Categories: Malware

VirTool:Win32/VBInject.UY (file analysis)

The VirTool:Win32/VBInject.UY is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What VirTool:Win32/VBInject.UY virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
Network anomalies occured during the analysis.
A process created a hidden window
Uses Windows utilities for basic functionality
Executed a process and injected code into it, probably while unpacking
Deletes its original binary from disk
Anomalous binary characteristics

How to determine VirTool:Win32/VBInject.UY?


File Info:
crc32: C407A871md5: a3e9c13ac3afde345690a29eca3e9fc1name: A3E9C13AC3AFDE345690A29ECA3E9FC1.mlwsha1: 07ce0293ba3d68d0cc52ffb8acbc4e1388a36aa4sha256: 26468aa28159ba30080cc88a4a0deac5bed8b916dfc096b04e49deeba0070efdsha512: 3697a432c3819e2d72a672a4fa18ba74fdb5ae984a752afca1ed47d1e5e52712d0590c791a51b77f787e8e8934ad32bb76b4819e4a7767f524a0492122a08843ssdeep: 3072:4jdNAbpTekViVxM1ssmoFlFlxjpTUrxuYSJvKvCL+Q0:4jAaxxMplx1g3SJv07type: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
Translation: 0x0409 0x04b0InternalName: WinRARFileVersion: 1.00CompanyName: MicrosoftProductName: WinRARProductVersion: 1.00OriginalFilename: WinRAR.exe

VirTool:Win32/VBInject.UY also known as:

Elastic	malicious (high confidence)
DrWeb	Trojan.Siggen3.43054
MicroWorld-eScan	Trojan.Generic.7317407
FireEye	Generic.mg.a3e9c13ac3afde34
Qihoo-360	Win32/Ransom.Blocker.HwMAar8A
ALYac	Trojan.Generic.7317407
Cylance	Unsafe
VIPRE	Backdoor.IRCBot
AegisLab	Trojan.Win32.Blocker.j!c
Sangfor	Trojan.Win32.Save.a
BitDefender	Trojan.Generic.7317407
BitDefenderTheta	Gen:NN.ZevbaF.34608.km0@a8gGnFfi
Symantec	W32.IRCBot
APEX	Malicious
Avast	Win32:GenMalicious-KJJ [Trj]
Kaspersky	Trojan-Ransom.Win32.Blocker.hcdh
Alibaba	Ransom:Win32/Blocker.e952f970
NANO-Antivirus	Trojan.Win32.Inject.ixyuz
Rising	Ransom.Blocker!8.12A (CLOUD)
Ad-Aware	Trojan.Generic.7317407
Sophos	Mal/Generic-R + Mal/VB-XXC
Comodo	Malware@#35hh5o2i3nl3e
F-Secure	Heuristic.HEUR/AGEN.1110558
Zillya	Trojan.Injector.Win32.194586
McAfee-GW-Edition	BehavesLike.Win32.Virus.cm
Emsisoft	Trojan.Generic.7317407 (B)
Ikarus	Trojan.Win32.Klovbot
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1110558
Antiy-AVL	Trojan[Dropper]/Win32.Injector
Kingsoft	Win32.Troj.Injector.(kcloud)
Microsoft	VirTool:Win32/VBInject.UY
Arcabit	Trojan.Generic.D6FA79F
AhnLab-V3	Win32/Sdbot.worm.151552.B
ZoneAlarm	Trojan-Ransom.Win32.Blocker.hcdh
GData	Win32.Trojan.VB.OH
Cynet	Malicious (score: 100)
ESET-NOD32	a variant of Win32/Injector.NYJ
McAfee	Artemis!A3E9C13AC3AF
MAX	malware (ai score=100)
Malwarebytes	Generic.Malware/Suspicious
Panda	Generic Malware
Zoner	Trojan.Win32.6628
Tencent	Malware.Win32.Gencirc.11496e85
Yandex	Trojan.GenAsa!4/LPsxmCWts
SentinelOne	Static AI – Malicious PE
Fortinet	W32/VBInjector.W!tr
AVG	Win32:GenMalicious-KJJ [Trj]
Cybereason	malicious.ac3afd
Paloalto	generic.ml
MaxSecure	Trojan.Malware.3571667.susgen