Malware

Win32:VB-AACZ [Trj] malicious file

Malware Removal

The Win32:VB-AACZ [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32:VB-AACZ [Trj] virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • Authenticode signature is invalid
  • Behavioural detection: Injection (inter-process)
  • Anomalous binary characteristics
  • Attempts to modify Explorer settings to prevent hidden files from being displayed

How to determine Win32:VB-AACZ [Trj]?


File Info:

name: A68A33D2DDDC90C30571.mlw
path: /opt/CAPEv2/storage/binaries/58b8b2c19401f00dc04331b6ac5066f9d9f3f5b3c4e5f2d7e85cf9eb9061812b
crc32: 40E6BBF6
md5: a68a33d2dddc90c3057161f0cca5e5e6
sha1: 644fb6ee8222385cfb0144d934aecc9850ec4c6b
sha256: 58b8b2c19401f00dc04331b6ac5066f9d9f3f5b3c4e5f2d7e85cf9eb9061812b
sha512: d883db4c6e0bd7e66abc03ddf354d5e318183e2f5617567f28816b101704f0c4e3504c940b9756ce21276a927cd9a4c6545dd5144a137814bde88fcdd938f6b3
ssdeep: 3072:FebB/pTnJUhfykwxvGQHhTiZemK/fObT/bGiU7dCyUHb9rXDdcNcX8Q:8N5nJUARhKK/fObT/bGiUJCyMrXDdBL
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18114C616B650B02FD546C8F26928C29A342D2D7A13D4EC0773C1BF1966709A7B8F17AF
sha3_384: 475f62c5da8c80c89709318c2fd1a08db5f5f8db9666d7fbed7b645eeb04f95985f7e0b89642b4a88d85bcdaac632f0b
ep_bytes: 68b03b4000e8f0ffffff000000000000
timestamp: 2011-12-06 08:02:18

Version Info:

Translation: 0x0409 0x04b0
ProductName: NiVMJZ
FileVersion: 1.00
ProductVersion: 1.00
InternalName: grKWuLCf
OriginalFilename: grKWuLCf.exe

Win32:VB-AACZ [Trj] also known as:

BkavW32.AIDetectMalware
AVGWin32:VB-AACZ [Trj]
tehtrisGeneric.Malware
MicroWorld-eScanGen:Variant.Chinky.6
CAT-QuickHealWorm.VobfusVMF.S21469912
SkyhighBehavesLike.Win32.VBObfus.cm
McAfeeVBObfus.cd
MalwarebytesGeneric.Malware.AI.DDS
VIPREGen:Variant.Chinky.6
SangforSuspicious.Win32.Save.vb
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaWorm:Win32/vobfus.2401
K7GWEmailWorm ( 0054d10f1 )
K7AntiVirusEmailWorm ( 0054d10f1 )
BaiduWin32.Worm.Autorun.l
VirITWorm.Win32.Generic.BDYB
SymantecW32.Changeup!gen15
Elasticmalicious (high confidence)
ESET-NOD32Win32/AutoRun.VB.AQE
CynetMalicious (score: 100)
APEXMalicious
ClamAVWin.Trojan.Changeup-6169544-0
KasperskyWorm.Win32.Vobfus.dfxx
BitDefenderGen:Variant.Chinky.6
NANO-AntivirusTrojan.Win32.Vobfus.chhpce
AvastWin32:VB-AACZ [Trj]
TencentWorm.Win32.Vobfus.n
EmsisoftGen:Variant.Chinky.6 (B)
F-SecureWorm.WORM/Vobfus.kefla
DrWebTrojan.VbCrypt.81
TrendMicroWORM_VOBFUS.SMAB
Trapminesuspicious.low.ml.score
FireEyeGeneric.mg.a68a33d2dddc90c3
SophosMal/SillyFDC-T
SentinelOneStatic AI – Malicious PE
WebrootW32.Trojan.Diple.Gen
VaristW32/VBInject.BG.gen!Eldorado
AviraWORM/Vobfus.kefla
MAXmalware (ai score=85)
Antiy-AVLWorm/Win32.WBNA.gen
Kingsoftmalware.kb.a.999
MicrosoftWorm:Win32/Vobfus!pz
XcitiumTrojWare.Win32.VB.AVA@4paxk7
ArcabitTrojan.Chinky.6
ViRobotWorm.Win32.A.WBNA.196608.AK
ZoneAlarmWorm.Win32.Vobfus.dfxx
GDataGen:Variant.Chinky.6
GoogleDetected
AhnLab-V3Trojan/Win32.Jorik.R17307
Acronissuspicious
BitDefenderThetaAI:Packer.5C751BD720
ALYacGen:Variant.Chinky.6
TACHYONWorm/W32.VB-WBNA.196608.B
VBA32BScope.Trojan.Diple
Cylanceunsafe
PandaTrj/Genetic.gen
TrendMicro-HouseCallWORM_VOBFUS.SMAB
RisingWorm.VobfusEx!1.99DB (CLASSIC)
IkarusWorm.Win32.WBNA
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/VBKrypt.C!tr
Cybereasonmalicious.e82223
DeepInstinctMALICIOUS

How to remove Win32:VB-AACZ [Trj]?

Win32:VB-AACZ [Trj] removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment