWN
User Data Access
  • GetComputerNameEx
  • GetUserDefaultLocaleName
  • GetUserObjectInformation
Encryption Used
  • BCryptOpenAlgorithmProvider
Anti Debug
  • IsDebuggerPresent