Malware

VirTool:Win32/VBInject.JY (file analysis)

Malware Removal

The VirTool:Win32/VBInject.JY is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What VirTool:Win32/VBInject.JY virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • CAPE extracted potentially suspicious content
  • Unconventionial language used in binary resources: Russian
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Behavioural detection: Injection (Process Hollowing)
  • Behavioural detection: Injection (inter-process)
  • Behavioural detection: Injection with CreateRemoteThread in a remote process
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine VirTool:Win32/VBInject.JY?



File Info:

name: F598999C4B7F05DE6315.mlw
path: /opt/CAPEv2/storage/binaries/e54fea71a7b5d71c263db32f67df2761fb55515052612d3495f64d4400f73e11
crc32: 9469809E
md5: f598999c4b7f05de6315fb37b29b50e3
sha1: 91375922371ffa6cd2827a3aed4a4caa80d2c4e6
sha256: e54fea71a7b5d71c263db32f67df2761fb55515052612d3495f64d4400f73e11
sha512: c975292fbf6b9d26fe2fc45e08116c488781b58ede9958559b338a2270f491f099d14b515801073dc58aea68a3c210c9dc8e73e8b42086487cd6361acdba638e
ssdeep: 6144:vBZPbEkTLCBTvUgldtu34dKXqKjIdoCXdaONE5FhdPrt:vBZbEkTLCBTvUgldtu34dKXqZ5XdaaEV
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1EB5408F7F9038160F67BBF71178F85461623BAA20F5A3E17E06952376C252307D5DA88
sha3_384: e656cdc5b62abf30aaa462115e91db7042f0776d8dceb79fe2598601d0f856549f914bfe955c2f8bfc4cb75d141b7852
ep_bytes: 684c144000e8f0ffffff000040000000
timestamp: 2010-09-22 01:42:17


Version Info:

Translation: 0x0409 0x04b0
CompanyName: AceSoft Corp all rights reserved
FileDescription: AceSoft Corp all rights reserved
LegalCopyright: AceSoft Corp all rights reserved
ProductName: AceSoft Corp all rights reserved
FileVersion: 2.00
ProductVersion: 2.00
InternalName: program
OriginalFilename: program.exe

VirTool:Win32/VBInject.JY also known as:

BkavW32.AIDetectMalware
LionicTrojan.Win32.VB.ljjn
CynetMalicious (score: 100)
CAT-QuickHealVirTool.VBInject.JY3
McAfeeW32/Rimecud.gen.at
Cylanceunsafe
VIPREGen:Variant.Midie.107712
SangforSuspicious.Win32.Save.vb
K7AntiVirusP2PWorm ( 001eb4b61 )
AlibabaRansom:Win32/Blocker.ebdb1833
K7GWP2PWorm ( 001eb4b61 )
Cybereasonmalicious.2371ff
VirITTrojan.Win32.VB.AINZ
SymantecTrojan.Usuge!gen3
Elasticmalicious (high confidence)
ESET-NOD32Win32/Bflient.K
APEXMalicious
ClamAVWin.Worm.Palevo-25659
KasperskyTrojan-Ransom.Win32.Blocker.heoy
BitDefenderGen:Variant.Midie.107712
NANO-AntivirusTrojan.Win32.Autoruner.blyna
ViRobotWorm.Win32.A.P2P-Palevo.286720
MicroWorld-eScanGen:Variant.Midie.107712
AvastWin32:TrojanX-gen [Trj]
TencentMalware.Win32.Gencirc.10be9aab
TACHYONRansom/W32.VB-Blocker.286720.B
EmsisoftGen:Variant.Midie.107712 (B)
F-SecureWorm.WORM/Palevo.acj
DrWebWin32.HLLW.Autoruner.22584
ZillyaWorm.Palevo.Win32.43390
TrendMicroTSPY_VBINJECT_CD1029B8.RDXN
McAfee-GW-EditionBehavesLike.Win32.Infected.dh
Trapminemalicious.high.ml.score
FireEyeGeneric.mg.f598999c4b7f05de
SophosMal/VBCheMan-A
JiangminWorm/Palevo.dgiv
WebrootW32.Downloader.Gen
AviraWORM/Palevo.acj
Antiy-AVLWorm[P2P]/Win32.Palevo
MicrosoftVirTool:Win32/VBInject.JY
XcitiumSuspicious@#3qjal074xpumc
ArcabitTrojan.Midie.D1A4C0
SUPERAntiSpywareTrojan.Agent/Gen-FakeAV[Ace]
ZoneAlarmTrojan-Ransom.Win32.Blocker.heoy
GDataGen:Variant.Midie.107712
GoogleDetected
VBA32Trojan.VB.FlyCryptor
ALYacGen:Variant.Midie.107712
MAXmalware (ai score=100)
MalwarebytesSpyware.Dybalom
PandaTrj/CI.A
TrendMicro-HouseCallTSPY_VBINJECT_CD1029B8.RDXN
RisingTrojan.Win32.VBCode.frc (CLASSIC)
YandexTrojan.GenAsa!9TVVauVSaz8
IkarusP2P-Worm.Win32.Palevo
MaxSecureWorm.W32.Palevo.BKFU
FortinetW32/Bflient.PAG!tr
BitDefenderThetaGen:NN.ZevbaF.36722.rm0@am5lPAbk
AVGWin32:TrojanX-gen [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (D)

How to remove VirTool:Win32/VBInject.JY?

VirTool:Win32/VBInject.JY removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment