Categories: Trojan

Trojan:Win32/Ymacco.AB65 (file analysis)

The Trojan:Win32/Ymacco.AB65 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Ymacco.AB65 virus can do?

Injection (inter-process)
Injection with CreateRemoteThread in a remote process
Uses Windows utilities for basic functionality
Network activity detected but not expressed in API logs
Harvests information related to installed mail clients

How to determine Trojan:Win32/Ymacco.AB65?


File Info:
crc32: B4783AA2md5: a50519badf2e0d5bd74ecc73b312d231name: upload_filesha1: 7ddbd2cd684136ae10107c7d4ee4a5c3ba153860sha256: 654020f2936ac35a44528062ea745fc1cc45b79920c23c54d2528cddcdaf940csha512: 4b5c51a9f778d68fa66a16fa04a6a45af783e36ddc2c80e375587b1e71e62ad4bcc2427749a47fa3cd679032e651cdefbd344e94eb85c5a8588369e6c05b7720ssdeep: 768:KXZ9o0guzanIpNSylLzw1n00BwtJwyTD9jI2Wr9kj:KXXgcaAMSzwZ0bJ1NjI79Wtype: Composite Document File V2 Document, No summary info
Version Info:
0: [No Data]

Trojan:Win32/Ymacco.AB65 also known as:

FireEye	Exploit.CVE-2017-11882.Gen
McAfee	Exploit-CVE2017-11882.bx
Invincea	Exp/20180802-B
Symantec	Trojan Horse
TrendMicro-HouseCall	Trojan.Win32.CVE201711882.BH
Avast	Win32:ShellCode [Expl]
Cynet	Malicious (score: 85)
Kaspersky	HEUR:Exploit.MSOffice.Generic
BitDefender	Exploit.CVE-2017-11882.Gen
ViRobot	DOC.Z.CVE-2017-1188.44544.M
MicroWorld-eScan	Exploit.CVE-2017-11882.Gen
Ad-Aware	Exploit.CVE-2017-11882.Gen
Emsisoft	Exploit.CVE-2017-11882.Gen (B)
Comodo	Malware@#skobgpgxx95z
F-Secure	Exploit.EXP/CVE-2017-11882.gtvcl
DrWeb	Exploit.Siggen2.48532
TrendMicro	Trojan.Win32.CVE201711882.BH
McAfee-GW-Edition	Exploit-CVE2017-11882.bx
Sophos	Exp/20180802-B
Ikarus	Trojan-Downloader.Office.Crypt
Avira	EXP/CVE-2017-11882.gtvcl
MAX	malware (ai score=100)
Microsoft	Trojan:Win32/Ymacco.AB65
Arcabit	Exploit.CVE-2017-11882.Gen
ZoneAlarm	HEUR:Exploit.MSOffice.Generic
GData	Exploit.CVE-2017-11882.Gen
AhnLab-V3	Exploit/XLS.Generic
TACHYON	Suspicious/W97.CVE-2017-11882
ESET-NOD32	probably a variant of Win32/Exploit.CVE-2017-11882.C
Tencent	Office.Exploit.Generic.Ljjp
Fortinet	MSOffice/CVE_2017_11882.B!exploit
AVG	Win32:ShellCode [Expl]
Qihoo-360	Generic/Trojan.Exploit.ed7