cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Malicious File

SOLVED
Conversationalist

Malicious File

I was looking at some security events in my Meraki dashboard and it seems to be showing this malicious filename: W32.4E846BBEDE-95.SBX.TG when I visit the virus total link attached to this finding it gives me different information. I have googled this malicious filename and found that it was linked to a malicious Microsoft Powerpoint exe file. What I am trying to gather here is what exactly does this virus do to the system? Any information would help.

 

Thanks!

 

https://www.virustotal.com/en/file/4e846bbede5e4a76cf1686c145a595d9cdfed95e598a5132e79f7f72cfda0e36/...

1 ACCEPTED SOLUTION

Accepted Solutions
Here to help

Re: Malicious File

Microsoft classifies it as a PUA:Win32/InstallCore,

 

Summary

This application was stopped from running on your network because it has a poor reputation. This application can also affect the quality of your computing experience. We have seen this leading to the following potentially unwanted behaviors on PCs:

 

  • Adds files that run at startup
  • Modifies file associations
  • Injects into other processes on your system
  • Injects into browsers
  • Changes browser settings
  • Changes browser shortcuts
  • Installs browser extensions
  • Disables User Access Control (UAC)

These applications are most commonly software bundlers or installers for applications such as toolbars, adware, or system optimizers. We have observed this application installing software that you might not have intended on your PC.

If you were trying to install an application, you might have downloaded it from a source other than the official product's website.

We usually see this application installed on PCs in the following countries. This list is sorted according to prevalence:

 

  • United States
  • Brazil
  • France
  • Poland
  • Spain

Source

4 REPLIES 4
Kind of a big deal

Re: Malicious File

Were there any other details?  I googled that filename and didn't find anything.  

Adam R MS | CISSP, CISM, VCP, MCITP, CCNP, ITILv3, CMNO
If this was helpful click the Kudo button below
If my reply solved your issue, please mark it as a solution.
Conversationalist

Re: Malicious File

Same here I looked everywhere and could not find anything on it. The virus total link I posted at the bottom said Roblox as the file name. I looked up this hash associated with the file 4e846bbede5e4a76cf1686c145a595d9cdfed95e598a5132e79f7f72cfda0e36 and got this.

 

 

https://www.hybrid-analysis.com/sample/4e846bbede5e4a76cf1686c145a595d9cdfed95e598a5132e79f7f72cfda0...

 

Hope this helps.

Here to help

Re: Malicious File

Microsoft classifies it as a PUA:Win32/InstallCore,

 

Summary

This application was stopped from running on your network because it has a poor reputation. This application can also affect the quality of your computing experience. We have seen this leading to the following potentially unwanted behaviors on PCs:

 

  • Adds files that run at startup
  • Modifies file associations
  • Injects into other processes on your system
  • Injects into browsers
  • Changes browser settings
  • Changes browser shortcuts
  • Installs browser extensions
  • Disables User Access Control (UAC)

These applications are most commonly software bundlers or installers for applications such as toolbars, adware, or system optimizers. We have observed this application installing software that you might not have intended on your PC.

If you were trying to install an application, you might have downloaded it from a source other than the official product's website.

We usually see this application installed on PCs in the following countries. This list is sorted according to prevalence:

 

  • United States
  • Brazil
  • France
  • Poland
  • Spain

Source

Conversationalist

Re: Malicious File

Thank you for your help 🙂

Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.