Categories: Virus

Virus.Win32.VB.gp (file analysis)

The Virus.Win32.VB.gp is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Virus.Win32.VB.gp virus can do?

Sample contains Overlay data
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid

How to determine Virus.Win32.VB.gp?


File Info:
name: 1299D99629C39F52D052.mlwpath: /opt/CAPEv2/storage/binaries/4a23518efd051aab6c8fc223c1248116468f458ccf4fa08a94bda028a6ba0d39crc32: 18FE2DFBmd5: 1299d99629c39f52d05268eeea7d478esha1: 9f869ffff24bc5662191179e73976c5b5986e3e7sha256: 4a23518efd051aab6c8fc223c1248116468f458ccf4fa08a94bda028a6ba0d39sha512: cee4517a23ecadd1061e22f3d589b4f62189d7582f408c769bb95932b2722a51d433ad969d1765a0979296e17846b73f028f7198dfbccb6e25eda7ba078e8d78ssdeep: 12288:6chZG6JkGMQdgchZG6JkGMVchZG6JH6HTr6lfr:jZZJkLQ1ZZJkLAZZJWWlztype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T18615C64A5246047FE8607A70846E6B0406617FBC2E73D76ABE04B507FA727C3A53377Asha3_384: 116577e741b0fa2b631b137fdc68cf4bac7a46e583dc19b6619ca80ab27bcb3d992751d82e069661095d5e6708e17283ep_bytes: 60be00c040008dbe0050ffff5783cdfftimestamp: 2007-09-07 11:28:55
Version Info:
Translation: 0x0804 0x04b0Comments: Microsoft Firewall Installer 12th EditionCompanyName: XC MicrosoftFileDescription: Microsoft Firewall Installer - Protect all of your filesLegalCopyright: Microsoft (C) 2007 , All rights reserved.LegalTrademarks: Microsoft Firewall InstallerProductName: Microsoft Firewall InstallerFileVersion: 1.01.0013ProductVersion: 1.01.0013InternalName: FirewallOriginalFilename: Firewall.exe

Virus.Win32.VB.gp also known as:

Lionic	Virus.Win32.VB.lPRX
Elastic	malicious (moderate confidence)
MicroWorld-eScan	Trojan.GenericKDZ.95034
ClamAV	Win.Malware.Score-6789632-0
FireEye	Trojan.GenericKDZ.95034
CAT-QuickHeal	W32.VBVindor.V3
ALYac	Trojan.GenericKDZ.95034
Cylance	unsafe
VIPRE	Trojan.GenericKDZ.95034
Sangfor	Suspicious.Win32.Save.ins
Alibaba	Trojan:Win32/Vindor.4c47
CrowdStrike	win/malicious_confidence_100% (W)
Baidu	Win32.Trojan.VB.t
VirIT	Worm.Win32.VB.DDH
Cyren	W32/Trojan.CQF.gen!Eldorado
Symantec	W32.Pajetbin
tehtris	Generic.Malware
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	Virus.Win32.VB.gp
BitDefender	Trojan.GenericKDZ.95034
NANO-Antivirus	Trojan.Win32.VB.tole
SUPERAntiSpyware	Trojan.Agent/Gen-Dropper
Avast	Win32:CripUnp [Susp]
Tencent	Trojan.Win32.Agent.bt
Sophos	W32/VB-DYT
DrWeb	Win32.HLLP.Woner
Zillya	Virus.VB.Win32.185
TrendMicro	TROJ_VB.BJR
McAfee-GW-Edition	BehavesLike.Win32.Dropper.ch
Emsisoft	Trojan.GenericKDZ.95034 (B)
Ikarus	Virus.Win32.VB.gp
GData	Trojan.GenericKDZ.95034
Jiangmin	Virus.VB.n
Avira	TR/Small.21504.B
MAX	malware (ai score=82)
Antiy-AVL	Virus/Win32.VB.gp
Xcitium	Virus.Win32.VB.ei@3l1r83
Arcabit	Trojan.Generic.D1733A
ViRobot	Trojan.Win32.VB.253494
Microsoft	Trojan:Win32/Wacatac.B!ml
Google	Detected
AhnLab-V3	Trojan/Win32.Xema.C5935
Acronis	suspicious
McAfee	MultiDropper-SG.gen.a
TACHYON	Banker/W32.Banbra.Gen
Malwarebytes	VB.Trojan.Generic.DDS
TrendMicro-HouseCall	TROJ_VB.BJR
Yandex	Trojan.VB!fJOJNyBDtpU
SentinelOne	Static AI – Malicious PE
MaxSecure	Virus.W32.VB.GP
Fortinet	W32/MalformedType.PE!dam
AVG	Win32:CripUnp [Susp]
Cybereason	malicious.ff24bc
Panda	W32/VB.ABL