popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

UPX Malicious Library AntiDebug PE File OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 19, 2021, 9:40 a.m. Aug. 19, 2021, 9:43 a.m.
Size 303.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 46b2b8e7621a93ae6b876b071da55212
SHA256 9da4d8126ac0c4c0b68066407e24cf1a36e06f0fc22ef87b0a464f90c1374095
CRC32 419B5532
ssdeep 6144:0zAfLQsyTvBg96hLshzuKd4lNC0wxkBl0:3LITa6SJuwaB
PDB Path C:\xupot-huseziho\rahotinuli\35 puh\70\lapogixoci\lugo\xili.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49204 -> 192.254.185.89:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 192.254.185.89:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 192.254.185.89:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49203 -> 154.92.6.107:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49203 -> 154.92.6.107:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49203 -> 154.92.6.107:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 3.223.115.185:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 3.223.115.185:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 3.223.115.185:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
pdb_path C:\xupot-huseziho\rahotinuli\35 puh\70\lapogixoci\lugo\xili.pdb
resource name None
suspicious_features GET method with no useragent header suspicious_request GET http://www.wang0911.com/otcl/?uzu4=W0aQsAfnZT9K8WsD4i5637X8WoT/2UA8HayUDBPHV5pQR9uMddXCE1ucNEuG5AYfMdvmFofK&OjQl7x=9r74bd4h
suspicious_features GET method with no useragent header suspicious_request GET http://www.fussionpromos.com/otcl/?uzu4=R6pBimEX126Y/7jz26NSIB+pAf+iSCkbIcynLs+ia55rI8fnMgFdof6zFKq4BsG3kSXOUZFo&OjQl7x=9r74bd4h
suspicious_features GET method with no useragent header suspicious_request GET http://www.sxhuanghe.com/otcl/?uzu4=bykNueCGzGef1kTLSC6P98gcCLtJHJm8XaoDN192w2lHtEo2seD5whRxipE3R8Jwf92JqfL+&OjQl7x=9r74bd4h
request GET http://www.wang0911.com/otcl/?uzu4=W0aQsAfnZT9K8WsD4i5637X8WoT/2UA8HayUDBPHV5pQR9uMddXCE1ucNEuG5AYfMdvmFofK&OjQl7x=9r74bd4h
request GET http://www.fussionpromos.com/otcl/?uzu4=R6pBimEX126Y/7jz26NSIB+pAf+iSCkbIcynLs+ia55rI8fnMgFdof6zFKq4BsG3kSXOUZFo&OjQl7x=9r74bd4h
request GET http://www.sxhuanghe.com/otcl/?uzu4=bykNueCGzGef1kTLSC6P98gcCLtJHJm8XaoDN192w2lHtEo2seD5whRxipE3R8Jwf92JqfL+&OjQl7x=9r74bd4h
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2388
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 151552
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02e6d000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2388
region_size: 192512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1772
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00910000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d83b8 size 0x00000468
name RT_STRING language LANG_SERBIAN filetype data sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d8eb0 size 0x0000015e
name RT_STRING language LANG_SERBIAN filetype data sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d8eb0 size 0x0000015e
name RT_STRING language LANG_SERBIAN filetype data sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d8eb0 size 0x0000015e
name RT_STRING language LANG_SERBIAN filetype data sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d8eb0 size 0x0000015e
name RT_ACCELERATOR language LANG_SERBIAN filetype data sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d88d0 size 0x00000028
name RT_ACCELERATOR language LANG_SERBIAN filetype data sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d88d0 size 0x00000028
name RT_ACCELERATOR language LANG_SERBIAN filetype data sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d88d0 size 0x00000028
name RT_ACCELERATOR language LANG_SERBIAN filetype data sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d88d0 size 0x00000028
section {u'size_of_data': u'0x0002f800', u'virtual_address': u'0x00001000', u'entropy': 7.885783762230105, u'name': u'.text', u'virtual_size': u'0x0002f6d0'} entropy 7.88578376223 description A section with a high entropy has been found
entropy 0.630182421227 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1772
region_size: 188416
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000080
1 0 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 1772
process_handle: 0x00000080
1 1 0
Process injection Process 2388 called NtSetContextThread to modify thread in remote process 1772
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1638384
registers.edi: 0
registers.eax: 4320080
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000007c
process_identifier: 1772
1 0 0
Process injection Process 2388 resumed a thread in remote process 1772
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000007c
suspend_count: 1
process_identifier: 1772
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 1824
thread_handle: 0x0000007c
process_identifier: 1772
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\vbc.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000080
1 1 0

NtGetContextThread

 thread_handle: 0x0000007c
1 0 0

NtUnmapViewOfSection

 base_address: 0x00400000
region_size: 4096
process_identifier: 1772
process_handle: 0x00000080
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1772
region_size: 188416
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000080
1 0 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 1772
process_handle: 0x00000080
1 1 0

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1638384
registers.edi: 0
registers.eax: 4320080
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000007c
process_identifier: 1772
1 0 0

NtResumeThread

 thread_handle: 0x0000007c
suspend_count: 1
process_identifier: 1772
1 0 0
Lionic Trojan.Win32.Noon.l!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.46813067
FireEye Generic.mg.46b2b8e7621a93ae
McAfee Packed-GDT!46B2B8E7621A
Malwarebytes Trojan.MalPack.GS
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 0056f9be1 )
Alibaba Trojan:Win32/runner.ali1000123
K7GW Trojan ( 0056f9be1 )
Cybereason malicious.1e0eb6
Arcabit Trojan.Generic.D2CA4F8B
Cyren W32/Kryptik.EWJ.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Kryptik.HMCU
APEX Malicious
Paloalto generic.ml
ClamAV Win.Malware.Generic-9886591-0
Kaspersky HEUR:Trojan-Ransom.Win32.Blocker.gen
BitDefender Trojan.GenericKD.46813067
Avast FileRepMetagen [Malware]
Tencent Win32.Trojan.Inject.Auto
Ad-Aware Trojan.GenericKD.46813067
Emsisoft Trojan.Agent (A)
TrendMicro Mal_HPGen-50
McAfee-GW-Edition BehavesLike.Win32.Generic.fc
Sophos Mal/Generic-S
Ikarus Trojan.Crypt
eGambit Unsafe.AI_Score_71%
Gridinsoft Ransom.Win32.STOP.ko!se37341
Microsoft Ransom:Win32/StopCrypt.MPK!MTB
GData Trojan.GenericKD.46813067
Cynet Malicious (score: 100)
AhnLab-V3 CoinMiner/Win.Glupteba.R437681
Acronis suspicious
BitDefenderTheta Gen:NN.ZexaF.34088.sq1@amDvdhpG
MAX malware (ai score=86)
VBA32 BScope.TrojanRansom.Blocker
TrendMicro-HouseCall Mal_HPGen-50
Rising Trojan.Kryptik!1.D82C (CLASSIC)
SentinelOne Static AI - Suspicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/GenKryptik.FJBW!tr
AVG FileRepMetagen [Malware]
CrowdStrike win/malicious_confidence_100% (W)
Qihoo-360 Win32/Heur.Generic.HwoCUugA