Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 30, 2021, 3:03 p.m.	July 30, 2021, 3:06 p.m.

Size	132.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`c85ee9fe0a4d346432307651cb4357a1`
SHA256	`b9677a659f448378a905926188cf5bb05937016d65ad16cf1210817e909324f0`
CRC32	`E0A2E460`
ssdeep	`1536:pfm9nt/fJxs+BBBBBBBBBBBNQ6pAqnxoJpqQXRm8WSPHPKh22JCFEHmqpxGoEoQO:Knt/RxpYqnxcpqH8n5qaC/xtTys/Dn`
Yara	IsPE32 - (no description) PE_Header_Zero - PE File Signature CryptBot_IN - CryptBot

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

No Suricata Alerts

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 30, 2021, 3:03 p.m.		1	1	0

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 30, 2021, 3:03 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d72000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 30, 2021, 3:03 p.m.	process_identifier: 112 region_size: 57344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 30, 2021, 3:03 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x004d0000 process_handle: 0xffffffff	1	0	0

section

{u'size_of_data': u'0x00018000', u'virtual_address': u'0x00001000', u'entropy': 7.039016666267513, u'name': u'.text', u'virtual_size': u'0x000173fc'}

entropy

7.03901666627

description

A section with a high entropy has been found

entropy

0.75

description

Overall entropy of this PE file is high

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
FireEye	Generic.mg.c85ee9fe0a4d3464
McAfee	Artemis!C85EE9FE0A4D
Sangfor	Trojan.Win32.Save.a
Cyren	W32/VBKrypt.AXS.gen!Eldorado
Symantec	Packed.Generic.575
ESET-NOD32	a variant of Win32/Injector.EPVN
APEX	Malicious
Kaspersky	Trojan.Win32.Vebzenpak.agdc
Avast	Win32:Trojan-gen
McAfee-GW-Edition	BehavesLike.Win32.Generic.ch
Sophos	ML/PE-A
Microsoft	Program:Win32/Wacapew.C!ml
Yandex	Trojan.GenAsa!5wnZ8amFQDs
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_99%
BitDefenderTheta	Gen:NN.ZevbaF.34050.im0@ayhPhYaG
AVG	Win32:Trojan-gen
CrowdStrike	win/malicious_confidence_60% (W)
Qihoo-360	Win32/Trojan.Vebzenpak.HwMA4iQA

vbc.exe