Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 14, 2021, 5:18 p.m.	Oct. 14, 2021, 5:21 p.m.

Size	204.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`8777020a37b6797241a489a707b9784b`
SHA256	`8a45d901cab57a1b65c32aea2452f56436dcf01c37bdf7875838e6054f395d90`
CRC32	`034C6AE8`
ssdeep	`1536:tTEDegofhrRAnvzYFBWigYcgkOwijQkwY+EhBKDID:tQeZpR47YeigqVX+SK8`
Yara	PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware IsPE32 - (no description)

vbc.exe "C:\Users\test22\AppData\Local\Temp\vbc.exe"
2220

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 14, 2021, 5:18 p.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

CUSTOM

One or more processes crashed (23 events)

Time & API	Arguments	Status
__exception__ Oct. 14, 2021, 5:18 p.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x773a0000 vbc+0x2de85 @ 0x42de85 exception.instruction_r: cc 02 94 36 a1 ee 89 6b 72 81 04 24 59 5b e7 3e exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x35a14c8 registers.esp: 1635296 registers.edi: 162464 registers.eax: 6321352 registers.ebp: 1635300 registers.edx: 56229888 registers.ebx: 56391401 registers.esi: 180224 registers.ecx: 56234825	1
__exception__ Oct. 14, 2021, 5:18 p.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x773a0000 vbc+0x2de85 @ 0x42de85 exception.instruction_r: cc 0f aa c4 bf 5a 45 e6 99 cc 0f 11 09 81 f7 f1 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x35a1619 registers.esp: 1635296 registers.edi: 162464 registers.eax: 6321352 registers.ebp: 1635300 registers.edx: 56229888 registers.ebx: 56391401 registers.esi: 180224 registers.ecx: 56234825	1
__exception__ Oct. 14, 2021, 5:18 p.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x773a0000 vbc+0x2de85 @ 0x42de85 exception.instruction_r: cc 0f 11 09 81 f7 f1 ff a3 c0 81 f7 68 2c 72 f0 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x35a1622 registers.esp: 1635296 registers.edi: 2582005082 registers.eax: 6321352 registers.ebp: 1635300 registers.edx: 56229888 registers.ebx: 56391401 registers.esi: 180224 registers.ecx: 56234825	1
__exception__ Oct. 14, 2021, 5:18 p.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x773a0000 vbc+0x2de85 @ 0x42de85 exception.instruction_r: cc 07 1c fa 2c 1f e1 15 84 ed d9 9d 68 c0 8e 62 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x35a163f registers.esp: 1635292 registers.edi: 162464 registers.eax: 6321352 registers.ebp: 1635300 registers.edx: 56229888 registers.ebx: 56391401 registers.esi: 180224 registers.ecx: 56234825	1
__exception__ Oct. 14, 2021, 5:18 p.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x773a0000 vbc+0x2de85 @ 0x42de85 exception.instruction_r: cc 19 d5 f3 c9 e0 74 81 89 8a 0e 52 86 fd 1b 41 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x35a165b registers.esp: 1635288 registers.edi: 2496505368 registers.eax: 6321352 registers.ebp: 1635300 registers.edx: 56229888 registers.ebx: 56391401 registers.esi: 180224 registers.ecx: 56234825	1
__exception__ Oct. 14, 2021, 5:18 p.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x773a0000 vbc+0x2de85 @ 0x42de85 exception.instruction_r: cc 18 cf 56 cf 17 69 d2 1a 45 4f e4 ab 0b 98 c8 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x35a1679 registers.esp: 1635288 registers.edi: 4124354220 registers.eax: 6321352 registers.ebp: 1635300 registers.edx: 56229888 registers.ebx: 56391401 registers.esi: 180224 registers.ecx: 56234825	1
__exception__ Oct. 14, 2021, 5:18 p.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x773a0000 vbc+0x2de85 @ 0x42de85 exception.instruction_r: cc 02 14 88 4b 4a 0f cf 4d 53 8b 9d 75 01 00 00 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x35a17f4 registers.esp: 1635280 registers.edi: 162464 registers.eax: 6321352 registers.ebp: 1635300 registers.edx: 56229888 registers.ebx: 20 registers.esi: 180224 registers.ecx: 56234825	1
__exception__ Oct. 14, 2021, 5:18 p.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x773a0000 vbc+0x2de85 @ 0x42de85 exception.instruction_r: cc 0c e6 34 4d 5e c8 68 01 e3 cd 28 68 67 20 b1 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x35a1804 registers.esp: 1635276 registers.edi: 162464 registers.eax: 6321352 registers.ebp: 1635300 registers.edx: 56229888 registers.ebx: 56391401 registers.esi: 180224 registers.ecx: 56234825	1
__exception__ Oct. 14, 2021, 5:18 p.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x773a0000 vbc+0x2de85 @ 0x42de85 exception.instruction_r: cc 19 4e ca 1b 91 6a 3e 63 24 07 d6 5e 40 92 7c exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x35a1815 registers.esp: 1635268 registers.edi: 162464 registers.eax: 6321352 registers.ebp: 1635300 registers.edx: 56229888 registers.ebx: 56391401 registers.esi: 180224 registers.ecx: 56234825	1
__exception__ Oct. 14, 2021, 5:18 p.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x773a0000 vbc+0x2de85 @ 0x42de85 exception.instruction_r: cc 07 13 31 6e 57 0b 51 43 f3 eb c1 81 04 24 8a exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x35a182e registers.esp: 1635268 registers.edi: 162464 registers.eax: 6321352 registers.ebp: 1635300 registers.edx: 56229888 registers.ebx: 56391401 registers.esi: 180224 registers.ecx: 56234825	1
__exception__ Oct. 14, 2021, 5:18 p.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x773a0000 vbc+0x2de85 @ 0x42de85 exception.instruction_r: cc 07 d1 8b 60 69 98 41 16 ff 72 5b 68 24 ab 43 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x35a1971 registers.esp: 1635268 registers.edi: 162464 registers.eax: 6321352 registers.ebp: 1635300 registers.edx: 56229888 registers.ebx: 56391401 registers.esi: 180224 registers.ecx: 56234825	1
__exception__ Oct. 14, 2021, 5:18 p.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x773a0000 vbc+0x2de85 @ 0x42de85 exception.instruction_r: cc 0e 41 bb 85 81 34 24 bc 7b fd 70 81 2c 24 c4 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x35a198e registers.esp: 1635260 registers.edi: 162464 registers.eax: 6321352 registers.ebp: 1635300 registers.edx: 56229888 registers.ebx: 56391401 registers.esi: 180224 registers.ecx: 56234825	1
__exception__ Oct. 14, 2021, 5:18 p.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x773a0000 vbc+0x2de85 @ 0x42de85 exception.instruction_r: cc 1a 11 df bd 9a 55 6e 16 3c 8b 4f 20 b3 6b 23 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x35a19a1 registers.esp: 1635260 registers.edi: 162464 registers.eax: 6321352 registers.ebp: 1635300 registers.edx: 56229888 registers.ebx: 56391401 registers.esi: 180224 registers.ecx: 56234825	1
__exception__ Oct. 14, 2021, 5:18 p.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x773a0000 vbc+0x2de85 @ 0x42de85 exception.instruction_r: cc 06 6d 95 27 f3 a1 da f8 24 dd d1 b0 68 21 e8 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x35a19b7 registers.esp: 1635256 registers.edi: 162464 registers.eax: 6321352 registers.ebp: 1635300 registers.edx: 56229888 registers.ebx: 56391401 registers.esi: 180224 registers.ecx: 56234825	1
__exception__ Oct. 14, 2021, 5:18 p.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x773a0000 vbc+0x2de85 @ 0x42de85 exception.instruction_r: cc 00 b4 e2 d4 ea de 3e 38 1d b8 81 04 24 f8 0e exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x35a19c9 registers.esp: 1635252 registers.edi: 162464 registers.eax: 6321352 registers.ebp: 1635300 registers.edx: 56229888 registers.ebx: 56391401 registers.esi: 180224 registers.ecx: 56234825	1
__exception__ Oct. 14, 2021, 5:18 p.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x773a0000 vbc+0x2de85 @ 0x42de85 exception.instruction_r: cc 02 99 27 b3 06 88 1e d1 68 ab 6e 39 42 89 b5 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x35a19e9 registers.esp: 1635252 registers.edi: 162464 registers.eax: 6321352 registers.ebp: 1635300 registers.edx: 56229888 registers.ebx: 56391401 registers.esi: 180224 registers.ecx: 56234825	1
__exception__ Oct. 14, 2021, 5:18 p.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x773a0000 vbc+0x2de85 @ 0x42de85 exception.instruction_r: cc 01 9d 17 63 53 dc e0 6d 28 8b b5 bf 01 00 00 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x35a1b4a registers.esp: 1635244 registers.edi: 162464 registers.eax: 6321352 registers.ebp: 1635300 registers.edx: 56229888 registers.ebx: 56391401 registers.esi: 11 registers.ecx: 56234825	1
__exception__ Oct. 14, 2021, 5:18 p.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x773a0000 vbc+0x2de85 @ 0x42de85 exception.instruction_r: cc 00 ab 75 a5 25 91 e5 3c aa 49 89 b5 4f 02 00 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x35a1b5f registers.esp: 1635240 registers.edi: 162464 registers.eax: 6321352 registers.ebp: 1635300 registers.edx: 56229888 registers.ebx: 56391401 registers.esi: 180224 registers.ecx: 56234825	1
__exception__ Oct. 14, 2021, 5:18 p.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x773a0000 vbc+0x2de85 @ 0x42de85 exception.instruction_r: cc 0f c7 63 81 ee 67 05 74 75 cc 03 73 bb 53 16 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x35a1b81 registers.esp: 1635240 registers.edi: 162464 registers.eax: 6321352 registers.ebp: 1635300 registers.edx: 56229888 registers.ebx: 56391401 registers.esi: 1970537852 registers.ecx: 56234825	1
__exception__ Oct. 14, 2021, 5:18 p.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x773a0000 vbc+0x2de85 @ 0x42de85 exception.instruction_r: cc 03 73 bb 53 16 a4 a8 56 8b b5 4f 02 00 00 cc exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x35a1b8b registers.esp: 1635240 registers.edi: 162464 registers.eax: 6321352 registers.ebp: 1635300 registers.edx: 56229888 registers.ebx: 56391401 registers.esi: 21 registers.ecx: 56234825	1
__exception__ Oct. 14, 2021, 5:18 p.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x773a0000 vbc+0x2de85 @ 0x42de85 exception.instruction_r: cc 18 d8 00 74 60 de 97 df 91 63 f9 03 4f 47 6e exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x35a1b9a registers.esp: 1635236 registers.edi: 162464 registers.eax: 6321352 registers.ebp: 1635300 registers.edx: 56229888 registers.ebx: 56391401 registers.esi: 180224 registers.ecx: 56234825	1
__exception__ Oct. 14, 2021, 5:18 p.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x773a0000 vbc+0x2de85 @ 0x42de85 exception.instruction_r: cc 0f a2 7e 81 f1 da 01 db 95 51 8b 8d cc 01 00 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x35a1cf2 registers.esp: 1635232 registers.edi: 162464 registers.eax: 6321352 registers.ebp: 1635300 registers.edx: 56229888 registers.ebx: 56391401 registers.esi: 180224 registers.ecx: 2514158038	1
__exception__ Oct. 14, 2021, 5:18 p.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x773a0000 vbc+0x2de85 @ 0x42de85 exception.instruction_r: cc 1b d3 cf 25 ad 45 f4 8f 0d ef ae f9 76 48 b1 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x35a1d03 registers.esp: 1635228 registers.edi: 162464 registers.eax: 6321352 registers.ebp: 1635300 registers.edx: 56229888 registers.ebx: 56391401 registers.esi: 180224 registers.ecx: 56234825	1

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 14, 2021, 5:18 p.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d72000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 14, 2021, 5:18 p.m.	process_identifier: 2220 region_size: 180224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x035a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 14, 2021, 5:18 p.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x005a0000 process_handle: 0xffffffff	1	0	0

File has been identified by 22 AntiVirus engines on VirusTotal as malicious (22 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
FireEye	Generic.mg.8777020a37b67972
McAfee	Artemis!8777020A37B6
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_90% (W)
ESET-NOD32	a variant of Generik.DQTEIJK
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan.Win32.Mucc.tgz
Avast	FileRepMalware
McAfee-GW-Edition	BehavesLike.Win32.Fareit.dt
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
AhnLab-V3	Win-Trojan/VBKrypt.RP.X1764
BitDefenderTheta	Gen:NN.ZevbaCO.34214.mm0@aeTEcEbi
Yandex	Trojan.AvsArher.bTx33N
Ikarus	Trojan.Win32.Crypt
eGambit	Unsafe.AI_Score_99%
AVG	FileRepMalware

vbc.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All