Trojan.Pepex.C

The detection of Trojan.Pepex.C on your system indicates a potential security threat that requires immediate attention. This report provides an overview of the threat, its operational characteristics, symptoms of infection, and steps to remove it from your system.

What Is Trojan.Pepex.C?

Trojan.Pepex.C is a type of malware that can compromise the security and integrity of your computer system. The term "Trojan" refers to a broad category of malicious software that disguises itself as legitimate software, allowing it to bypass security measures and gain unauthorized access to a system. Trojan.Pepex.C, like other Trojans, can be used for a variety of malicious purposes, including data theft, espionage, and the distribution of additional malware.

How Trojan.Pepex.C Operates

Once installed on a system, Trojan.Pepex.C can operate in various ways, depending on its intended purpose. It may connect to remote servers to receive instructions or send stolen data. Trojans often exploit vulnerabilities in software or manipulate users into executing them, thinking they are installing legitimate programs. They can also be spread through infected software downloads, infected USB drives, or by visiting compromised websites.

Symptoms of Infection

Symptoms of a Trojan.Pepex.C infection can vary widely but may include unusual system behavior such as unexpected pop-ups, slow system performance, or unfamiliar programs appearing on the system. In some cases, the infection may not exhibit noticeable symptoms, making it difficult for users to detect without the aid of security software. Regular system scans with up-to-date antivirus tools are crucial for identifying and removing such threats.

How to Remove Trojan.Pepex.C

1. Enter Safe Mode with Networking to limit the malware's ability to interfere with the removal process. This mode allows you to use the internet to download removal tools while minimizing system activity.
2. Download and install a reputable anti-malware tool, such as SpyHunter, designed to detect and remove Trojans and other malware. Perform a full scan of your system to identify all infected files and registry entries.
3. Manually uninstall any suspicious programs that you do not recognize or that were installed around the time the malware was detected. Be cautious and only remove programs you are sure are not necessary for your system's operation.
4. Reset your web browsers (Chrome, Firefox, Edge, etc.) to their default settings to remove any malicious extensions or settings that the Trojan may have altered.
5. After completing the above steps, reboot your system and perform another scan with your anti-malware tool to ensure that all traces of the Trojan have been removed.

Conclusion

Removing Trojan.Pepex.C from your system requires careful and systematic steps to ensure that all components of the malware are eliminated. It's also crucial to adopt preventive measures to avoid future infections, including keeping your operating system and software up to date, using strong and unique passwords, being cautious with emails and attachments from unknown sources, and regularly scanning your system with reputable security software. By taking these steps, you can significantly reduce the risk of your system being compromised by malware like Trojan.Pepex.C.

Analysis Report

General information

Family Name:	Trojan.Pepex.C
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 6d54a7b75b25f0c5e6366a2bfdb36b5e SHA1: b804fa4fe536851b885c297aa8c02463d9481c92 File Size: 527.85 KB, 527848 bytes

MD5: b2e69a61871c501fd2324f24b7e24b52 SHA1: 5ca2a212e67809a80de1d2a411de219f20ccf565 File Size: 1.72 MB, 1722266 bytes

MD5: 14fc8b40808325a0f7d652d287ba98b4 SHA1: 4182fc8e0a92d65ae344ca09e5e2eb56ea8bdbc7 File Size: 484.68 KB, 484678 bytes

MD5: 419d8d9676f17782318d0b80bda94933 SHA1: 6688d3b0ccb222646c25c0df10cb7909826d1641 SHA256: 06CF09DFB485711E622F9ABF3B0ADE211AA9E6BB786EDD7BADEC11BCEF9E4E19 File Size: 59.22 KB, 59220 bytes

MD5: 79ea272e885d00bc713c3e4622ce4ad8 SHA1: f095341b72656a9d510a39d4160b5141f68a2f8a SHA256: 4E739D88BF52B4221CA558FFD9A573FF05E3FB64515589F83047786452DA2D05 File Size: 354.82 KB, 354816 bytes

Show More

MD5: bf1d54907149f42132bd3c79e6127641 SHA1: 4ca5a15a792d41323ff9d5579a8f88ce11a4a9a4 SHA256: B6DBBCD2A94E60BCBB760747CE5708D42FCAD344E4E9E514941062CCC42E4CC5 File Size: 837.04 KB, 837039 bytes

MD5: b265b583769a5977e62bf2b95076cfeb SHA1: 22c6b2e33e34481b6a1aca6296e620f36965fd5d SHA256: 781FCA3A4F36B9BF8A028764D8502E4508169AED2870CD5101CF20530A651653 File Size: 480.47 KB, 480472 bytes

MD5: 8a952bb5d5bd856929286c7fea562ea8 SHA1: 05c4742b7c881072848ca232fd1b871854bfb408 SHA256: 34E3079A4190DDBDD703D7DA8CD7D84D3A745652D93350C01CFE8A6B0E09CE64 File Size: 7.02 MB, 7023256 bytes

MD5: b13351922b4ba5b205b9ac8081920434 SHA1: 6674306571e3c7d5efa21dbda7e70a049aa831c6 SHA256: 76ECF8AF3F394E6EB0BF86401916358B5976D122C45011DDC99DA7000D9FAB9F File Size: 606.80 KB, 606802 bytes

MD5: 710829a5211aaaeb84859fc933190a6a SHA1: 4e3a0fc6277df7dce6ae2605a40912c926c5407c SHA256: 306CEF1685B9107632543A7435158D6A8E7359437E1C71984CA32139F8F3F25F File Size: 384.14 KB, 384142 bytes

MD5: d517232357b31335b5d47685632751fc SHA1: ef6e34718d5b09b59878f1ef2e5fa96203652779 SHA256: 36EDB028533774312EA7EF9639A621CA6E997D18C90EA73A0D5E3CB39D42FB34 File Size: 519.95 KB, 519952 bytes

MD5: f4f3fad502b7048a0ceae6763a995815 SHA1: 969584307b7a353ce8422afc11db36609d1b154c SHA256: A24E2902DA5AB84F755D6C8D365C7D0DE94A0E06F17621FA7DF7653036120A71 File Size: 240.18 KB, 240176 bytes

MD5: 4752534ea7128f78a75cd78dea7b8bc1 SHA1: 880366105c9829f0b612567b73efe98a64f2cf7a SHA256: 354803A30F8F4E0FE634E10C057F79793948956461CA8D9B63511F1CC14482DB File Size: 573.94 KB, 573936 bytes

MD5: 12440c165ed5953c099255132ce3167a SHA1: dfb6b5539d4408661afaf1a87e1b6ec80ff23a91 SHA256: DEB86EF917F51E165506A282D50CAD8E21A4DEC5A1F34598286BE63B004D249E File Size: 317.22 KB, 317223 bytes

MD5: 2ae7e3ddc29d7b0b43df3c812b1245e1 SHA1: a99f33958b986fc88f26d434623ffdb3b0448cd7 SHA256: 03618BBAF5ABE91283374CDCF0C24A044B6411C702F0CB6EA55092EE0701024D File Size: 474.79 KB, 474785 bytes

MD5: 97947abe60f935be7a48a3936a2af485 SHA1: d0a0dde869a2909cbfde320218a9c08dee99eb01 SHA256: 6831BDC623B1664C574F6C4E33A0C9AAA3F53CF03AE48E0C460866ACC1203F9F File Size: 593.63 KB, 593634 bytes

MD5: b57b26b4d1773a72c8b5c79f35fe7512 SHA1: 50069ac8a4cc9c6392645704603432012adc4a1d SHA256: E6B6F3C40AAA44B060E6D7C1798831E1D24A6E142DBBC70B9E62292D8777CABA File Size: 532.61 KB, 532614 bytes

MD5: d7c16850b74c0445d80a5ae3218c1edd SHA1: ad28c8a3ca3118055e0538fb4870e3cb0754e999 SHA256: 951DD7D3B35773DE7514404B326F27DDD66216BCDC095A913FE84161A312E240 File Size: 497.32 KB, 497325 bytes

MD5: ba33d2d79c7bb65600fbf2306b563cab SHA1: f18780025f2fc260896ac2bd59018e78132f31ea SHA256: 62BA8BC394300D9768DC4F92C3AED797C3E4BFD1339C368792A3CCA49B3F8988 File Size: 7.02 MB, 7023192 bytes

MD5: 2648b5301891804c91ad480fb789028c SHA1: 121f081c82e9a1620dbc669f3d14ff95645afc82 SHA256: 4EDA5BA90F1D40D01EB1BCE3E17B80DE57B36D436B5C5914C0C5846FA9DF88EE File Size: 387.74 KB, 387736 bytes

MD5: 01d59ae3f1e59c3bb3731e650632a1d5 SHA1: 5f848b34ea99b41e596c69f4f4abeb4ad39eae6a SHA256: BB6C56B9633C3F12234FDD971E7E66E59A1D639368B1BC7CC002F6C465193DFD File Size: 448.12 KB, 448115 bytes

MD5: cb072e8c01890b823df0ba4eff8414c8 SHA1: c943185c2454e4d7668ab0a07eace3e97bf81ac0 SHA256: 7ABC5EB91BC92369254A3BE0A1AB50BB49D3B586C0B0AD345E8C87F6DC049CB5 File Size: 454.65 KB, 454651 bytes

MD5: 829131182c94d653836ea3360802364d SHA1: 4502e3e55db370b5966434d9aaa82851d8d5591e SHA256: C379B7F8FBEF0D0BB50CB39727F8230A014BADDE3F17A22A2BFA7DBDE452CFEA File Size: 1.09 MB, 1092690 bytes

MD5: b2d6d0be88eebe819a721b40d3bfc9ac SHA1: 27de871802743cab826a1526f0e9f7691685708c SHA256: 9F1A6BA122A00EBFFC669E2136C874B0DEB219EC1136A024147488D428BB841C File Size: 594.17 KB, 594175 bytes

MD5: bbfb9ecd97086a437431e03a8272db9c SHA1: 6c95f26280e7230b5afaa02ac1565bfd1d0f5b19 SHA256: F989E17593A36A6BC512F59DF125AE6E84207DE5B8D1D2316ABC2561AC67DCC5 File Size: 249.04 KB, 249043 bytes

MD5: 20b6bd8ede287aeeb01a49818def25e8 SHA1: 814e845f262ccac615f814d03dd260857b9797b6 SHA256: 1DE256F1A75450E53FEE85DF2F2B909D726B3114E021CC6397C477DAD2A2FFFF File Size: 528.29 KB, 528289 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has exports table
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)

Show More

• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Comments	5m Amar Guerfi © 1994-2002 Contents Copyright© 2000 Creator and designer of the contents Digital Records JCA jjf@webelectronica.zzn.com.ar Player for Multimedia Builder Topdownloads Networks
Company Name	John El Self MediaChance Mediachance Oakley Data Services Oscarko
File Description	Player for MMB Player for Multimedia Builder Runtime Module for MMB presentation tswin Application WebCompiler
File Version	5, 0, 13, 0 4.8.5 4.8.01 4.7b 4.7 4.2 1.50.0.0 1.00
Internal Name	MMB Player Multimedia Builder Player player TJprojMain tswini WebCompiler
Legal Copyright	Copyright (C) 2005 Copyright MediaChance (C) 1998-1999 www.mediachance.com © 1998 Oakley Data Services
Legal Trademarks	Mediachance MediaChance WebCompiler is a Trademark of Oakley Data Services
Original Filename	autorun.exe player.exe player.EXE TJprojMain.exe tswini.EXE
Private Build	4.7 4.7b 4.8.01 4.8.5
Product Name	MMB Player Application Multimedia Builder runtime Player Project1 tswin Application WebCompiler
Product Version	5, 0, 13, 0 4.8.5 4.8.01 4.7b 4.7 4.2 1.50 1.00
Special Build	4.7 4.8 4.71

File Traits

• .petite
• 00 section
• 2+ executable sections
• big overlay
• HighEntropy
• No Version Info
• x86

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Total Blocks:	8
Potentially Malicious Blocks:	8
Whitelisted Blocks:	0
Unknown Blocks:	0

Visual Map

x x x x x x x x

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• Banker.J
• Banker.JJ
• Banload.Z
• Keygen.FG

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe\gmdasllogger	Generic Write,Read Attributes
c:\users\user\downloads\trace.log	Generic Write,Read Attributes

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Other Suspicious	SetWindowsHookEx
Anti Debug	IsDebuggerPresent
User Data Access	GetUserObjectInformation