popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 18, 2021, 7:45 a.m. Nov. 18, 2021, 8:20 a.m.
Size 328.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 803403abfa57194087a7f744cfc4ab3c
SHA256 b71a6afd4af1487d2aa52a5eb6dd25a09eb3055ad5615708d4ee7a0b69aae65f
CRC32 C8D49589
ssdeep 6144:AkEGG6ycLfiu2DeSg6bNAJIZMVfwofDqnS3XqNDMgDGHipIRHf:AsFyrCb1WnS3XqNvDs8Qf
PDB Path C:\gosederu_hi.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\gosederu_hi.pdb
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 65536
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02bfc000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2768
region_size: 110592
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00320000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00037e00', u'virtual_address': u'0x00001000', u'entropy': 6.961980923158319, u'name': u'.text', u'virtual_size': u'0x00037caa'} entropy 6.96198092316 description A section with a high entropy has been found
entropy 0.683486238532 description Overall entropy of this PE file is high
Bkav W32.AIDetect.malware2
Lionic Trojan.Win32.Generic.lCNY
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
Cylance Unsafe
Cybereason malicious.9ed7ac
Cyren W32/Kryptik.FQI.gen!Eldorado
Symantec Packed.Generic.620
ESET-NOD32 a variant of Win32/Kryptik.HNIK
TrendMicro-HouseCall TROJ_GEN.R002H0CKG21
Paloalto generic.ml
Kaspersky UDS:Backdoor.Win32.Androm.gen
Rising Trojan.Generic@ML.88 (RDML:0SdusFKdF/fPVPwSs/akZw)
FireEye Generic.mg.803403abfa571940
Ikarus Win32.Outbreak
MaxSecure Trojan.Malware.300983.susgen
Kingsoft Win32.Hack.Undef.(kcloud)
GData Win32.Trojan.BSE.WS9D4D
AhnLab-V3 CoinMiner/Win.Glupteba.R450374
Acronis suspicious
VBA32 BScope.Backdoor.Agent
Malwarebytes Trojan.MalPack.GS
APEX Malicious
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_98%
Fortinet W32/GenKryptik.FNOK!tr
CrowdStrike win/malicious_confidence_100% (W)