popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

Generic Malware UPX Malicious Library PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 May 10, 2023, 5:58 p.m. May 10, 2023, 6:09 p.m.
Size 319.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 6ade942d85d1738a7d52360ca1d34080
SHA256 d48a2b8410a53d0f6475fa8f93ef357ab2fbfe21a9b56af60ac3aa73cd4c1078
CRC32 B0075AEA
ssdeep 6144:7AlTLATq+/lVkvYIfTWVKAag6K5vIV6DvGG4+:7q0Tq+xWaVK7OIVQvG
PDB Path C:\cohumasivumo\80\fiz\moxopij_vesojet.pdb
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
117.18.232.200 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\cohumasivumo\80\fiz\moxopij_vesojet.pdb
resource name AFX_DIALOG_LAYOUT
resource name FOLOYEZIMAWOKI
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 86016
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0086e000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2560
region_size: 110592
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00029e00', u'virtual_address': u'0x00001000', u'entropy': 7.513732334873597, u'name': u'.text', u'virtual_size': u'0x00029d1a'} entropy 7.51373233487 description A section with a high entropy has been found
entropy 0.52590266876 description Overall entropy of this PE file is high
host 117.18.232.200
dead_host 192.168.56.101:49184
Bkav W32.AIDetectMalware
Lionic Adware.Win32.Generic.lXlr
Elastic malicious (high confidence)
ClamAV Win.Packer.pkr_ce1a-9980177-0
FireEye Generic.mg.6ade942d85d1738a
CAT-QuickHeal Ransom.Stop.P5
McAfee Artemis!6ADE942D85D1
Cylance unsafe
Sangfor Trojan.Win32.Save.a
Cyren W32/Kryptik.JTD.gen!Eldorado
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 100)
Kaspersky UDS:DangerousObject.Multi.Generic
Avast Win32:TrojanX-gen [Trj]
McAfee-GW-Edition BehavesLike.Win32.Generic.fh
Trapmine malicious.moderate.ml.score
Sophos Troj/Krypt-VZ
Ikarus Trojan.Win32.SmokeLoader
Gridinsoft Trojan.Win32.Sabsik.dd!n
Microsoft Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm UDS:DangerousObject.Multi.Generic
GData Win32.Trojan.Agent.MP58GV
Google Detected
Acronis suspicious
Malwarebytes Generic.Malware/Suspicious
Panda Trj/Genetic.gen
TrendMicro-HouseCall TROJ_GEN.R002H0CEA23
Rising Trojan.Generic@AI.100 (RDML:oOZfnKJm48U0jDdbtQqhWw)
MaxSecure Trojan.Malware.300983.susgen
AVG Win32:TrojanX-gen [Trj]
DeepInstinct MALICIOUS