Win32/VB.RUJ malicious file

The Win32/VB.RUJ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/VB.RUJ virus can do?

Unconventionial language used in binary resources: Spanish (Modern)
The binary likely contains encrypted or compressed data.

How to determine Win32/VB.RUJ?


File Info:
crc32: 1E9C2787
md5: d2266b799ed08273d7bec9f60edd9215
name: D2266B799ED08273D7BEC9F60EDD9215.mlw
sha1: a76cf8b41749d928215bc3460e224eed1d44417e
sha256: 1ae9ae155d1f389736bdee334d691993c1ed0861891bf88bcbded4c25015c7e4
sha512: 713f1a2bb0e3c1b2ccc56e97a9272505e74f71039037327b229b74ca969ef8e518698633cc495a342a6a960af5534a6f6f989f48dd5fd098f95705f64e8f655b
ssdeep: 6144:3WwCl8PaBsyVPp0yN90QEw7r+SaoY9azSl+qfSFs4m7PWWxO7ZePJdxFCBFEN5x:3MnBsry902mEKcq77u57yLxIe1Z
type: PE32+ executable (GUI) x86-64, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: Wextract                
FileVersion: 9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
CompanyName: Microsoft Corporation
ProductName: Windowsxae Internet Explorer
ProductVersion: 9.00.8112.16421
FileDescription: Win32 Cabinet Self-Extractor                                           
OriginalFilename: WEXTRACT.EXE            .MUI
Translation: 0x0409 0x04b0

Win32/VB.RUJ also known as:

CyrenCloud	W32/Trojan.MNJC-1347
K7AntiVirus	Trojan ( 0000000c1 )
Cynet	Malicious (score: 100)
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_60% (W)
K7GW	Trojan ( 0000000c1 )
Cybereason	malicious.41749d
NANO-Antivirus	Trojan.Win32.Blocker.hxnkwh
Cyren	W32/Trojan.MNJC-1347
ESET-NOD32	a variant of Win32/VB.RUJ
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Trojan-Ransom.Win32.Blocker.goxb
Sophos	Mal/Generic-S
DrWeb	Trojan.DownLoader12.53817
TrendMicro	TrojanSpy.Win32.BLOCKER.USMANAB21
McAfee-GW-Edition	BehavesLike.Win64.BadFile.gc
FireEye	Generic.mg.d2266b799ed08273
SentinelOne	Static AI – Malicious SFX
Avira	TR/VB.Agent.bkskm
eGambit	Unsafe.AI_Score_99%
ZoneAlarm	Trojan-Ransom.Win32.Blocker.goxb
McAfee	Artemis!D2266B799ED0
Rising	Ransom.Blocker!8.12A (CLOUD)
Yandex	Trojan.Blocker!xDqujPv3udE
Fortinet	W32/Blocker.GOXB!tr
AVG	Win32:Malware-gen

How to remove Win32/VB.RUJ?

Win32/VB.RUJ removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X