Win32/Spy.VB.OBC (file analysis)

The Win32/Spy.VB.OBC is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Spy.VB.OBC virus can do?

Behavioural detection: Executable code extraction – unpacking
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Sniffs keystrokes

How to determine Win32/Spy.VB.OBC?


File Info:
name: 751D1F543D06C34D2E67.mlw
path: /opt/CAPEv2/storage/binaries/47fdad70e1b1758b22852410748ab3d819f6a322ffce93af4834bdcb1cc74603
crc32: 0EE0D4E8
md5: 751d1f543d06c34d2e67e891de48ac3a
sha1: 9dedaede03b1db48b4afe3f730f4d8c81a13b9d5
sha256: 47fdad70e1b1758b22852410748ab3d819f6a322ffce93af4834bdcb1cc74603
sha512: a746818909ac2c2f1e6d9cd3a016172771225c9443d3b23c06a682926d279b8a9210aee2ded0c087a9d08253465a9e0e6dc6ac4c6c37d017f9d3894e9b9aafb3
ssdeep: 384:Gtn5aPNHEfUypXJUNvZnmUjVb6GYyd/VoC0WdDSs1WsTuERyUDvze4KxjJDVhzo:Gl5Ikjo
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13DD2944B92C0C1D1F88E11326E53869964A239EDD73685C227E363BF6C77E0A4D38727
sha3_384: 80fbb4b7b486e09e96078734f4de747f32ba1206cc4ffb422dca35fa2c92344719f5648d849ebfdfcee73b2b0f15f3e8
ep_bytes: 68ec164000e8f0ffffff000000000000
timestamp: 2022-07-11 07:29:22

Version Info:
Translation: 0x0409 0x04b0
Comments: It's a simple key spy program
CompanyName: R3|K0 Inc
FileDescription: KeySpy
LegalCopyright: 1999
LegalTrademarks: Yes
ProductName: KeySpy
FileVersion: 1.00
ProductVersion: 1.00
InternalName: KeySpy
OriginalFilename: KeySpy.exe

Win32/Spy.VB.OBC also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Frmhntpi.4!c
Elastic	malicious (moderate confidence)
FireEye	Gen:Trojan.Heur.bm0@frmHNtpi
McAfee	RDN/Generic PWS.y
Cylance	Unsafe
VIPRE	Gen:Trojan.Heur.bm0@frmHNtpi
Sangfor	Trojan.Win32.Agent.V2p0
CrowdStrike	win/malicious_confidence_60% (W)
Alibaba	TrojanSpy:Win32/KeyLogger.e0c7d4b9
K7GW	Spyware ( 004dc5541 )
K7AntiVirus	Spyware ( 004dc5541 )
Cyren	W32/VBTrojan.17E!Maximus
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Spy.VB.OBC
APEX	Malicious
Kaspersky	Trojan-Spy.Win32.KeyLogger.cgdb
BitDefender	Gen:Trojan.Heur.bm0@frmHNtpi
MicroWorld-eScan	Gen:Trojan.Heur.bm0@frmHNtpi
Ad-Aware	Gen:Trojan.Heur.bm0@frmHNtpi
Sophos	Mal/VB-F
McAfee-GW-Edition	BehavesLike.Win32.Trojan.mz
Trapmine	malicious.high.ml.score
Emsisoft	Gen:Trojan.Heur.bm0@frmHNtpi (B)
GData	Gen:Trojan.Heur.bm0@frmHNtpi
ViRobot	Trojan.Win32.Z.Wacapew.28672.A
ZoneAlarm	Trojan-Spy.Win32.KeyLogger.cgdb
Microsoft	Trojan:Win32/Wacatac.B!ml
BitDefenderTheta	AI:Packer.80B99BD11C
ALYac	Gen:Trojan.Heur.bm0@frmHNtpi
MAX	malware (ai score=81)
TrendMicro-HouseCall	TROJ_GEN.R002C0RGB22
Rising	Spyware.VB!8.226 (CLOUD)
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/PossibleThreat
Cybereason	malicious.43d06c

How to remove Win32/Spy.VB.OBC?

Win32/Spy.VB.OBC removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X