popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

Gen1 Generic Malware Malicious Library UPX Malicious Packer PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 19, 2021, 9:43 a.m. Oct. 19, 2021, 9:55 a.m.
Size 584.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 bf6bcbda23200e2bb0b6acc4fd744ad5
SHA256 466f914dcfe4bd5ca22f2748ccc4effeb03378c7cf7f9a089de910311176e1bb
CRC32 C94853AE
ssdeep 12288:hEYDoAU/U3AVE2gNrY9iH8+1YMfZlAAeG7a42:2YkAU/6AVE2Urp8+1dZV90
Yara
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
resource name DATA
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72d72000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1896
region_size: 73728
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00660000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 24576
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x00380000
process_handle: 0xffffffff
1 0 0
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Heur.PonyStealer.Km0@dS9JGwgi
FireEye Generic.mg.bf6bcbda23200e2b
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
Arcabit Trojan.PonyStealer.E8C0FE
BitDefenderTheta Gen:NN.ZevbaF.34218.Km0@aS9JGwgi
APEX Malicious
Paloalto generic.ml
ClamAV Win.Trojan.Remcos-9753190-0
BitDefender Gen:Heur.PonyStealer.Km0@dS9JGwgi
Ad-Aware Gen:Heur.PonyStealer.Km0@dS9JGwgi
McAfee-GW-Edition BehavesLike.Win32.Fareit.hh
Emsisoft Gen:Heur.PonyStealer.Km0@dS9JGwgi (B)
SentinelOne Static AI - Malicious PE
MAX malware (ai score=86)
Microsoft Backdoor:Win32/Remcos.GA!MTB
GData Gen:Heur.PonyStealer.Km0@dS9JGwgi
Cynet Malicious (score: 100)
ALYac Gen:Heur.PonyStealer.Km0@dS9JGwgi
Malwarebytes Malware.AI.327962661
Rising Backdoor.Remcos!1.B6A7 (CLASSIC)
eGambit Unsafe.AI_Score_100%