VirTool:Win32/VBInject

This is a generic detection for malicious files that are obfuscated using particular techniques to prevent their detection or analysis.

A malicious file is generally encrypted/and or compressed and stored inside another program (written in Visual Basic), which decodes the malicious file and loads it.

The malicious program may be injected into a clean process or loaded in a new process of its own. Unlike a "dropper", the malicious executable is never written to disk as a separate file.

Malicious programs detected as VirTool:Win32/VBInject can have virtually any purpose, as this technique is used by many different malware families in the wild to protect them from detection or analysis.

Examples of families which have been using VirTool:Win32/VBInject to deter detection include:

• Backdoor:Win32/Bifrose
• Backdoor:Win32/IRCbot
• Backdoor:Win32/Votwup
• PWS:Win32/OnLineGames
• PWS:Win32/Zbot
• Worm:Win32/Ainslot
• Worm:Win32/Pushbot
• Worm:Win32/Rebhip

Analysis by Daniel Radu