Win32/Farfli.AWK

Spectating the Win32/Farfli.AWK detection name usually means that your PC is in big danger. This computer virus can correctly be named as ransomware – virus which encrypts your files and forces you to pay for their decryption. Removing it requires some specific steps that must be done as soon as possible.

Win32/Farfli.AWK detection is a virus detection you can spectate in your system. It frequently appears after the preliminary procedures on your PC – opening the untrustworthy email, clicking the advertisement in the Web or setting up the program from unreliable resources. From the instance it appears, you have a short time to do something about it before it begins its malicious action. And be sure – it is much better not to wait for these malicious things.

What is Win32/Farfli.AWK virus?

Win32/Farfli.AWK is ransomware-type malware. It searches for the documents on your disks, ciphers it, and then asks you to pay the ransom for getting the decryption key. Besides making your files inaccessible, this virus also does a ton of harm to your system. It alters the networking setups in order to avoid you from looking for the removal guides or downloading the anti-malware program. In some cases, Win32/Farfli.AWK can also block the setup of anti-malware programs.

Win32/Farfli.AWK Summary

In summary, Win32/Farfli.AWK virus activities in the infected PC are next:

  • SetUnhandledExceptionFilter detected (possible anti-debug);
  • Attempts to connect to a dead IP:Port (2 unique times);
  • A process attempted to delay the analysis task.;
  • Unconventionial language used in binary resources: Chinese (Traditional);
  • Authenticode signature is invalid;
  • Ciphering the documents kept on the target’s disk — so the victim cannot open these documents;
  • Blocking the launching of .exe files of anti-malware apps
  • Blocking the launching of installation files of anti-virus apps

Ransomware has actually been a nightmare for the last 4 years. It is challenging to realize a more hazardous virus for both individual users and organizations. The algorithms used in Win32/Farfli.AWK (usually, RHA-1028 or AES-256) are not hackable – with minor exclusions. To hack it with a brute force, you need a lot more time than our galaxy actually exists, and possibly will exist. But that virus does not do all these bad things immediately – it can take up to several hours to cipher all of your files. Therefore, seeing the Win32/Farfli.AWK detection is a clear signal that you have to begin the clearing procedure.

Where did I get the Win32/Farfli.AWK?

General ways of Win32/Farfli.AWK distribution are usual for all other ransomware variants. Those are one-day landing web pages where victims are offered to download the free software, so-called bait emails and hacktools. Bait e-mails are a quite modern strategy in malware distribution – you get the e-mail that imitates some normal notifications about shippings or bank service conditions shifts. Within the email, there is a malicious MS Office file, or a web link which leads to the exploit landing site.

Malicious email spam

Malicious email message. This one tricks you to open the phishing website.

Preventing it looks quite simple, but still demands a lot of attention. Malware can hide in different places, and it is better to stop it even before it gets into your system than to rely on an anti-malware program. Basic cybersecurity awareness is just an essential thing in the modern-day world, even if your relationship with a computer remains on YouTube videos. That can save you a great deal of money and time which you would spend while trying to find a fixing guide.

Win32/Farfli.AWK malware technical details

File Info:

name: C2C37329F59DA445BC38.mlwpath: /opt/CAPEv2/storage/binaries/15b8dddbfa37317ccdfbc340764cd0f43b1fb8915b1817b5666c4816ccb98e7ccrc32: 7985F413md5: c2c37329f59da445bc38f936f84c8139sha1: 7caf6daf89def783c89edf819e152d2596d49901sha256: 15b8dddbfa37317ccdfbc340764cd0f43b1fb8915b1817b5666c4816ccb98e7csha512: c9c6444ef5e56bc0fcf2552f2923978b56b967703e4f520653f69f381b0709291a2c5444179059eab0350642724e87c0d1040812bed8828ea71c8e711e7af0dcssdeep: 3072:QgrvEc2vphPl3BzU4MOsq+KI3agD3x+IYwtWM88TBfRiz5wmkjZN:QgrscCp5xB44+re8TBJV9type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1E7246DB07350C073C4A7147684F6EABA5E697E62036454CBB7C83BBA5B3C2D09E35687sha3_384: a050867a10184350e4db49bfce96cdf343af536247d3925c5316bd84741cdcdfa7746128cae185e5e8e157b35414d882ep_bytes: e8d6510000e978feffffcccccc558bectimestamp: 2020-05-18 09:17:37

Version Info:

0: [No Data]

Win32/Farfli.AWK also known as:

Bkav W32.AIDetect.malware2
Lionic Trojan.Win32.Agent.m!c
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
CAT-QuickHeal Trojan.Win32
ALYac Backdoor.Farfli.gen
Cylance Unsafe
Zillya Backdoor.Agent.Win32.77601
Sangfor Trojan.Win32.Gh0stClasses.A
K7AntiVirus Trojan ( 004ce8ad1 )
Alibaba Backdoor:Win32/Farfli.414bb3ff
K7GW Trojan ( 004ce8ad1 )
Cybereason malicious.9f59da
Cyren W32/Trojan.PUCE-8253
Symantec Backdoor.Trojan
ESET-NOD32 a variant of Win32/Farfli.AWK
APEX Malicious
Avast Win32:Trojan-gen
Kaspersky Backdoor.Win32.Agent.mytxit
BitDefender Gen:Variant.Bulz.93393
NANO-Antivirus Trojan.Win32.Farfli.ilwqxb
ViRobot Trojan.Win32.S.Agent.209408.JJ
MicroWorld-eScan Gen:Variant.Bulz.93393
Rising [email protected] (RDML:CxR9NyfYa31V+KMmtxDXiA)
Ad-Aware Gen:Variant.Bulz.93393
Sophos ML/PE-A
Comodo Malware@#1cuyreucyj9ul
VIPRE Trojan.Win32.Generic!BT
TrendMicro Backdoor.Win32.FAROST.ZTHI-BT
McAfee-GW-Edition RDN/Generic BackDoor
FireEye Generic.mg.c2c37329f59da445
Emsisoft Gen:Variant.Bulz.93393 (B)
Ikarus Trojan.Win32.Farfli
Webroot W32.Trojan.Gen
Avira TR/Farfli.qkbrp
Antiy-AVL Trojan/Generic.ASMalwS.30EA648
Microsoft Ransom:Win32/StopCrypt!ml
Arcabit Trojan.Bulz.D16CD1
GData Gen:Variant.Bulz.93393
AhnLab-V3 Backdoor/Win.FAROST.C4677883
McAfee RDN/Generic BackDoor
MAX malware (ai score=81)
VBA32 BScope.Backdoor.Zegost
TrendMicro-HouseCall Backdoor.Win32.FAROST.ZTHI-BT
Tencent Win32.Backdoor.Agent.Syrj
eGambit Unsafe.AI_Score_99%
Fortinet W32/Farfli.AWK!tr
BitDefenderTheta Gen:NN.ZexaF.34062.muW@a88eXKkb
AVG Win32:Trojan-gen
Paloalto generic.ml
CrowdStrike win/malicious_confidence_100% (W)
MaxSecure Trojan.Malware.1728101.susgen

How to remove Win32/Farfli.AWK?

About the author

Robert Bailey

Security engineer focused on malware behavior, removal workflows, and Windows hardening. Robert reviews threat articles for practical accuracy, checking detection names, symptoms, and cleanup steps before publication.

Leave a Comment