popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

.vbc.exe

NSIS Malicious Library UPX PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 2, 2021, 11:35 a.m. Nov. 2, 2021, 11:44 a.m.
Size 395.8KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 6117ec91b644303e86e5a9db8c6d9eea
SHA256 413877dde2cff56ab605f7019e65ae9b8ca78fc9715e359d0838befa01a9ca3e
CRC32 F10A3D00
ssdeep 6144:pBlL/C4pLgMecZKoe3Ea9HF47+MWMzC/QKkhWl4PCUbbhe/xLQo:PXBXrZ63EwmJjzChtiXVsRQo
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • NSIS_Installer - Null Soft Installer

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bf6000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nsn8BC6.tmp\mvlgjfqt.dll
file C:\Users\test22\AppData\Local\Temp\nsn8BC6.tmp\mvlgjfqt.dll
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2404
region_size: 1392640
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x001f0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000218
1 0 0
Process injection Process 2316 created a remote thread in non-child process 2404
Time & API Arguments Status Return Repeated

CreateRemoteThread

 thread_identifier: 0
process_identifier: 2404
function_address: 0x001f5ce2
flags: 4
stack_size: 0
parameter: 0x00000000
process_handle: 0x00000218
1 544 0
Process injection Process 2316 manipulating memory of non-child process 2404
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2404
region_size: 1392640
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x001f0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000218
1 0 0
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.NSISX.Spy.Gen.1
FireEye Generic.mg.6117ec91b644303e
Cybereason malicious.1b6443
Cyren W32/Injector.AMK.gen!Eldorado
Symantec Packed.Generic.606
APEX Malicious
Paloalto generic.ml
BitDefender Trojan.NSISX.Spy.Gen.1
Emsisoft Trojan.NSISX.Spy.Gen.1 (B)
McAfee-GW-Edition BehavesLike.Win32.Generic.fc
Ikarus Trojan.NSIS.Agent.S
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Arcabit Trojan.NSISX.Spy.Gen.1
GData Zum.Androm.1
Cynet Malicious (score: 100)
MAX malware (ai score=86)
Malwarebytes Trojan.Injector
SentinelOne Static AI - Malicious PE
Fortinet W32/Injector.EOLV!tr