[Community-sigs] Win.Worm.VB

[Ben Baker]

Thanks Askar, I'll queue this up for FP testing. Your signature for
Win.Trojan.Fosniw passed FP testing and should be published soon.

On Tue, Aug 16, 2016 at 12:29 PM, Askar Dyussekeyev <dyussekeyev at yandex.kz>
wrote:

> Win.Worm.VB:1:8587:68{4}B8{4}FFD0FFE0{7}57494E494E455400{4}
> 496E7465726E65744F70656E4100{26}A1{4}0BC07402FFE068{4}B8{4}FFD0FFE0{7}
> 496E7465726E6574436C6F736548616E646C6500{24}A1486540000BC07402FFE068{4}B8{
> 4}FFD0FFE0{7}496E7465726E65745265616446696C6500{27}A1{4}0BC07402FFE068{4}
> B8{4}FFD0FFE0{7}6A5933BE7867BD4100{27}A1{4}0BC07402FFE068{4}B8{4}
> FFD0FFE0{7}4F70656E50726F6365737300{24}A1{4}0BC07402FFE068{4}B8{4}
> FFD0FFE0{7}43726561746546696C654100{24}A1{4}0BC07402FFE068{4}B8{4}FFD0FFE0
>
> signature looks for specific block of data and code
>
> detections(63):
> 051ed9ce3aa91ae460a236fdcf56405a
> 0c6904585ceb8f914a0d4b1e0acd554e
> 1bf39287764d5c07a60e972ca6d718ac
> 2d5cb8499f677c9d0a5a29607c982155
> 30c57554d4d571913aa4b26ff39cdd04
> 3555b3c6abcef18ae30d86808de7a747
> 3bce9d1da553265de502b6b2ac5bb8ca
> 4a50c7b2d7540ec96f006d24b843d565
> 4ab4b6e7f35aa203fb59f4c0da21c086
> 4af57cf78b232569012d6d496d1a3840
> 4bf8b3ad3f04170c53a3dc304b38dd6b
> 52fabb1ca04194ecf013fb3df38fa84e
> 53b01244333e48dee0bdf820f0b15ebb
> 540fc62d6bcedd903d39d91300a407d9
> 5ca05556efb752f1ecb713aadd5be52b
> 5cc6f541a3eb8c8bf86eec6bec344779
> 60f3af7d61fc007861ed153d0086a395
> 62c72badad58de0f68f72e9075fd393c
> 669f3a5e9fab85c638b38cfb532d7936
> 6838684cc3e0085e48d769f8a164fe4d
> 6bb952679e90ad903080a8358db026b3
> 6ce833b826e315139ed591c77bc7501e
> 72c23abf713a6248666700740940d967
> 738a69ef3323dbf52e1e0af783353c28
> 753b6ebf6936e251df0dba6583b4af37
> 7946fb5526205f1f5873427d057617e4
> 79f2c683e8d6de0646e7cb20bf796fda
> 7f478cacc9256e8a2d3366fb7e71c346
> 80a31db23426804025bfdcfa5888aaf9
> 85a59b49ff3cc959dcbc06b4eb8f3b12
> 8747e59c6d7479ec549d06d77086d891
> 8874022b33cb9a0ceb846c15742092f5
> 89bba9d0b46f6f0dd3c3960ea0ca027b
> 8f24b5e95927d7af929d2aaa4f42dde3
> 9850dc62863fd214c53944a5bd70e5f1
> 9abf33f1e5a5b9a248004836fd9269eb
> 9c6373f1ebf09735e95704b05bd8784c
> a25188252c7a84536fe0b790c117a13e
> a3e386be1787e77ed830a985ea486ce7
> ad53ee8d744f1b1324bbb9a6d3d281ce
> af22811bea92303b69b13e6f5dfefa79
> b009bcda6b5c2e231ace51d749b167c7
> b1165346f7559e542a3819e777d875a3
> b61cb8f1490a890a182b774b057747ab
> b88f68b33fa4dfcf711af2c4af1bcf05
> baa9f78d990ef48cc1ad74f1d10a20d5
> bba54267851f0a0d1fc1485d3d1c81f3
> c0e6181b35c56ac810dedc6ee9e712b2
> c33f7df083ac6576dfd8c6f3f7fbca31
> c435b045f0f1e1b82fc143cf4065a62f
> c7129a331c92cfe0fb1666e6b6887f68
> c8f563c1b1644c958974b6d490bb48b5
> caf103430458509f98a7799e0d0905e4
> caf430d48766ac9f4f205cb96adb0230
> d0b35fcd47c73fcc6883256fa619d57a
> d67e955d29479387b5822e1c812da038
> d77aea9ebaee1bb25a26c7ed38509888
> d7929b778a45be7bf98f1c81369a3633
> d9f773952fdc9a26a5ae7e34a3051a56
> dd316be7b6a10aeeb35f6cf706bc3df4
> ef667e0b714b9faa32e1754c2f4788b7
> fc6190920d1f2df1bff154a105b6b33c
> ff13665fa14d75b5564db275938f7c2e
> _______________________________________________
> Community-sigs mailing list
> Community-sigs at lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/community-sigs
>
> http://www.clamav.net/contact.html#ml
>