Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
11.15 01:11
wwbizsrvs.exe
11.15 01:11
op.exe
11.15 01:11
msf.exe
11.15 01:11
lum250.exe
11.15 01:11
msf443.exe
11.13 04:11
hello.exe
11.13 03:11
espsemhvcioff.exe
11.13 02:11
Geek_se.exe
11.13 02:11
cred64.dll
11.13 02:11
svhost.exe

Latest News
11.17 07:11
IT Sicherheitsnews stü...
11.17 07:11
IT Sicherheitsnews stü...
11.17 06:11
Classic LED Bubble Dis...
11.17 06:11
DIN-Download: Neue Vor...
11.17 06:11
IT Sicherheitsnews stü...
11.17 05:11
[AIS 2024 영상] 최원혁 누리랩 ...
11.17 05:11
[강연 영상] 김직동 개인정보위 과장 “...
11.17 05:11
Diese KI-Oma soll Betr...
11.17 05:11
ChatGPT knackt Rekord:...
11.17 05:11
Ancient TP-Link Backdo...

Summary | ZeroBOX

vbc.exe

UPX PE32 PE File

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 23, 2021, 5:15 p.m.	Sept. 23, 2021, 5:24 p.m.

Size	116.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`ccb092ded62c0a7ce793daa1873db0cb`
SHA256	`abc97d710760f9449d691364d7ab0a7c3185f868625b8f05a8ab8facdebe54f1`
CRC32	`D7822291`
ssdeep	`1536:Zm+Fp/INAWumDNEoQ3AOoJtski0suyF/hz8Gi+u3IBZ:ZhvWf+R3ATB8W+u3OZ`
Yara	UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE32 - (no description)

vbc.exe "C:\Users\test22\AppData\Local\Temp\vbc.exe"
2504

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 23, 2021, 5:15 p.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

CUSTOM

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 23, 2021, 5:15 p.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f92000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Sept. 23, 2021, 5:15 p.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74013000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Sept. 23, 2021, 5:15 p.m.	process_identifier: 2504 region_size: 73728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x031c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Foreign language identified in PE resource (1 event)

name

RT_VERSION

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_TRADITIONAL

offset

0x0001b260

size

0x000002ec

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 23, 2021, 5:15 p.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x003f0000 process_handle: 0xffffffff	1	0	0

File has been identified by 11 AntiVirus engines on VirusTotal as malicious (11 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.194f1a
APEX	Malicious
SentinelOne	Static AI - Suspicious PE
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Win-Trojan/VBKrand.Gen
BitDefenderTheta	Gen:NN.ZevbaCO.34170.hm0@aeMJNImj