Categories: Malware

What is “PWS:Win32/OnLineGames.JB”?

The PWS:Win32/OnLineGames.JB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PWS:Win32/OnLineGames.JB virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
The executable is compressed using UPX
Authenticode signature is invalid
Yara detections observed in process dumps, payloads or dropped files

How to determine PWS:Win32/OnLineGames.JB?


File Info:
name: 9B22CBAC302A49B239E9.mlwpath: /opt/CAPEv2/storage/binaries/0103904b98980f82a2daddb7dcd8e10b3dd81783a8c57cfddc0474fabc74d7b8crc32: CCBDF2F5md5: 9b22cbac302a49b239e941d3d784db6csha1: c3d48c4ebad9a760649c8524bf34a2253f47a133sha256: 0103904b98980f82a2daddb7dcd8e10b3dd81783a8c57cfddc0474fabc74d7b8sha512: 179bcb82f774888a399ab9a951f4c9059cc8dbb862e4ecf240c74fc86f4dc4eb8139da9df3adfd95ff4cac6b3d4c5bbd8cc19a5f45e489dc9e38ab3478d10c30ssdeep: 1536:KY4a/DS608jz+dQqWLdjTx5wLxHVNILWpMRcQU3O3GVGlTGxBYmlWXbXg9Tm:roQJqWBjTx50x1WLeM2QUXfBZmbwEtype: PE32 executable (DLL) (GUI) Intel 80386, for MS Windowstlsh: T19AA3C0999A152977C7BBCA7688B33E23873932B27D479097533250D93CB6181DB06F0Bsha3_384: e03e59d776eb6da44a0e475dcad1f31b6d454b5cbac49a860d2b10d01321de658e2b151517bec4dff5ff2e231efb1e78ep_bytes: 558bec81ec040100008b450c56485785timestamp: 2011-03-10 14:53:04
Version Info:
0: [No Data]

PWS:Win32/OnLineGames.JB also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Kykymber.lhMk
Elastic	malicious (moderate confidence)
DrWeb	Trojan.PWS.Qq.5
MicroWorld-eScan	Trojan.PWS.Onlinegames.KEGA
FireEye	Generic.mg.9b22cbac302a49b2
CAT-QuickHeal	Trojan.OnLineGames.gen
Skyhigh	BehavesLike.Win32.PWSOnlineGames.nt
McAfee	PWS-OnlineGames.ke
Malwarebytes	Malware.AI.4197497426
Zillya	Trojan.Kykymber.Win32.2370
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 004bcce41 )
Alibaba	TrojanPSW:Win32/Kykymber.b973e69b
K7GW	Password-Stealer ( 0018a90c1 )
BitDefenderTheta	AI:Packer.17CF8F0A20
VirIT	Trojan.Win32.Generic.BBKS
Symantec	Infostealer.Gampass
ESET-NOD32	a variant of Win32/PSW.Kykymber.AA
APEX	Malicious
TrendMicro-HouseCall	TSPY_KYMBER.SMWX
Avast	Win32:OnLineGames-GCA [Trj]
ClamAV	Win.Spyware.78845-2
Kaspersky	Trojan-PSW.Win32.Kykymber.mcv
BitDefender	Trojan.PWS.Onlinegames.KEGA
NANO-Antivirus	Trojan.Win32.OnLineGames.bkxdd
Tencent	Trojan.PSW.Win32.MiBao.a
Emsisoft	Trojan.PWS.Onlinegames.KEGA (B)
F-Secure	Trojan.TR/Crypt.ULPM.Gen
Baidu	Win32.Trojan-PSW.OLGames.b
VIPRE	Trojan.PWS.Onlinegames.KEGA
TrendMicro	TSPY_KYMBER.SMWX
Trapmine	malicious.high.ml.score
Sophos	Mal/PWS-GZ
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan/PSW.Kykymber.aku
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/Crypt.ULPM.Gen
Varist	W32/OnlineGames.FL.gen!Eldorado
Antiy-AVL	Trojan[PSW]/Win32.Kykymber.aa
Kingsoft	malware.kb.a.1000
Microsoft	PWS:Win32/OnLineGames.JB
Xcitium	Packed.Win32.MUPX.Gen@24tbus
Arcabit	Trojan.PWS.Onlinegames.KEGA
ZoneAlarm	Trojan-PSW.Win32.Kykymber.mcv
GData	Win32.Trojan-Spy.OnlineGames.N
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.OnlineGameHack.R1787
Acronis	suspicious
VBA32	BScope.TrojanPSW.Kykymber
ALYac	Trojan.PWS.Onlinegames.KEGA
MAX	malware (ai score=100)
Cylance	unsafe
Panda	Trj/Kykymber.A
Rising	Stealer.Kykymber!1.A598 (CLASSIC)
Yandex	Trojan.PWS.Kykymber!T4adGUUFclg
Ikarus	Trojan-PWS.Win32.Kykymber
MaxSecure	not-a-virus-PSW-OnlineGames.Gen
Fortinet	W32/Onlinegames.XQB!tr
AVG	Win32:OnLineGames-GCA [Trj]
DeepInstinct	MALICIOUS