popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

VBDVMGWB.exe

Gen1 Generic Malware Malicious Library Antivirus UPX Malicious Packer PE File PE64 OS Processor Check PE32 DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 3, 2024, 8 a.m. July 3, 2024, 8:02 a.m.
Size 5.9MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 30772bcce9852eb58cf05a75bcdce2f9
SHA256 584945fbd2076bc151184065a72373f87405136be7b0131d36ded7d986b968fc
CRC32 7AF79CEA
ssdeep 98304:+pYdpXlLQCWYPzgXWx4qMO3X81hMTuJDdoi37BtYaCCKuZ5qM3g3b9LSsSuIAERN:+pGdbhgXWxRMO3XsmuxddCdoU3J7SuIR
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
packer Armadillo v1.71
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc2000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 0
free_bytes_available: 13318868992
root_path: C:\Users\test22\AppData\Local\Temp
total_number_of_bytes: 0
1 1 0
file C:\Users\test22\AppData\Local\Temp\blackleg.pptx
file C:\Users\test22\AppData\Local\Temp\msvcp140_1.dll
file C:\Users\test22\AppData\Local\Temp\libssl-1_1-x64.dll
file C:\Users\test22\AppData\Local\Temp\Qt5Network.dll
file C:\Users\test22\AppData\Local\Temp\libcrypto-1_1-x64.dll
file C:\Users\test22\AppData\Local\Temp\vcruntime140.dll
file C:\Users\test22\AppData\Local\Temp\msvcp140.dll
file C:\Users\test22\AppData\Local\Temp\vcruntime140_1.dll
file C:\Users\test22\AppData\Local\Temp\EASteamProxy.exe
file C:\Users\test22\AppData\Local\Temp\Qt5Core.dll
file C:\Users\test22\AppData\Local\Temp\steam_api64.dll
file C:\Users\test22\AppData\Local\Temp\EASteamProxy.exe