Malware

Win32:VB-ABUM [Trj] information

Malware Removal

The Win32:VB-ABUM [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32:VB-ABUM [Trj] virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • Authenticode signature is invalid
  • Behavioural detection: Injection (inter-process)
  • Attempts to disable Windows Auto Updates
  • Anomalous binary characteristics
  • Attempts to modify Explorer settings to prevent hidden files from being displayed

How to determine Win32:VB-ABUM [Trj]?


File Info:

name: F73A587318CFCAF9318D.mlw
path: /opt/CAPEv2/storage/binaries/2ef2e3da6081917334897d070b563ce080f49e249d00a66ad16f250886f11479
crc32: 140A4A39
md5: f73a587318cfcaf9318dc48c49b48eb4
sha1: 19d775c2ac5b546891f8be671923c35c4b549ec0
sha256: 2ef2e3da6081917334897d070b563ce080f49e249d00a66ad16f250886f11479
sha512: a7c437ea50fad5abad0bac21aac3ae8407610b2bab8df4d0d6576d5e4c83432f97aec30e36159b6a31b5561184bd8d5f3f984cbc49566cc6ad61f70279bd8adf
ssdeep: 6144:eILIpydVsZyxyK5R8GYKi1Xfvs1tzH51t+ewSReMNP/:duydfiebPn
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FF547445A928B03BE55684B33826C757181C2E7222D0EC67B391AB0D71712E7FAF572F
sha3_384: 4c730dc75d966dbd93d027383d5dde5197089f836db013f929f595af2173eae50edf34ba6f1d4a132f417581f7e194dd
ep_bytes: 6890434000e8f0ffffff000000000000
timestamp: 2012-03-20 02:10:02

Version Info:

ProductName:
FileVersion: 1.00
ProductVersion: 1.00
InternalName:
OriginalFilename:
Translation: 0x0409 0x04b0

Win32:VB-ABUM [Trj] also known as:

BkavW32.AIDetectMalware
LionicWorm.Win32.Vobfus.o!c
tehtrisGeneric.Malware
DrWebTrojan.VbCrypt.60
MicroWorld-eScanGen:Variant.VBInject.11
FireEyeGeneric.mg.f73a587318cfcaf9
CAT-QuickHealTrojan.Beebone.D
SkyhighBehavesLike.Win32.VBObfus.dm
ALYacGen:Variant.VBInject.11
Cylanceunsafe
SangforSuspicious.Win32.Save.vb
K7AntiVirusEmailWorm ( 0054d10f1 )
AlibabaWorm:Win32/Vobfus.99f3a09c
K7GWEmailWorm ( 0054d10f1 )
Cybereasonmalicious.318cfc
BitDefenderThetaGen:NN.ZevbaF.36802.rm0@aiJaxbci
VirITBackdoor.Win32.VB.ONM
SymantecW32.Changeup
Elasticmalicious (high confidence)
ESET-NOD32Win32/AutoRun.VB.ATO
APEXMalicious
TrendMicro-HouseCallWORM_VBNA.SMKC
ClamAVWin.Trojan.Changeup-6169544-0
KasperskyWorm.Win32.Vobfus.egiq
BitDefenderGen:Variant.VBInject.11
NANO-AntivirusTrojan.Win32.Jorik.cfdsmx
SUPERAntiSpywareTrojan.Agent/Gen-Autorun
AvastWin32:VB-ABUM [Trj]
TencentWorm.Win32.Autorun.twl
TACHYONWorm/W32.Vobfus.286720.C
EmsisoftGen:Variant.VBInject.11 (B)
GoogleDetected
F-SecureTrojan.TR/VBInject.11.A.1
BaiduWin32.Worm.Autorun.l
TrendMicroWORM_VBNA.SMKC
Trapminemalicious.moderate.ml.score
SophosMal/SillyFDC-W
IkarusWorm.Win32.Vobfus
VaristW32/VBcrypt.T.gen!Eldorado
AviraTR/VBInject.11.A.1
Antiy-AVLWorm/Win32.WBNA.gen
Kingsoftmalware.kb.a.999
MicrosoftWorm:Win32/Vobfus!pz
XcitiumTrojWare.Win32.VB.AVA@4paxk7
ArcabitTrojan.VBInject.11
ZoneAlarmWorm.Win32.Vobfus.egiq
GDataGen:Variant.VBInject.11
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.Jorik.R22659
Acronissuspicious
McAfeeVBObfus.dh
MAXmalware (ai score=88)
VBA32BScope.Trojan.VB.Onechki
MalwarebytesPronny.Worm.Spreader.DDS
PandaW32/Vobfus.GEW.worm
RisingWorm.VobfusEx!1.99DB (CLASSIC)
YandexTrojan.GenAsa!dFlQiwYYslQ
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/VBKrypt.C!tr
AVGWin32:VB-ABUM [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (D)
alibabacloudWorm:Win/Vobfus.b08e37ea

How to remove Win32:VB-ABUM [Trj]?

Win32:VB-ABUM [Trj] removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment