popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 July 30, 2021, 10:57 a.m. July 30, 2021, 11:05 a.m.
Size 132.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c85ee9fe0a4d346432307651cb4357a1
SHA256 b9677a659f448378a905926188cf5bb05937016d65ad16cf1210817e909324f0
CRC32 E0A2E460
ssdeep 1536:pfm9nt/fJxs+BBBBBBBBBBBNQ6pAqnxoJpqQXRm8WSPHPKh22JCFEHmqpxGoEoQO:Knt/RxpYqnxcpqH8n5qaC/xtTys/Dn
Yara
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 504
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73fd2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 504
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73ad3000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 504
region_size: 57344
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03970000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 504
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 24576
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x00470000
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00018000', u'virtual_address': u'0x00001000', u'entropy': 7.039016666267513, u'name': u'.text', u'virtual_size': u'0x000173fc'} entropy 7.03901666627 description A section with a high entropy has been found
entropy 0.75 description Overall entropy of this PE file is high
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
FireEye Generic.mg.c85ee9fe0a4d3464
McAfee Artemis!C85EE9FE0A4D
Sangfor Trojan.Win32.Save.a
Cyren W32/VBKrypt.AXS.gen!Eldorado
Symantec Packed.Generic.575
ESET-NOD32 a variant of Win32/Injector.EPVN
APEX Malicious
Kaspersky Trojan.Win32.Vebzenpak.agdc
Avast Win32:Trojan-gen
McAfee-GW-Edition BehavesLike.Win32.Generic.ch
Sophos ML/PE-A
Microsoft Program:Win32/Wacapew.C!ml
Yandex Trojan.GenAsa!5wnZ8amFQDs
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_99%
BitDefenderTheta Gen:NN.ZevbaF.34050.im0@ayhPhYaG
AVG Win32:Trojan-gen
CrowdStrike win/malicious_confidence_60% (W)
Qihoo-360 Win32/Trojan.Vebzenpak.HwMA4iQA