popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

Malicious Library OS Processor Check PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 5, 2021, 9:52 a.m. Oct. 5, 2021, 10:01 a.m.
Size 286.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 cb1aa8895db7b5598823e583102f9fc6
SHA256 7986de346479a9d3203949e22f990d9e8fadf86b7cdcf573ff9a2da2d7d9867c
CRC32 2DF1C869
ssdeep 6144:KQx21wWMsvXOWHDNVHz5buM7+ROhxxpeTr/ekI:D21wWMs2YjFuKrzxp6L
PDB Path C:\tipirupe_tazixalufo.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\tipirupe_tazixalufo.pdb
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 61440
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005b4000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 110592
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00380000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00022c00', u'virtual_address': u'0x00001000', u'entropy': 7.490612791432983, u'name': u'.text', u'virtual_size': u'0x00022b80'} entropy 7.49061279143 description A section with a high entropy has been found
entropy 0.487719298246 description Overall entropy of this PE file is high
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
FireEye Generic.mg.cb1aa8895db7b559
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
Cybereason malicious.1985b4
BitDefenderTheta Gen:NN.ZexaF.34170.rq0@a855u2ci
Cyren W32/Kryptik.EWJ.gen!Eldorado
Symantec ML.Attribute.HighConfidence
APEX Malicious
Kaspersky VHO:Trojan-PSW.Win32.Convagent.gen
Rising Trojan.Generic@ML.100 (RDML:Qe4FKt56BVGlR8JwXvmDAQ)
McAfee-GW-Edition BehavesLike.Win32.MultiPlug.dh
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_99%
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Cynet Malicious (score: 100)
Acronis suspicious
Ikarus Trojan-Banker.UrSnif
CrowdStrike win/malicious_confidence_100% (W)