popup

Report - vbc.exe

Generic Malware Malicious Packer PE File OS Processor Check PE32
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.06.24 19:55 Machine s1_win7_x6401
Filename vbc.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
1
 Behavior Score
1.8
ZERO API file : clean
VT API (file)
md5 f17e854a03ef48b2b2581e329b233510
sha256 a39bf71ad924d013133a402cea33e33c57a0fd202dcee7f411a4149535f7e969
ssdeep 12288:ebBLrKMu5/zyDPHVQBONb7Q87oWxn9wbKeD:ALrKMQ3ONbVjnWbKe
imphash 1e17a996886aa2657a4de6c042170d2c
impfuzzy 48:yEbODA+fmpdVXAZI1qlpoX/OQ9YWaE8cRhV8+UpeLXvGBg:WEZzVXAW4voX/+zE8cRhV8+SeLXB
  Network IP location

Signature (6cnts)

Level Description
notice Allocates read-write-execute memory (usually to unpack itself)
notice Foreign language identified in PE resource
notice The binary likely contains encrypted or compressed data indicative of a packer
info One or more processes crashed
info The file contains an unknown PE resource name possibly indicative of a packer
info This executable has a PDB path

Rules (5cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x44a000 SetVolumeLabelA
 0x44a004 SearchPathW
 0x44a008 WriteConsoleInputW
 0x44a00c TlsGetValue
 0x44a010 GetProfileIntW
 0x44a014 MapUserPhysicalPages
 0x44a018 LoadResource
 0x44a01c InterlockedIncrement
 0x44a020 InterlockedDecrement
 0x44a024 ScrollConsoleScreenBufferW
 0x44a028 CreateDirectoryW
 0x44a02c GetComputerNameW
 0x44a030 GetCommProperties
 0x44a034 FreeEnvironmentStringsA
 0x44a038 GetModuleHandleW
 0x44a03c CreateNamedPipeW
 0x44a040 LocalFlags
 0x44a044 GetConsoleAliasesLengthA
 0x44a048 GetPrivateProfileStringW
 0x44a04c GetWindowsDirectoryA
 0x44a050 WriteFile
 0x44a054 SetCommState
 0x44a058 GetCommandLineA
 0x44a05c GetSystemWow64DirectoryA
 0x44a060 WriteFileGather
 0x44a064 CreateDirectoryExW
 0x44a068 SetProcessPriorityBoost
 0x44a06c FindResourceExA
 0x44a070 GlobalAlloc
 0x44a074 LoadLibraryW
 0x44a078 GetConsoleMode
 0x44a07c GetCalendarInfoA
 0x44a080 SetSystemTimeAdjustment
 0x44a084 GetSystemWindowsDirectoryA
 0x44a088 SetConsoleCursorPosition
 0x44a08c VerifyVersionInfoA
 0x44a090 TerminateProcess
 0x44a094 IsDBCSLeadByte
 0x44a098 GetBinaryTypeW
 0x44a09c GetOverlappedResult
 0x44a0a0 lstrlenW
 0x44a0a4 SetConsoleTitleA
 0x44a0a8 GlobalUnlock
 0x44a0ac LCMapStringA
 0x44a0b0 GetConsoleOutputCP
 0x44a0b4 InterlockedExchange
 0x44a0b8 ReleaseActCtx
 0x44a0bc GetFileSizeEx
 0x44a0c0 SetThreadLocale
 0x44a0c4 GetProcAddress
 0x44a0c8 SetComputerNameA
 0x44a0cc EnterCriticalSection
 0x44a0d0 SearchPathA
 0x44a0d4 BuildCommDCBW
 0x44a0d8 OpenWaitableTimerA
 0x44a0dc GetLocalTime
 0x44a0e0 GetConsoleScreenBufferInfo
 0x44a0e4 IsSystemResumeAutomatic
 0x44a0e8 SetConsoleCtrlHandler
 0x44a0ec WriteProfileSectionW
 0x44a0f0 FindAtomA
 0x44a0f4 GetTapeParameters
 0x44a0f8 EnumResourceTypesW
 0x44a0fc SetConsoleCursorInfo
 0x44a100 GetConsoleTitleW
 0x44a104 GetCurrentDirectoryA
 0x44a108 CompareStringA
 0x44a10c GetConsoleCursorInfo
 0x44a110 SetThreadAffinityMask
 0x44a114 GetVersionExA
 0x44a118 DeleteFileW
 0x44a11c InterlockedPushEntrySList
 0x44a120 GetProfileSectionW
 0x44a124 CopyFileExA
 0x44a128 AreFileApisANSI
 0x44a12c GetVolumeInformationW
 0x44a130 GetModuleHandleA
 0x44a134 FlushFileBuffers
 0x44a138 GetStartupInfoA
 0x44a13c HeapValidate
 0x44a140 IsBadReadPtr
 0x44a144 RaiseException
 0x44a148 DeleteCriticalSection
 0x44a14c LeaveCriticalSection
 0x44a150 GetModuleFileNameW
 0x44a154 SetUnhandledExceptionFilter
 0x44a158 QueryPerformanceCounter
 0x44a15c GetTickCount
 0x44a160 GetCurrentThreadId
 0x44a164 GetCurrentProcessId
 0x44a168 GetSystemTimeAsFileTime
 0x44a16c Sleep
 0x44a170 ExitProcess
 0x44a174 GetModuleFileNameA
 0x44a178 GetEnvironmentStrings
 0x44a17c FreeEnvironmentStringsW
 0x44a180 WideCharToMultiByte
 0x44a184 GetLastError
 0x44a188 GetEnvironmentStringsW
 0x44a18c SetHandleCount
 0x44a190 GetStdHandle
 0x44a194 GetFileType
 0x44a198 TlsAlloc
 0x44a19c TlsSetValue
 0x44a1a0 TlsFree
 0x44a1a4 SetLastError
 0x44a1a8 HeapDestroy
 0x44a1ac HeapCreate
 0x44a1b0 HeapFree
 0x44a1b4 VirtualFree
 0x44a1b8 HeapAlloc
 0x44a1bc GetCurrentProcess
 0x44a1c0 UnhandledExceptionFilter
 0x44a1c4 IsDebuggerPresent
 0x44a1c8 HeapSize
 0x44a1cc HeapReAlloc
 0x44a1d0 VirtualAlloc
 0x44a1d4 GetACP
 0x44a1d8 GetOEMCP
 0x44a1dc GetCPInfo
 0x44a1e0 IsValidCodePage
 0x44a1e4 RtlUnwind
 0x44a1e8 InitializeCriticalSectionAndSpinCount
 0x44a1ec DebugBreak
 0x44a1f0 OutputDebugStringA
 0x44a1f4 WriteConsoleW
 0x44a1f8 OutputDebugStringW
 0x44a1fc LoadLibraryA
 0x44a200 MultiByteToWideChar
 0x44a204 LCMapStringW
 0x44a208 GetStringTypeA
 0x44a20c GetStringTypeW
 0x44a210 GetLocaleInfoA
 0x44a214 SetFilePointer
 0x44a218 GetConsoleCP
 0x44a21c SetStdHandle
 0x44a220 WriteConsoleA
 0x44a224 CreateFileA
 0x44a228 CloseHandle
USER32.dll
 0x44a230 GetMenuInfo
 0x44a234 GetMessageTime
 0x44a238 GetMenuCheckMarkDimensions

EAT(Export Address Table) Library

0x43faa0 _CallPattern@8

Similarity measure (PE file only) - Checking for service failure