home

vbmz7.exe

The executable vbmz7.exe has been detected as malware by 9 anti-virus scanners. This is a setup program which is used to install the application. Infected by an entry-point obscuring polymorphic file infector which will create a peer-to-peer botnet and receives URLs of additional files to download. The file has been seen being downloaded from cdn.visualbee.net.
Version:
v23.10

MD5:
f54eec34d4d2c5e1d95050869475ca1a

SHA-1:
71c733e2bd0e5267a34e831fe54a752475d0ef21

SHA-256:
7537c704f18636a5d870600baa1f394397b84cf5f86908f956708ecb90b87117

Scanner detections:
9 / 68

Status:
File is infected by a Virus

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
12/27/2024 2:34:59 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:SaliCode
160327-1

AVG
Win32/Sality
2015.0.4355

Dr.Web
Win32.Sector.30
9.0.1.05190

Emsisoft Anti-Malware
Win32.Sality
11.5.0.6191

ESET NOD32
Win32/Sality.NBA virus
8.0.319.0

F-Prot
W32/Sality.E.gen
4.6.5.141

Kaspersky
Virus.Win32.Sality
15.0.0.562

McAfee
Virus.W32/Sality.gen.z
18.0.204.0

Microsoft Security Essentials
Threat.Undefined
1.217.784.0

File size:
158.5 KB (162,272 bytes)

Product version:
v23.10

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\vbmz7.exe

File PE Metadata
Compilation timestamp:
12/6/2009 11:50:46 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
3072:TQItRTXJxCIcRMXwEZe7ERBM7+ebN4p6i2tNObPkpRFd9kEi1TO85:TN6JZEM7aBqbGp6iaNiPkpzd9g1n

Entry address:
0x323C

Entry point:
FE, C9, 80, E0, FD, 69, CA, A3, 34, 78, 28, 1C, 5F, B1, 9D, 89, FD, 69, D3, 56, 6F, 6C, 34, 89, C3, 80, DA, 69, 86, FB, FF, C2, 2B, C2, 08, FB, FE, CA, F6, C2, 47, 69, E8, 47, 25, 88, 43, C7, C0, 56, 05, FD, E4, 87, D1, C6, C3, 1D, EB, 07, F2, 69, F1, 88, 74, D7, F0, 0F, BE, C4, 0F, AF, D7, 8B, F7, E8, 00, 00, 00, 00, 5D, 81, F3, 22, CB, 4D, B0, 25, 08, EF, 98, 47, 0F, AF, D3, 0B, F9, F2, 0F, AF, F0, 89, D0, 0F, B7, FE, F7, C5, E6, 1F, A2, C9, 0F, AF, F7, F3, 8D, 3D, 11, 98, 4D, 50, 6B, DB, 00, 73, 0A, 8B...
 
[+]

Code size:
23 KB (23,552 bytes)

The file vbmz7.exe has been seen being distributed by the following URL.

http://cdn.visualbee.net/vbmz7.exe

Remove vbmz7.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.