popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

NSIS Malicious Library PE32 PE File DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 19, 2021, 10:40 a.m. Sept. 19, 2021, 10:55 a.m.
Size 255.4KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 de8a80136d8b6c2002ba8473bda2a617
SHA256 4e18d364c4fa2db105557cf8105e5e3d77c9d7a06590b4f897051f99014da5be
CRC32 2D22D48C
ssdeep 6144:x8LxBggmjyU9avHM2nVm+cTc0xvklLAFj:zv1avsRo0xvkEj
Yara
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • NSIS_Installer - Null Soft Installer

Name Response Post-Analysis Lookup
www.comprarmiaspiradora.com
A 91.195.240.13
91.195.240.13
www.maximumsale.com
CNAME HDRedirect-LB7-5a03e1c2772e1c9c.elb.us-east-1.amazonaws.com
A 3.223.115.185
3.223.115.185
www.mygaybookcase.com
CNAME ghs.googlehosted.com
A 142.250.204.147
172.217.25.83
www.meetheveganz.com
www.banban365.net
A 34.98.99.30
CNAME banban365.net
34.98.99.30
www.findingforeverrealty.com
A 52.71.133.130
52.71.133.130
www.norfolkveggiebox.com
A 94.136.40.51
94.136.40.51
www.helpmovingandstorage.com
A 209.15.40.102
CNAME helpmovingandstorage.com
209.15.40.102
www.cabalzi.com
A 34.98.99.30
CNAME cabalzi.com
34.98.99.30
www.erinkiauq.icu
www.asteroid.finance
A 198.54.117.218
A 198.54.117.216
A 198.54.117.217
CNAME parkingpage.namecheap.com
A 198.54.117.215
A 198.54.117.212
A 198.54.117.210
A 198.54.117.211
198.54.117.210
www.id-ers.com
CNAME id-ers.com
A 34.102.136.180
34.102.136.180
www.e38.site
A 18.213.250.117
A 52.4.209.250
A 18.215.128.143
18.215.128.143
www.rishitaprabhu.com
A 31.170.161.30
CNAME rishitaprabhu.com
31.170.161.30
www.breathlessandinlove.com
A 172.67.155.190
A 104.21.40.174
172.67.155.190
IP Address Status Action
104.21.48.37 Active Moloch
104.21.40.174 Active Moloch
142.250.204.147 Active Moloch
164.124.101.2 Active Moloch
18.213.250.117 Active Moloch
198.54.117.212 Active Moloch
209.15.40.102 Active Moloch
3.223.115.185 Active Moloch
31.170.161.30 Active Moloch
34.102.136.180 Active Moloch
34.98.99.30 Active Moloch
52.71.133.130 Active Moloch
91.195.240.13 Active Moloch
94.136.40.51 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49223 -> 142.250.204.147:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49223 -> 142.250.204.147:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49223 -> 142.250.204.147:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49225 -> 91.195.240.13:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49225 -> 91.195.240.13:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49225 -> 91.195.240.13:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
UDP 192.168.56.101:62430 -> 164.124.101.2:53 2026888 ET INFO DNS Query for Suspicious .icu Domain Potentially Bad Traffic
TCP 192.168.56.101:49229 -> 104.21.40.174:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49229 -> 104.21.40.174:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49229 -> 104.21.40.174:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49209 -> 52.71.133.130:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49209 -> 52.71.133.130:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49209 -> 52.71.133.130:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 94.136.40.51:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 198.54.117.212:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 94.136.40.51:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 198.54.117.212:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 94.136.40.51:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 198.54.117.212:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49227 -> 18.213.250.117:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49227 -> 18.213.250.117:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49227 -> 18.213.250.117:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 34.98.99.30:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 34.98.99.30:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 34.98.99.30:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49233 -> 94.136.40.51:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49233 -> 94.136.40.51:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49233 -> 94.136.40.51:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 209.15.40.102:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 209.15.40.102:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 209.15.40.102:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49219 -> 34.98.99.30:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49219 -> 34.98.99.30:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49219 -> 34.98.99.30:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49231 -> 3.223.115.185:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49231 -> 3.223.115.185:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49231 -> 3.223.115.185:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49235 -> 34.98.99.30:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49235 -> 34.98.99.30:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49235 -> 34.98.99.30:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49221 -> 31.170.161.30:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49221 -> 31.170.161.30:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49221 -> 31.170.161.30:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.norfolkveggiebox.com/b6a4/?p0G=1/oriW/wBBMvnVsB6SWy9Yw+vFbi5sAE6aUu3YgJfO8ImsDD+rtOiN3CEmMRA2XQUKRL61LS&uFNl=XP7LsfJxpBQ
suspicious_features GET method with no useragent header suspicious_request GET http://www.banban365.net/b6a4/?p0G=LB4TDSoOcfLfP6WEu4Xi7VJHqpSLlQ19KfcRHvNI1E0BJW4Tj/37f9F/v3DaWRHlsfthhSdO&uFNl=XP7LsfJxpBQ
suspicious_features GET method with no useragent header suspicious_request GET http://www.findingforeverrealty.com/b6a4/?p0G=PInLHBo1X2HDarmW4cmF2pBaWgvKn6miM8cLM6v9Qr8JSOd47ujhG3xH1L1lq6pkSFupWod4&uFNl=XP7LsfJxpBQ
suspicious_features GET method with no useragent header suspicious_request GET http://www.helpmovingandstorage.com/b6a4/?p0G=WCQPk6OV774AQmQZK5qr8VSUgSKsV6/gws8DuEwnniOEFY0oNuiFQFr5fT8XTvC//aYnyiLC&uFNl=XP7LsfJxpBQ
suspicious_features GET method with no useragent header suspicious_request GET http://www.asteroid.finance/b6a4/?p0G=qLtgNToSswb6CMFxrgf7fmc+nXqwhZnGR9zX0c9pvpxyA4sUtmU5qGoaAQCzoAft52FbUOHw&uFNl=XP7LsfJxpBQ
suspicious_features GET method with no useragent header suspicious_request GET http://www.id-ers.com/b6a4/?p0G=uH6EfKcepLhoITy038beys+pLFYYfex5cK/VvJ23mqODSQImeIcr0rdBhl7AYUs9qsPgSB01&uFNl=XP7LsfJxpBQ
suspicious_features GET method with no useragent header suspicious_request GET http://www.cabalzi.com/b6a4/?p0G=vCEfkciNsJLnQ6NTKgmnH0RKiXqKx4X1OsBfXMLmCHhcM6UjpXRp9mu9MO0KT8GS97XSNDdh&uFNl=XP7LsfJxpBQ
suspicious_features GET method with no useragent header suspicious_request GET http://www.rishitaprabhu.com/b6a4/?p0G=mXEWyNYhUxX28+1G/UM2VRAPihtF3WypxWTWJzN08wDEoA83vp8VPi/S1EIUDaTCIrurvPIx&uFNl=XP7LsfJxpBQ
suspicious_features GET method with no useragent header suspicious_request GET http://www.mygaybookcase.com/b6a4/?p0G=te2h0gcaE7p6i9wQxEk3TsaN/6gLiAYto4hyl6TRVV4kVjpqQnGMO7vaMYfNjjEPzzX2jHXy&uFNl=XP7LsfJxpBQ
suspicious_features GET method with no useragent header suspicious_request GET http://www.comprarmiaspiradora.com/b6a4/?p0G=NgL62OvvJT139jumkr6yKdEzBj23Q8ZPX7pdh2JMf40EvGh1dAmibAZdYhuMGcMjCZsKMW8b&uFNl=XP7LsfJxpBQ
suspicious_features GET method with no useragent header suspicious_request GET http://www.e38.site/b6a4/?p0G=PYLlb9PqAnilyjTS8SDYyANzlEUh7Z5+yycE2LHFHltN8HlXGx/7Jd/QXNbEbwQsu4dLQl47&uFNl=XP7LsfJxpBQ
suspicious_features GET method with no useragent header suspicious_request GET http://www.breathlessandinlove.com/b6a4/?p0G=L3jTl+qjmOLob/hwsT1R5L1wPHeQgqAvmmPpKYZw/Tvlatm9T0OvxocvGkGBA0MAck/qyoGi&uFNl=XP7LsfJxpBQ
suspicious_features GET method with no useragent header suspicious_request GET http://www.maximumsale.com/b6a4/?p0G=jUXSBmmEOkRVD/snHUZVGd++nKvIB5C3Qlbp0N4c/DnjLwT5QCEf4v32ZuriMDGEoBVryIv8&uFNl=XP7LsfJxpBQ
request POST http://www.norfolkveggiebox.com/b6a4/
request GET http://www.norfolkveggiebox.com/b6a4/?p0G=1/oriW/wBBMvnVsB6SWy9Yw+vFbi5sAE6aUu3YgJfO8ImsDD+rtOiN3CEmMRA2XQUKRL61LS&uFNl=XP7LsfJxpBQ
request POST http://www.banban365.net/b6a4/
request GET http://www.banban365.net/b6a4/?p0G=LB4TDSoOcfLfP6WEu4Xi7VJHqpSLlQ19KfcRHvNI1E0BJW4Tj/37f9F/v3DaWRHlsfthhSdO&uFNl=XP7LsfJxpBQ
request POST http://www.findingforeverrealty.com/b6a4/
request GET http://www.findingforeverrealty.com/b6a4/?p0G=PInLHBo1X2HDarmW4cmF2pBaWgvKn6miM8cLM6v9Qr8JSOd47ujhG3xH1L1lq6pkSFupWod4&uFNl=XP7LsfJxpBQ
request POST http://www.helpmovingandstorage.com/b6a4/
request GET http://www.helpmovingandstorage.com/b6a4/?p0G=WCQPk6OV774AQmQZK5qr8VSUgSKsV6/gws8DuEwnniOEFY0oNuiFQFr5fT8XTvC//aYnyiLC&uFNl=XP7LsfJxpBQ
request POST http://www.asteroid.finance/b6a4/
request GET http://www.asteroid.finance/b6a4/?p0G=qLtgNToSswb6CMFxrgf7fmc+nXqwhZnGR9zX0c9pvpxyA4sUtmU5qGoaAQCzoAft52FbUOHw&uFNl=XP7LsfJxpBQ
request POST http://www.id-ers.com/b6a4/
request GET http://www.id-ers.com/b6a4/?p0G=uH6EfKcepLhoITy038beys+pLFYYfex5cK/VvJ23mqODSQImeIcr0rdBhl7AYUs9qsPgSB01&uFNl=XP7LsfJxpBQ
request POST http://www.cabalzi.com/b6a4/
request GET http://www.cabalzi.com/b6a4/?p0G=vCEfkciNsJLnQ6NTKgmnH0RKiXqKx4X1OsBfXMLmCHhcM6UjpXRp9mu9MO0KT8GS97XSNDdh&uFNl=XP7LsfJxpBQ
request POST http://www.rishitaprabhu.com/b6a4/
request GET http://www.rishitaprabhu.com/b6a4/?p0G=mXEWyNYhUxX28+1G/UM2VRAPihtF3WypxWTWJzN08wDEoA83vp8VPi/S1EIUDaTCIrurvPIx&uFNl=XP7LsfJxpBQ
request POST http://www.mygaybookcase.com/b6a4/
request GET http://www.mygaybookcase.com/b6a4/?p0G=te2h0gcaE7p6i9wQxEk3TsaN/6gLiAYto4hyl6TRVV4kVjpqQnGMO7vaMYfNjjEPzzX2jHXy&uFNl=XP7LsfJxpBQ
request POST http://www.comprarmiaspiradora.com/b6a4/
request GET http://www.comprarmiaspiradora.com/b6a4/?p0G=NgL62OvvJT139jumkr6yKdEzBj23Q8ZPX7pdh2JMf40EvGh1dAmibAZdYhuMGcMjCZsKMW8b&uFNl=XP7LsfJxpBQ
request POST http://www.e38.site/b6a4/
request GET http://www.e38.site/b6a4/?p0G=PYLlb9PqAnilyjTS8SDYyANzlEUh7Z5+yycE2LHFHltN8HlXGx/7Jd/QXNbEbwQsu4dLQl47&uFNl=XP7LsfJxpBQ
request POST http://www.breathlessandinlove.com/b6a4/
request GET http://www.breathlessandinlove.com/b6a4/?p0G=L3jTl+qjmOLob/hwsT1R5L1wPHeQgqAvmmPpKYZw/Tvlatm9T0OvxocvGkGBA0MAck/qyoGi&uFNl=XP7LsfJxpBQ
request POST http://www.maximumsale.com/b6a4/
request GET http://www.maximumsale.com/b6a4/?p0G=jUXSBmmEOkRVD/snHUZVGd++nKvIB5C3Qlbp0N4c/DnjLwT5QCEf4v32ZuriMDGEoBVryIv8&uFNl=XP7LsfJxpBQ
request POST http://www.norfolkveggiebox.com/b6a4/
request POST http://www.banban365.net/b6a4/
request POST http://www.findingforeverrealty.com/b6a4/
request POST http://www.helpmovingandstorage.com/b6a4/
request POST http://www.asteroid.finance/b6a4/
request POST http://www.id-ers.com/b6a4/
request POST http://www.cabalzi.com/b6a4/
request POST http://www.rishitaprabhu.com/b6a4/
request POST http://www.mygaybookcase.com/b6a4/
request POST http://www.comprarmiaspiradora.com/b6a4/
request POST http://www.e38.site/b6a4/
request POST http://www.breathlessandinlove.com/b6a4/
request POST http://www.maximumsale.com/b6a4/
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2972
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x728d2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2972
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 12288
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73794000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1556
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00900000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nsh6200.tmp\tkxaz.dll
file C:\Users\test22\AppData\Local\Temp\nsh6200.tmp\tkxaz.dll
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
host 104.21.48.37
Process injection Process 2972 called NtSetContextThread to modify thread in remote process 1556
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1638384
registers.edi: 0
registers.eax: 4313264
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000218
process_identifier: 1556
1 0 0
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.NSISX.Spy.Gen.2
Cylance Unsafe
Sangfor Suspicious.Win32.Save.a
Cybereason malicious.36d8b6
Arcabit Trojan.NSISX.Spy.Gen.2
Cyren W32/Injector.ALI.gen!Eldorado
Symantec Packed.Generic.606
ESET-NOD32 a variant of Win32/Injector.EQCV
Paloalto generic.ml
Kaspersky UDS:Trojan-Spy.Win32.Noon.gen
BitDefender Trojan.NSISX.Spy.Gen.2
Avast NSIS:PWSX-gen [Trj]
Sophos Generic ML PUA (PUA)
DrWeb Trojan.Packed2.43408
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.de8a80136d8b6c20
Emsisoft Trojan.NSISX.Spy.Gen.2 (B)
APEX Malicious
MAX malware (ai score=85)
Microsoft Trojan:Win32/Sabsik.TE.B!ml
GData Zum.Androm.1
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Nsis.C4371168
Tencent Win32.Trojan.Inject.Auto
Fortinet W32/Swotter.LQZI!tr
AVG NSIS:PWSX-gen [Trj]