popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

Generic Malware UPX Malicious Library PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 22, 2023, 10:05 a.m. March 22, 2023, 10:12 a.m.
Size 180.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 55aca393f1147b8ad1b2abc5a3c255e4
SHA256 5ce7cc92343e4b35138948556755b62597fe7a10de071f0429eba2369a986483
CRC32 CA39BBA5
ssdeep 3072:ZB13MC9/v5BRNWpPbTqSNTd/zNMqiX0P5Dsopd8amTw1JZ:nmCtJ23qSV4+sopya8s
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .ziditaw
resource name AFX_DIALOG_LAYOUT
resource name TEFUHAZIYUVOVONIDIMAWARULOBEKA
resource name None
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2556
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 77824
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005bc000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 110592
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00013200', u'virtual_address': u'0x0000d000', u'entropy': 7.857134467356031, u'name': u'.data', u'virtual_size': u'0x0009078c'} entropy 7.85713446736 description A section with a high entropy has been found
entropy 0.426183844011 description Overall entropy of this PE file is high
Bkav W32.AIDetectNet.01
Lionic Trojan.Win32.Generic.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Zusy.454327
FireEye Generic.mg.55aca393f1147b8a
McAfee Artemis!55ACA393F114
Malwarebytes Trojan.MalPack.GS
Sangfor Trojan.Win32.Save.a
Alibaba Ransom:Win32/RansomX.6e7ed31e
CrowdStrike win/malicious_confidence_100% (W)
Cyren W32/Kryptik.JGG.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Kryptik.HTCI
Cynet Malicious (score: 100)
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan-Spy.Win32.Stealer.gen
BitDefender Gen:Variant.Zusy.454327
Avast Win32:PWSX-gen [Trj]
Sophos ML/PE-A
VIPRE Gen:Variant.Mikey.145680
TrendMicro TROJ_GEN.R002C0DCL23
McAfee-GW-Edition BehavesLike.Win32.Lockbit.ch
Trapmine malicious.high.ml.score
Emsisoft Gen:Variant.Zusy.454327 (B)
SentinelOne Static AI - Suspicious PE
Antiy-AVL Trojan[Backdoor]/Win32.Convagent
Microsoft Trojan:Win32/RedLineStealer.E!MTB
Arcabit Trojan.Mikey.D23910
ZoneAlarm HEUR:Trojan-Spy.Win32.Stealer.gen
GData Gen:Variant.Zusy.454327
Google Detected
AhnLab-V3 Malware/Win.Generic.R564864
ALYac Gen:Variant.Mikey.145680
MAX malware (ai score=87)
VBA32 Malware-Cryptor.Azorult.gen
Cylance unsafe
Rising Trojan.Generic@AI.100 (RDML:h9Ave0dHMvdkvrt0oYrc1A)
Ikarus Trojan.Win32.Crypt
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/GenKryptik.GHWB!tr
AVG Win32:PWSX-gen [Trj]
Panda Trj/Genetic.gen