popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

UPX Malicious Library OS Processor Check PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 23, 2021, 10:01 a.m. Oct. 23, 2021, 10:09 a.m.
Size 350.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 940fb7ef71682b6110d7c2d37a92f5df
SHA256 c87415b188828e354d7f87edc4184c94adb757258e79ab5e1e6e200a8c8df52c
CRC32 BD5D3F0D
ssdeep 6144:n7+kn6p2xtxqlkFx6MPLYp7q9LwvzIn+fPlkFQob7aLaArbEk0vJtEW:7+k6c1qK2kY7btABbmHbVIJtE
PDB Path C:\liviboy\suxisifibeho.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\liviboy\suxisifibeho.pdb
resource name XASOBEZEHAMUHEYENEXUT
resource name None
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 135168
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a3a000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00300000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x0004bc00', u'virtual_address': u'0x00001000', u'entropy': 7.29329186648083, u'name': u'.text', u'virtual_size': u'0x0004ba9e'} entropy 7.29329186648 description A section with a high entropy has been found
entropy 0.868194842407 description Overall entropy of this PE file is high
Lionic Trojan.Multi.Generic.4!c
Elastic malicious (high confidence)
FireEye Generic.mg.940fb7ef71682b61
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
Cybereason malicious.b1d1db
Baidu Win32.Trojan.Kryptik.jm
Cyren W32/Kryptik.FOO.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/GenKryptik.FMKI
APEX Malicious
Paloalto generic.ml
Kaspersky UDS:DangerousObject.Multi.Generic
Sophos ML/PE-A
McAfee-GW-Edition Packed-GDT!940FB7EF7168
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Cynet Malicious (score: 100)
Acronis suspicious
McAfee Packed-GDT!940FB7EF7168
Malwarebytes Trojan.MalPack.GS
TrendMicro-HouseCall TROJ_GEN.R002H06JM21
Rising Trojan.Kryptik!1.D9FE (CLASSIC)
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Packed.GDT!tr
CrowdStrike win/malicious_confidence_100% (W)