[Community-sigs] Win.Worm.VB

[Askar Dyussekeyev]

Win.Worm.VB:1:8587:68{4}B8{4}FFD0FFE0{7}57494E494E455400{4}496E7465726E65744F70656E4100{26}A1{4}0BC07402FFE068{4}B8{4}FFD0FFE0{7}496E7465726E6574436C6F736548616E646C6500{24}A1486540000BC07402FFE068{4}B8{4}FFD0FFE0{7}496E7465726E65745265616446696C6500{27}A1{4}0BC07402FFE068{4}B8{4}FFD0FFE0{7}6A5933BE7867BD4100{27}A1{4}0BC07402FFE068{4}B8{4}FFD0FFE0{7}4F70656E50726F6365737300{24}A1{4}0BC07402FFE068{4}B8{4}FFD0FFE0{7}43726561746546696C654100{24}A1{4}0BC07402FFE068{4}B8{4}FFD0FFE0

signature looks for specific block of data and code

detections(63):
051ed9ce3aa91ae460a236fdcf56405a
0c6904585ceb8f914a0d4b1e0acd554e
1bf39287764d5c07a60e972ca6d718ac
2d5cb8499f677c9d0a5a29607c982155
30c57554d4d571913aa4b26ff39cdd04
3555b3c6abcef18ae30d86808de7a747
3bce9d1da553265de502b6b2ac5bb8ca
4a50c7b2d7540ec96f006d24b843d565
4ab4b6e7f35aa203fb59f4c0da21c086
4af57cf78b232569012d6d496d1a3840
4bf8b3ad3f04170c53a3dc304b38dd6b
52fabb1ca04194ecf013fb3df38fa84e
53b01244333e48dee0bdf820f0b15ebb
540fc62d6bcedd903d39d91300a407d9
5ca05556efb752f1ecb713aadd5be52b
5cc6f541a3eb8c8bf86eec6bec344779
60f3af7d61fc007861ed153d0086a395
62c72badad58de0f68f72e9075fd393c
669f3a5e9fab85c638b38cfb532d7936
6838684cc3e0085e48d769f8a164fe4d
6bb952679e90ad903080a8358db026b3
6ce833b826e315139ed591c77bc7501e
72c23abf713a6248666700740940d967
738a69ef3323dbf52e1e0af783353c28
753b6ebf6936e251df0dba6583b4af37
7946fb5526205f1f5873427d057617e4
79f2c683e8d6de0646e7cb20bf796fda
7f478cacc9256e8a2d3366fb7e71c346
80a31db23426804025bfdcfa5888aaf9
85a59b49ff3cc959dcbc06b4eb8f3b12
8747e59c6d7479ec549d06d77086d891
8874022b33cb9a0ceb846c15742092f5
89bba9d0b46f6f0dd3c3960ea0ca027b
8f24b5e95927d7af929d2aaa4f42dde3
9850dc62863fd214c53944a5bd70e5f1
9abf33f1e5a5b9a248004836fd9269eb
9c6373f1ebf09735e95704b05bd8784c
a25188252c7a84536fe0b790c117a13e
a3e386be1787e77ed830a985ea486ce7
ad53ee8d744f1b1324bbb9a6d3d281ce
af22811bea92303b69b13e6f5dfefa79
b009bcda6b5c2e231ace51d749b167c7
b1165346f7559e542a3819e777d875a3
b61cb8f1490a890a182b774b057747ab
b88f68b33fa4dfcf711af2c4af1bcf05
baa9f78d990ef48cc1ad74f1d10a20d5
bba54267851f0a0d1fc1485d3d1c81f3
c0e6181b35c56ac810dedc6ee9e712b2
c33f7df083ac6576dfd8c6f3f7fbca31
c435b045f0f1e1b82fc143cf4065a62f
c7129a331c92cfe0fb1666e6b6887f68
c8f563c1b1644c958974b6d490bb48b5
caf103430458509f98a7799e0d0905e4
caf430d48766ac9f4f205cb96adb0230
d0b35fcd47c73fcc6883256fa619d57a
d67e955d29479387b5822e1c812da038
d77aea9ebaee1bb25a26c7ed38509888
d7929b778a45be7bf98f1c81369a3633
d9f773952fdc9a26a5ae7e34a3051a56
dd316be7b6a10aeeb35f6cf706bc3df4
ef667e0b714b9faa32e1754c2f4788b7
fc6190920d1f2df1bff154a105b6b33c
ff13665fa14d75b5564db275938f7c2e