What is “Worm.Win32.VBNA.anfa”?

The Worm.Win32.VBNA.anfa is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Worm.Win32.VBNA.anfa virus can do?

Sample contains Overlay data
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Worm.Win32.VBNA.anfa?


File Info:
name: 0318C0D3D53CCCE87671.mlw
path: /opt/CAPEv2/storage/binaries/b891cecf46667cdd7e36a415f05faa3036f9f203cc8ced8fb245d6d3a0fdcf68
crc32: 87F74CEA
md5: 0318c0d3d53ccce8767146e23c26f844
sha1: bfc3df7ddc7d20323489c6b99e7fe836a540aede
sha256: b891cecf46667cdd7e36a415f05faa3036f9f203cc8ced8fb245d6d3a0fdcf68
sha512: 9ef600042e4ef82cb2f5c975089101f228b1ca035d9e84e8883216e9b37e27260b97ab134323fbc7d18173ccd407cea2fb4ea69f2206ae4c7fbd0fe7084047c4
ssdeep: 768:gVXL+uSm/pmhrDDwvoFEohoJ0h4h2hQJVNjDkp57xXp5Rmg5Fh4hqhxOhDhzhnha:gZqv1DDwBCJh4h2hON6x5px
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16793E22F74833862F04ABC7153EACBB156B369C659CAC65F13068DCD780D858D9B09EB
sha3_384: 35167088c859f893016098e45f4b42626e0c651c3bb5cf099f874a2739b9307f77a385020b2e6b0c2fbd9febf8348754
ep_bytes: 6890124000e8eeffffff000058000000
timestamp: 2010-08-25 05:36:01

Version Info:
0: [No Data]

Worm.Win32.VBNA.anfa also known as:

Bkav	W32.AIDetectMalware
AVG	Win32:AutoRun-BNJ [Wrm]
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader1.19201
MicroWorld-eScan	Trojan.GenericKDZ.83608
CAT-QuickHeal	Trojan.VBCryptMF.S29949192
Skyhigh	BehavesLike.Win32.Duptwux.nm
McAfee	Downloader-CJX.gen.j
Malwarebytes	Generic.Malware.AI.DDS
VIPRE	Trojan.GenericKDZ.83608
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	EmailWorm ( 00198a431 )
K7GW	EmailWorm ( 00198a431 )
CrowdStrike	win/malicious_confidence_100% (D)
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Trojan.VB-1244
Kaspersky	Worm.Win32.VBNA.anfa
BitDefender	Trojan.GenericKDZ.83608
Avast	Win32:AutoRun-BNJ [Wrm]
Emsisoft	Trojan.GenericKDZ.83608 (B)
F-Secure	Worm.WORM/VBNA.amtl.1
TrendMicro	WORM_ESFURY.SMA
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.0318c0d3d53ccce8
Sophos	Mal/SillyFDC-D
SentinelOne	Static AI – Malicious PE
Varist	W32/Vobfus.I
Avira	WORM/VBNA.amtl.1
MAX	malware (ai score=84)
Antiy-AVL	Trojan[AutoRun]/Win32.VB.st
Kingsoft	malware.kb.a.994
Microsoft	Worm:Win32/Vobfus!pz
Xcitium	Worm.Win32.Vbna.~anf@24x0ri
Arcabit	Trojan.Generic.D14698
ZoneAlarm	Worm.Win32.VBNA.anfa
GData	Trojan.GenericKDZ.83608
Google	Detected
ALYac	Trojan.GenericKDZ.83608
TrendMicro-HouseCall	WORM_ESFURY.SMA
Ikarus	Worm.Win32.Vobfus
MaxSecure	Trojan.Malware.1726085.susgen

How to remove Worm.Win32.VBNA.anfa?

Worm.Win32.VBNA.anfa removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X