Categories: Trojan

Should I remove “Trojan.Win32.VB.axk”?

The Trojan.Win32.VB.axk is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.VB.axk virus can do?

Behavioural detection: Executable code extraction – unpacking
SetUnhandledExceptionFilter detected (possible anti-debug)
Dynamic (imported) function loading detected
Network anomalies occured during the analysis.
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Executable file is packed/obfuscated with NsPack
Authenticode signature is invalid
A ping command was executed with the -n argument possibly to delay analysis
Uses Windows utilities for basic functionality

How to determine Trojan.Win32.VB.axk?


File Info:
name: 548A39CAC7ACFA07B004.mlwpath: /opt/CAPEv2/storage/binaries/c8515bf441ea0f3d22c17ab0c165697f222e1920f5a27cbd1ed2d7437ba3573acrc32: 1E40F97Bmd5: 548a39cac7acfa07b004988d3216428asha1: 0a034f1414d485f94d6ba55261f1c16fedf3b1besha256: c8515bf441ea0f3d22c17ab0c165697f222e1920f5a27cbd1ed2d7437ba3573asha512: 643478fd6c26accde5799843f2fcd8ef44e55fb129254dac78096dd50dabf6c4e692fc97dee5ed4b02eec888797b67236736c3308320212c1b3ade43a882e773ssdeep: 1536:DSechYqXYfPhhV+C764g9xbalgVoHZsruuK69YM55fSsBnqY8tJ9O:AhbXYPhhV+CmigVoHouu55qsFMJtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1B2D3F93BBB01E02EF202C5B22954D1BE64193D3259C5999BB7822F9A3131597F9F4B0Fsha3_384: c12aa92014f00c272a843912d7496363f6d055728a7344ab20ab912201bbd839771f278e8f0ff3030f2ac924b81fe58eep_bytes: 68bc294000e8f0ffffff000000000000timestamp: 2006-11-03 09:51:27
Version Info:
Translation: 0x0804 0x04b0Comments: csrss.exeCompanyName: Microsoft CorporationFileDescription: LSA Shell (Export Version)LegalCopyright: Microsoft Corporation. All rights reserved.LegalTrademarks: Microsoft CorporationProductName: Microsoft Windows Operating SystemFileVersion: 5.01.2600ProductVersion: 5.01.2600InternalName: setupOriginalFilename: setup.exe

Trojan.Win32.VB.axk also known as:

Bkav	W32.AIDetect.malware1
tehtris	Generic.Malware
DrWeb	BackDoor.Generic.1562
MicroWorld-eScan	Gen:Trojan.Heur.Packed.im0@cuUv6Mmb
FireEye	Generic.mg.548a39cac7acfa07
McAfee	Generic VB.do
Cylance	Unsafe
Sangfor	[MICROSOFT VISUAL BASIC V6.0]
K7AntiVirus	Trojan ( 005376ae1 )
K7GW	Trojan ( 005376ae1 )
Cybereason	malicious.ac7acf
BitDefenderTheta	AI:Packer.F215CD9723
Cyren	W32/Threat-HLLIN-Slipper-based!
Elastic	malicious (high confidence)
Zoner	Probably Heur.ExeHeaderP
Kaspersky	Trojan.Win32.VB.axk
BitDefender	Gen:Trojan.Heur.Packed.im0@cuUv6Mmb
Avast	Win32:Malware-gen
Ad-Aware	Gen:Trojan.Heur.Packed.im0@cuUv6Mmb
Emsisoft	Gen:Trojan.Heur.Packed.im0@cuUv6Mmb (B)
Comodo	Backdoor.Win32.Popwin.~IQ@ogvrk
Zillya	Trojan.VB.Win32.135868
McAfee-GW-Edition	BehavesLike.Win32.Generic.cm
Trapmine	malicious.high.ml.score
Sophos	ML/PE-A + Mal/VBbl-PN
SentinelOne	Static AI – Malicious PE
GData	Gen:Trojan.Heur.Packed.im0@cuUv6Mmb
Avira	TR/Crypt.FKM.Gen
MAX	malware (ai score=81)
Arcabit	Trojan.Heur.Packed.E596D4
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Xema.R89103
Acronis	suspicious
VBA32	Trojan.VB
ALYac	Gen:Trojan.Heur.Packed.im0@cuUv6Mmb
Malwarebytes	Trojan.MalPack.Generic
APEX	Malicious
Rising	Trojan.VB.vyn (CLASSIC)
Yandex	Trojan.GenAsa!0IRFlckBjTk
Ikarus	Trojan-Spy.Agent
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win32:Malware-gen
Panda	Generic Malware
CrowdStrike	win/malicious_confidence_100% (D)