Categories: Worm

What is “Worm:VBS/Phorpiex.RB!lnk”?

The Worm:VBS/Phorpiex.RB!lnk is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:VBS/Phorpiex.RB!lnk virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is likely packed with VMProtect
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine Worm:VBS/Phorpiex.RB!lnk?


File Info:
name: 0D263F5FA179BEDFE9F8.mlwpath: /opt/CAPEv2/storage/binaries/5b63c56234136fd8930083ef4ef6f1593f5bc308c7147fe32e8ee51a5e31d45ecrc32: B727E806md5: 0d263f5fa179bedfe9f8d72cf4cd0cdesha1: c183c71deed83233594324e55987ba0c33a4a5d2sha256: 5b63c56234136fd8930083ef4ef6f1593f5bc308c7147fe32e8ee51a5e31d45esha512: 22df19c6a868cd02370f199cfd8bc55f06558b617413797279d66988776950d4aee07a1231a5e0a597eefd0580583716430e49771f0cae2e10245aadd7c53b7fssdeep: 12288:Bo7MGxCwZmMIZkoJfZkPmuAgugjtFVmNB+ugjtFVmNB:YxCwBI5fuPmNg55mNI55mNtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1A0A4F1282ADD9956CBDE47B8D5E4199046F2AA023E97E76F108D0FE43A17FD00E1436Fsha3_384: e30cf6b8d587bf3ebbf86e37729ce4ba18f1a0f6b5a41c250d585cd0d07f78a95654604cbd960cdb6c8911f3fb74b892ep_bytes: ff250000470001004a00000100000000timestamp: 2044-09-03 01:45:49
Version Info:
Translation: 0x0000 0x04b0Comments: CompanyName: FileDescription: Vonex-FortniteFileVersion: 1.0.0.0InternalName: Vonex-Fortnite.exeLegalCopyright: Copyright ©  2022LegalTrademarks: OriginalFilename: Vonex-Fortnite.exeProductName: Vonex-FortniteProductVersion: 1.0.0.0Assembly Version: 1.0.0.0

Worm:VBS/Phorpiex.RB!lnk also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.38901920
FireEye	Generic.mg.0d263f5fa179bedf
CAT-QuickHeal	Trojan.IGENERIC
ALYac	Trojan.GenericKD.38901920
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 7000001c1 )
Alibaba	Packed:MSIL/VMProtect.ed72cf2d
K7GW	Trojan ( 7000001c1 )
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZemsilF.34232.Du0@a0UN@mm
Cyren	W32/MSIL_Kryptik.CRG.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Packed.VMProtect.C suspicious
TrendMicro-HouseCall	TROJ_GEN.R002C0RB922
Paloalto	generic.ml
BitDefender	Trojan.GenericKD.38901920
Avast	Win32:Malware-gen
Ad-Aware	Trojan.GenericKD.38901920
Sophos	Mal/Generic-S + Mal/VMProtBad-A
TrendMicro	TROJ_GEN.R002C0RB922
McAfee-GW-Edition	BehavesLike.Win32.Generic.gc
Emsisoft	Trojan.GenericKD.38901920 (B)
SentinelOne	Static AI – Malicious PE
GData	Trojan.GenericKD.38901920
Avira	HEUR/AGEN.1226415
MAX	malware (ai score=84)
Gridinsoft	Ransom.Win32.Sabsik.sa
Microsoft	Worm:VBS/Phorpiex.RB!lnk
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.RL_Generic.C4127054
McAfee	RDN/Generic.grp
Malwarebytes	Malware.AI.4254394560
APEX	Malicious
Rising	Trojan.Generic/MSIL@AI.100 (RDM.MSIL:cnA6mKf2X9MvQrcA/Y7Xxg)
Yandex	Riskware.VMProtect!7GALuKtGfSA
Ikarus	Trojan.MSIL.Vmprotect
Fortinet	Riskware/Application
AVG	Win32:Malware-gen
Cybereason	malicious.fa179b
Panda	Trj/GdSda.A