Win32:VB-ABOX [Trj] (file analysis)

The Win32:VB-ABOX [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32:VB-ABOX [Trj] virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• CAPE detected the embedded win api malware family
• Attempts to disable Windows Auto Updates
• Attempts to modify Explorer settings to prevent hidden files from being displayed
• Yara detections observed in process dumps, payloads or dropped files

How to determine Win32:VB-ABOX [Trj]?

File Info:
name: 02E36E18D008E97D00FA.mlw
path: /opt/CAPEv2/storage/binaries/ae3ae43b561b0daf99fa0e5ae59dbc8982485684272dca85cc4dd453eaaaef3a
crc32: A31B04DA
md5: 02e36e18d008e97d00fac8f0ba704078
sha1: 5467cee560001f82ed447eafe4dd1b4cbcf9d3c0
sha256: ae3ae43b561b0daf99fa0e5ae59dbc8982485684272dca85cc4dd453eaaaef3a
sha512: 9d97541ab905a5fcddb3d7f2c9be06e42f78b5afb4bccc024be94f5683fe7bb4e3298ab4cdb42a150af2b431a2dc7ae0e58fdd4aef54d032cadb52223bdb6ed9
ssdeep: 3072:045JukiibdBG5XoC8ctR8imbQhpwI9J5zTbK2VzvPpi52mwzlM9I9IjtQ/Ba:PhtnhctRnmMhpL9J53vTRi52mwzBkQ/8
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13464D6397390F73EE521C6F92D9983A4046DAD3611E1E40BF7C12B1A36F1AD792207A7
sha3_384: 0d2616ada65bf2550d1038f5aedb5f2ab8e5b7e0ec6b05e14b0aba1dd2246e638c9c202ccf18a92334f867f694511d8a
ep_bytes: 68084c4000e8eeffffff000000000000
timestamp: 2012-03-07 19:35:56

Version Info:
0: [No Data]

Win32:VB-ABOX [Trj] also known as:

How to remove Win32:VB-ABOX [Trj]?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.