Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 27, 2022, 8:58 a.m.	July 27, 2022, 9:08 a.m.

Size	1.0MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`111a90a2e621eca70ea6eaf203a442ef`
SHA256	`1cad6ac7f1a52dabece616a63040cc6e1b191461ce96caaef87a846de6c8ead4`
CRC32	`7D4C3E32`
ssdeep	`12288:KQYOpw4UZvaVJ9ZzxUaeiGJ8Iy2TiGrSa0iudFFM5ZWOSeAKwid9SDhpQy1ZarD8:Vw4UZvybcv8vE0LrGq7mSnx1MH`
Yara	IsPE32 - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature

vbc.exe "C:\Users\test22\AppData\Local\Temp\vbc.exe"
2804

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 27, 2022, 8:58 a.m.			0	0
IsDebuggerPresent July 27, 2022, 8:58 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 27, 2022, 8:58 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (10 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 27, 2022, 8:58 a.m.	process_identifier: 2804 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 27, 2022, 8:58 a.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 27, 2022, 8:58 a.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 27, 2022, 8:58 a.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 27, 2022, 8:58 a.m.	process_identifier: 2804 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00600000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 27, 2022, 8:58 a.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 27, 2022, 8:58 a.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00392000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 27, 2022, 8:58 a.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 27, 2022, 8:58 a.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 27, 2022, 8:58 a.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000ec200', u'virtual_address': u'0x00002000', u'entropy': 7.727280363721292, u'name': u'.text', u'virtual_size': u'0x000ec184'}

entropy

7.72728036372

description

A section with a high entropy has been found

entropy

0.893566698202

description

Overall entropy of this PE file is high

File has been identified by 32 AntiVirus engines on VirusTotal as malicious (32 events)

Bkav	W32.AIDetectNet.01
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Strictor.271089
ALYac	Gen:Variant.Strictor.271089
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Strictor.D422F1
Cyren	W32/MSIL_Agent.DPT.gen!Eldorado
Symantec	Scr.Malcode!gdn34
ESET-NOD32	a variant of MSIL/GenKryptik.FXYX
APEX	Malicious
Kaspersky	UDS:Backdoor.MSIL.Androm.gen
BitDefender	Gen:Variant.Strictor.271089
Avast	Win32:PWSX-gen [Trj]
Ad-Aware	Gen:Variant.Strictor.271089
Emsisoft	Gen:Variant.Strictor.271089 (B)
VIPRE	Gen:Variant.Strictor.271089
Trapmine	suspicious.low.ml.score
FireEye	Generic.mg.111a90a2e621eca7
Sophos	Generic ML PUA (PUA)
MAX	malware (ai score=82)
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Gen:Variant.Strictor.271089
Cynet	Malicious (score: 100)
Acronis	suspicious
VBA32	CIL.HeapOverride.Heur
Rising	Trojan.Generic/MSIL@AI.98 (RDM.MSIL:Wn3VqmDXdAA69H58xNvqVw)
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/GenKryptik.FVXS!tr
BitDefenderTheta	Gen:NN.ZemsilF.34806.cn0@aOa@Wbc
AVG	Win32:PWSX-gen [Trj]

vbc.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All