Categories: Malware

Koobface.1 (file analysis)

The Koobface.1 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Koobface.1 virus can do?

At least one process apparently crashed during execution
Dynamic (imported) function loading detected
Unconventionial language used in binary resources: Catalan
Authenticode signature is invalid

How to determine Koobface.1?


File Info:
name: 96799BD0F3BFD4B2ED3A.mlwpath: /opt/CAPEv2/storage/binaries/bd0f387cd93935d58e9a67d32ef2a3c13cd58c84f2825cf840aa2128e3b0229acrc32: 346AB0B9md5: 96799bd0f3bfd4b2ed3a65ab5bc21b7csha1: 03cdae9126c3b12996b090b11a85267cafbee90csha256: bd0f387cd93935d58e9a67d32ef2a3c13cd58c84f2825cf840aa2128e3b0229asha512: 7ac2d25c4e3731f510c7aeffc680397e6d31c6a80bb1950939edd6f6560645a568b22abffe5ba3884d3f9df1e4faa7a37324e2c3e86cfcb85509d68562dc1c26ssdeep: 768:/06R0UKzOgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9f:lR0vxn3Pc0LCH9MtbvabUDzJYWu3Bgtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1B2A3D046B930B6DAF6A996358044FF815F3CBD290DF3C1B6345C22CEEA39C89464572Dsha3_384: b6414dec3d641c78dd8ea7d151dc37b805a0cbd1abbc1750ebef81d15f871af504658c825c72f747e11033024547f04cep_bytes: 558bec83ec2c8165ec000000008d5b56timestamp: 2004-11-06 22:01:02
Version Info:
CompanyName: Macromedia, Inc.FileDescription: Macromedia Flash Player 7.0  r19FileVersion: 7,0,19,0InternalName: Macromedia Flash Player 7.0LegalCopyright: Copyright © 1996-2003 Macromedia, Inc.LegalTrademarks: Macromedia Flash PlayerOriginalFilename: SAFlashPlayer.exeProductName: Shockwave FlashProductVersion: 7,0,19,0Translation: 0x0409 0x04b0

Koobface.1 also known as:

Bkav	W32.FamVT.DisbukCI.Trojan
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Koobface.1
FireEye	Generic.mg.96799bd0f3bfd4b2
CAT-QuickHeal	W32.Ramnit.DR
ALYac	Gen:Variant.Koobface.1
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_100% (W)
K7GW	Trojan ( 001f82c71 )
K7AntiVirus	Trojan ( 001f82c71 )
VirIT	Trojan.Win32.Generic.SUG
Cyren	W32/SuspPack.DC.gen!Eldorado
Symantec	Packed.Protexor!gen1
ESET-NOD32	a variant of Win32/Kryptik.JBG
APEX	Malicious
ClamAV	Win.Virus.Virut-6804273-0
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Koobface.1
NANO-Antivirus	Trojan.Win32.Ramnit.bbgdmp
SUPERAntiSpyware	Trojan.Agent/Gen-Pune
Avast	Win32:Crypto-V [Trj]
Tencent	Trojan.Win32.Koobface.udb
Ad-Aware	Gen:Variant.Koobface.1
Sophos	ML/PE-A + Mal/Ramnit-ZZ
Comodo	TrojWare.Win32.Kryptik.ILZ@39m3x2
DrWeb	Trojan.Siggen2.9448
TrendMicro	TROJ_DROPPR.SMAL
McAfee-GW-Edition	BehavesLike.Win32.Dropper.nm
Emsisoft	Gen:Variant.Koobface.1 (B)
Ikarus	Virus.Win32.Ramnit
GData	Gen:Variant.Koobface.1
Jiangmin	Packed.Krap.dljx
Avira	TR/Patched.Ren.Gen
MAX	malware (ai score=87)
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Ramnit
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Krap.R20076
McAfee	PWS-Zbot.gen.cn
TACHYON	Trojan/W32.Krap.98733
VBA32	BScope.Trojan.Inject
Malwarebytes	Nimnul.Virus.FileInfector.DDS
TrendMicro-HouseCall	TROJ_DROPPR.SMAL
Rising	Trojan.Win32.Fednu.tyo (CLOUD)
Yandex	Trojan.GenAsa!MLownxgq9A8
SentinelOne	Static AI – Malicious PE
MaxSecure	Packed.Krap.ar
Fortinet	W32/Kryptik.LW!tr
BitDefenderTheta	Gen:NN.ZexaF.34638.gq1@aKiznpfH
AVG	Win32:Crypto-V [Trj]
Cybereason	malicious.0f3bfd
Panda	Trj/Pck_Pretorx.A