ScreenShot
| Created | 2021.04.28 09:47 | Machine | s1_win7_x6401 |
| Filename | vbc.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 22 detected (AIDetect, malware1, malicious, high confidence, Unsafe, Save, Attribute, HighConfidence, Auto, Wacatac, score, ET#96%, RDMK, cmRtazqLUHstwtgiQcLzSsZ8OBKH, Static AI, Malicious PE, ZexaF, uC1@aWm1CRmk, confidence) | ||
| md5 | ea4f3cbb2f990be8628145b8e7970880 | ||
| sha256 | 554853af78e123ea4831b732cafddd36d29441188bb9c825ad662eae0d2d215a | ||
| ssdeep | 6144:TrVnaG84d89N2UNXK1s5CDMRVKGuhF7+J5ERbZ:Fs4W9N2U6W55VKjD+TERbZ | ||
| imphash | 5e03c3392ae63c1a9ad529a3ae4b9981 | ||
| impfuzzy | 24:U9zbkxpUBzj/IhfdcDL1fKg8TbqLOova1tmkJ3I5cxOaNTqdbplOFQ8RyvHRTrZ7:UWWYG18q6v1thGcvcd1/xPZBpKpCZ | ||
Network IP location
Signature (17cnts)
| Level | Description |
|---|---|
| danger | Executed a process and injected code into it |
| warning | File has been identified by 22 AntiVirus engines on VirusTotal as malicious |
| warning | Generates some ICMP traffic |
| watch | Allocates execute permission to another process indicative of possible code injection |
| watch | Potential code injection by writing to the memory of another process |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| watch | Used NtSetContextThread to modify a thread in a remote process indicative of process injection |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Foreign language identified in PE resource |
| notice | HTTP traffic contains suspicious features which may be indicative of malware related traffic |
| notice | One or more potentially interesting buffers were extracted |
| notice | Performs some HTTP requests |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | Yara rule detected in process memory |
| info | Checks if process is being debugged by a debugger |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (13cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check Signature Zero | binaries (upload) |
| info | PE_Header_Zero | PE File Signature Zero | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
| info | HasOverlay | Overlay Check | binaries (upload) |
| info | IsPacked | Entropy Check | binaries (upload) |
| info | IsWindowsGUI | (no description) | binaries (upload) |
Network (13cnts) ?
Suricata ids
ET MALWARE FormBook CnC Checkin (GET)
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x3da9008 FreeLibrary
0x3da900c LoadLibraryExW
0x3da9010 InterlockedIncrement
0x3da9014 GetConsoleAliasA
0x3da9018 GetModuleHandleExW
0x3da901c GetTimeFormatA
0x3da9020 ConnectNamedPipe
0x3da9024 TzSpecificLocalTimeToSystemTime
0x3da9028 GlobalAlloc
0x3da902c TerminateThread
0x3da9030 GetLocaleInfoW
0x3da9034 GetSystemTimeAdjustment
0x3da9038 GetFileAttributesA
0x3da903c SetConsoleCursorPosition
0x3da9040 FindResourceW
0x3da9044 SetTimeZoneInformation
0x3da9048 GetAtomNameW
0x3da904c lstrcatA
0x3da9050 RaiseException
0x3da9054 GetLastError
0x3da9058 GetProcAddress
0x3da905c OpenWaitableTimerA
0x3da9060 SetConsoleOutputCP
0x3da9064 FindAtomA
0x3da9068 GlobalFindAtomW
0x3da906c GetModuleHandleA
0x3da9070 GetFileTime
0x3da9074 FileTimeToLocalFileTime
0x3da9078 GetCurrentProcessId
0x3da907c GetFileAttributesW
0x3da9080 MapViewOfFile
0x3da9084 GetModuleHandleW
0x3da9088 Sleep
0x3da908c ExitProcess
0x3da9090 GetCommandLineA
0x3da9094 GetStartupInfoA
0x3da9098 RtlUnwind
0x3da909c TerminateProcess
0x3da90a0 GetCurrentProcess
0x3da90a4 UnhandledExceptionFilter
0x3da90a8 SetUnhandledExceptionFilter
0x3da90ac IsDebuggerPresent
0x3da90b0 HeapAlloc
0x3da90b4 HeapFree
0x3da90b8 TlsGetValue
0x3da90bc TlsAlloc
0x3da90c0 TlsSetValue
0x3da90c4 TlsFree
0x3da90c8 SetLastError
0x3da90cc GetCurrentThreadId
0x3da90d0 InterlockedDecrement
0x3da90d4 GetCurrentThread
0x3da90d8 WriteFile
0x3da90dc GetStdHandle
0x3da90e0 GetModuleFileNameA
0x3da90e4 DeleteCriticalSection
0x3da90e8 LeaveCriticalSection
0x3da90ec FatalAppExitA
0x3da90f0 EnterCriticalSection
0x3da90f4 SetConsoleCtrlHandler
0x3da90f8 InterlockedExchange
0x3da90fc LoadLibraryA
0x3da9100 InitializeCriticalSectionAndSpinCount
0x3da9104 FreeEnvironmentStringsA
0x3da9108 GetEnvironmentStrings
0x3da910c FreeEnvironmentStringsW
0x3da9110 WideCharToMultiByte
0x3da9114 GetEnvironmentStringsW
0x3da9118 SetHandleCount
0x3da911c GetFileType
0x3da9120 HeapCreate
0x3da9124 HeapDestroy
0x3da9128 VirtualFree
0x3da912c QueryPerformanceCounter
0x3da9130 GetTickCount
0x3da9134 GetSystemTimeAsFileTime
0x3da9138 VirtualAlloc
0x3da913c HeapReAlloc
0x3da9140 GetCPInfo
0x3da9144 GetACP
0x3da9148 GetOEMCP
0x3da914c IsValidCodePage
0x3da9150 HeapSize
0x3da9154 GetLocaleInfoA
0x3da9158 GetDateFormatA
0x3da915c GetUserDefaultLCID
0x3da9160 EnumSystemLocalesA
0x3da9164 IsValidLocale
0x3da9168 GetStringTypeA
0x3da916c MultiByteToWideChar
0x3da9170 GetStringTypeW
0x3da9174 LCMapStringA
0x3da9178 LCMapStringW
0x3da917c GetTimeZoneInformation
0x3da9180 CompareStringA
0x3da9184 CompareStringW
0x3da9188 SetEnvironmentVariableA
ADVAPI32.dll
0x3da9000 RegCreateKeyW
EAT(Export Address Table) Library
0x43d958 Linear
KERNEL32.dll
0x3da9008 FreeLibrary
0x3da900c LoadLibraryExW
0x3da9010 InterlockedIncrement
0x3da9014 GetConsoleAliasA
0x3da9018 GetModuleHandleExW
0x3da901c GetTimeFormatA
0x3da9020 ConnectNamedPipe
0x3da9024 TzSpecificLocalTimeToSystemTime
0x3da9028 GlobalAlloc
0x3da902c TerminateThread
0x3da9030 GetLocaleInfoW
0x3da9034 GetSystemTimeAdjustment
0x3da9038 GetFileAttributesA
0x3da903c SetConsoleCursorPosition
0x3da9040 FindResourceW
0x3da9044 SetTimeZoneInformation
0x3da9048 GetAtomNameW
0x3da904c lstrcatA
0x3da9050 RaiseException
0x3da9054 GetLastError
0x3da9058 GetProcAddress
0x3da905c OpenWaitableTimerA
0x3da9060 SetConsoleOutputCP
0x3da9064 FindAtomA
0x3da9068 GlobalFindAtomW
0x3da906c GetModuleHandleA
0x3da9070 GetFileTime
0x3da9074 FileTimeToLocalFileTime
0x3da9078 GetCurrentProcessId
0x3da907c GetFileAttributesW
0x3da9080 MapViewOfFile
0x3da9084 GetModuleHandleW
0x3da9088 Sleep
0x3da908c ExitProcess
0x3da9090 GetCommandLineA
0x3da9094 GetStartupInfoA
0x3da9098 RtlUnwind
0x3da909c TerminateProcess
0x3da90a0 GetCurrentProcess
0x3da90a4 UnhandledExceptionFilter
0x3da90a8 SetUnhandledExceptionFilter
0x3da90ac IsDebuggerPresent
0x3da90b0 HeapAlloc
0x3da90b4 HeapFree
0x3da90b8 TlsGetValue
0x3da90bc TlsAlloc
0x3da90c0 TlsSetValue
0x3da90c4 TlsFree
0x3da90c8 SetLastError
0x3da90cc GetCurrentThreadId
0x3da90d0 InterlockedDecrement
0x3da90d4 GetCurrentThread
0x3da90d8 WriteFile
0x3da90dc GetStdHandle
0x3da90e0 GetModuleFileNameA
0x3da90e4 DeleteCriticalSection
0x3da90e8 LeaveCriticalSection
0x3da90ec FatalAppExitA
0x3da90f0 EnterCriticalSection
0x3da90f4 SetConsoleCtrlHandler
0x3da90f8 InterlockedExchange
0x3da90fc LoadLibraryA
0x3da9100 InitializeCriticalSectionAndSpinCount
0x3da9104 FreeEnvironmentStringsA
0x3da9108 GetEnvironmentStrings
0x3da910c FreeEnvironmentStringsW
0x3da9110 WideCharToMultiByte
0x3da9114 GetEnvironmentStringsW
0x3da9118 SetHandleCount
0x3da911c GetFileType
0x3da9120 HeapCreate
0x3da9124 HeapDestroy
0x3da9128 VirtualFree
0x3da912c QueryPerformanceCounter
0x3da9130 GetTickCount
0x3da9134 GetSystemTimeAsFileTime
0x3da9138 VirtualAlloc
0x3da913c HeapReAlloc
0x3da9140 GetCPInfo
0x3da9144 GetACP
0x3da9148 GetOEMCP
0x3da914c IsValidCodePage
0x3da9150 HeapSize
0x3da9154 GetLocaleInfoA
0x3da9158 GetDateFormatA
0x3da915c GetUserDefaultLCID
0x3da9160 EnumSystemLocalesA
0x3da9164 IsValidLocale
0x3da9168 GetStringTypeA
0x3da916c MultiByteToWideChar
0x3da9170 GetStringTypeW
0x3da9174 LCMapStringA
0x3da9178 LCMapStringW
0x3da917c GetTimeZoneInformation
0x3da9180 CompareStringA
0x3da9184 CompareStringW
0x3da9188 SetEnvironmentVariableA
ADVAPI32.dll
0x3da9000 RegCreateKeyW
EAT(Export Address Table) Library
0x43d958 Linear