What is “Win32/RiskWare.VBCrypt.FM”?

The Win32/RiskWare.VBCrypt.FM is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/RiskWare.VBCrypt.FM virus can do?

Behavioural detection: Executable code extraction – unpacking
Authenticode signature is invalid

How to determine Win32/RiskWare.VBCrypt.FM?


File Info:
name: B8D9DF1824553F73F97C.mlw
path: /opt/CAPEv2/storage/binaries/8bd73fe99af39bcd24c0efcda842fe1d4ef74226ebd115fe6682743b93f89f7b
crc32: 93B2783C
md5: b8d9df1824553f73f97c97970fc70b92
sha1: fbddcf8997bb7e7a73eea9759f89c6f17c264fce
sha256: 8bd73fe99af39bcd24c0efcda842fe1d4ef74226ebd115fe6682743b93f89f7b
sha512: 1f7a1a1267835334ebd5a7c4891584e0c7d6fcbc1aead398d08b61d0be5c9f9c26e1b2f54f06eddc892ef9e61011d295f1a59fcac094befef3889ad33874cad3
ssdeep: 3072:l8T7+IeNLNAz6Cc6zi8du/MKRfyEzt5G8FuU/1nP3fysFjqhh0GjFpl29asatWwV:lSBeFNAzrZdyMIyYLNJpPyQQR6OI
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B9A44A62C6609ECBF3A70D3873108FA056B42C758B6E7016F6AE7B44B67764274BF142
sha3_384: cfcbb31d5e792d744807963141dd75ff52d6329053c987c88d9eeda83fc10961b97d67f02dbb273daef09282957299b0
ep_bytes: 68384c4100e8eeffffff000000000000
timestamp: 2015-01-21 19:50:01

Version Info:
Translation: 0x0409 0x04b0
ProductName: Project1
FileVersion: 1.00
ProductVersion: 1.00
InternalName: ..Gerador..Folha..By;Blindex;King
OriginalFilename: ..Gerador..Folha..By;Blindex;King.exe

Win32/RiskWare.VBCrypt.FM also known as:

Bkav	W32.AIDetectMalware
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/RiskWare.VBCrypt.FM
APEX	Malicious
ClamAV	Win.Dropper.HawkEye-9856314-0
Kaspersky	HEUR:Trojan.Win32.Generic
Trapmine	malicious.high.ml.score
ZoneAlarm	HEUR:Trojan.Win32.Generic
Google	Detected
Rising	Trojan.Win32.Generic.18E2A0FD (C64:YzY0Or8ut6BFl1dI)
MaxSecure	Trojan.Malware.300983.susgen
BitDefenderTheta	Gen:NN.ZevbaF.36318.Dm0@aSx9QMai
CrowdStrike	win/malicious_confidence_70% (D)

How to remove Win32/RiskWare.VBCrypt.FM?

Win32/RiskWare.VBCrypt.FM removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X