ScreenShot
| Created | 2021.07.02 09:18 | Machine | s1_win7_x6401 |
| Filename | vbc.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 49 detected (AIDetect, malware1, GenericKD, Unsafe, Save, Azorult, malicious, ZexaF, vuW@aCRmk4iO, Kryptik, Eldorado, Attribute, HighConfidence, HLNN, PWSX, Androm, Fareit, Auto, UMal, lkfau@0, STOP, SMYXBFX, R + Troj, Racealer, ai score=80, kcloud, 1T2D522, score, R428315, BScope, CLASSIC, Static AI, Malicious PE, Behavior, susgen, Genetic, confidence, 100%, HgIASXYA) | ||
| md5 | 38811f89fdfca60be471e776e73ad1a9 | ||
| sha256 | 39b95a1927b9cc2435642fc76dbeb4e7fae9a858ce4cc2664490de6f74662fbc | ||
| ssdeep | 6144:Gcdmj1Gx2/4Mtc03dYdqvoJ6AlwpPGq7jCLuzK/rQPg6UO4M:Gt1GcwMS03dY4oJ6AlSjeLGKzXjM | ||
| imphash | a6f146a143ca57a8d8acf4fb9d34381c | ||
| impfuzzy | 48:CzLU1t4O7FLvtzuX0kJtip0gFOV+fc3utHaEGoxccv+3pvBg:DtDdvluX0Q8fg+fc+t6EGOccv+3pq | ||
Network IP location
Signature (7cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 49 AntiVirus engines on VirusTotal as malicious |
| watch | Tries to unhook Windows functions monitored by Cuckoo |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | One or more processes crashed |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (7cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| warning | RIG_EK_IN | RIG EK Interzer | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x43a000 GetCommandLineW
0x43a004 GetComputerNameA
0x43a008 SetVolumeLabelA
0x43a00c CreateMutexW
0x43a010 WriteConsoleInputW
0x43a014 WritePrivateProfileStructA
0x43a018 GetConsoleAliasesLengthW
0x43a01c CommConfigDialogA
0x43a020 GetProfileIntW
0x43a024 GetDefaultCommConfigW
0x43a028 FindResourceExW
0x43a02c FreeLibrary
0x43a030 CallNamedPipeA
0x43a034 SetConsoleTextAttribute
0x43a038 GetCommState
0x43a03c InterlockedDecrement
0x43a040 ZombifyActCtx
0x43a044 ScrollConsoleScreenBufferW
0x43a048 GetNamedPipeHandleStateA
0x43a04c CreateDirectoryExA
0x43a050 GetProcessPriorityBoost
0x43a054 GetModuleHandleW
0x43a058 GetCommConfig
0x43a05c GetPrivateProfileStringW
0x43a060 FindActCtxSectionStringA
0x43a064 TlsSetValue
0x43a068 ActivateActCtx
0x43a06c GlobalAlloc
0x43a070 GetSystemDirectoryW
0x43a074 LoadLibraryW
0x43a078 GetConsoleMode
0x43a07c SizeofResource
0x43a080 GetCalendarInfoA
0x43a084 ReadFileScatter
0x43a088 GetSystemWow64DirectoryW
0x43a08c GetSystemWindowsDirectoryA
0x43a090 GetSystemTimeAdjustment
0x43a094 GetVersionExW
0x43a098 GlobalFlags
0x43a09c SetConsoleCursorPosition
0x43a0a0 GetBinaryTypeA
0x43a0a4 IsDBCSLeadByte
0x43a0a8 ReadFile
0x43a0ac GetOverlappedResult
0x43a0b0 ExitThread
0x43a0b4 lstrlenW
0x43a0b8 SetConsoleTitleA
0x43a0bc GlobalUnlock
0x43a0c0 VerifyVersionInfoW
0x43a0c4 CreateDirectoryA
0x43a0c8 GetFileSizeEx
0x43a0cc SetCurrentDirectoryA
0x43a0d0 SetThreadLocale
0x43a0d4 GetCPInfoExW
0x43a0d8 GetCurrentDirectoryW
0x43a0dc ReadConsoleOutputCharacterA
0x43a0e0 WriteProfileSectionA
0x43a0e4 FreeUserPhysicalPages
0x43a0e8 SetComputerNameA
0x43a0ec SearchPathA
0x43a0f0 GetLocalTime
0x43a0f4 GetAtomNameA
0x43a0f8 LoadLibraryA
0x43a0fc SetConsoleOutputCP
0x43a100 SetConsoleWindowInfo
0x43a104 GetTapeParameters
0x43a108 WTSGetActiveConsoleSessionId
0x43a10c SetConsoleCursorInfo
0x43a110 GetProcessShutdownParameters
0x43a114 FreeEnvironmentStringsW
0x43a118 RequestWakeupLatency
0x43a11c VirtualProtect
0x43a120 CompareStringA
0x43a124 GetConsoleCursorInfo
0x43a128 FindAtomW
0x43a12c GetWindowsDirectoryW
0x43a130 FileTimeToLocalFileTime
0x43a134 GetVolumeNameForVolumeMountPointW
0x43a138 InterlockedPushEntrySList
0x43a13c GetProfileSectionW
0x43a140 LCMapStringW
0x43a144 CopyFileExA
0x43a148 CommConfigDialogW
0x43a14c DeleteFileA
0x43a150 GetModuleHandleA
0x43a154 InterlockedIncrement
0x43a158 Sleep
0x43a15c InitializeCriticalSection
0x43a160 DeleteCriticalSection
0x43a164 EnterCriticalSection
0x43a168 LeaveCriticalSection
0x43a16c MultiByteToWideChar
0x43a170 GetCommandLineA
0x43a174 GetStartupInfoA
0x43a178 UnhandledExceptionFilter
0x43a17c SetUnhandledExceptionFilter
0x43a180 GetModuleFileNameW
0x43a184 HeapValidate
0x43a188 IsBadReadPtr
0x43a18c RaiseException
0x43a190 RtlUnwind
0x43a194 TerminateProcess
0x43a198 GetCurrentProcess
0x43a19c IsDebuggerPresent
0x43a1a0 SetHandleCount
0x43a1a4 GetStdHandle
0x43a1a8 GetFileType
0x43a1ac GetACP
0x43a1b0 GetOEMCP
0x43a1b4 GetCPInfo
0x43a1b8 IsValidCodePage
0x43a1bc GetProcAddress
0x43a1c0 TlsGetValue
0x43a1c4 TlsAlloc
0x43a1c8 GetCurrentThreadId
0x43a1cc TlsFree
0x43a1d0 SetLastError
0x43a1d4 GetLastError
0x43a1d8 QueryPerformanceCounter
0x43a1dc GetTickCount
0x43a1e0 GetCurrentProcessId
0x43a1e4 GetSystemTimeAsFileTime
0x43a1e8 ExitProcess
0x43a1ec GetModuleFileNameA
0x43a1f0 FreeEnvironmentStringsA
0x43a1f4 GetEnvironmentStrings
0x43a1f8 WideCharToMultiByte
0x43a1fc GetEnvironmentStringsW
0x43a200 HeapDestroy
0x43a204 HeapCreate
0x43a208 HeapFree
0x43a20c VirtualFree
0x43a210 WriteFile
0x43a214 FlushFileBuffers
0x43a218 GetConsoleCP
0x43a21c DebugBreak
0x43a220 OutputDebugStringA
0x43a224 WriteConsoleW
0x43a228 OutputDebugStringW
0x43a22c HeapAlloc
0x43a230 HeapSize
0x43a234 HeapReAlloc
0x43a238 VirtualAlloc
0x43a23c GetStringTypeA
0x43a240 GetStringTypeW
0x43a244 GetLocaleInfoA
0x43a248 InitializeCriticalSectionAndSpinCount
0x43a24c SetFilePointer
0x43a250 LCMapStringA
0x43a254 SetStdHandle
0x43a258 WriteConsoleA
0x43a25c GetConsoleOutputCP
0x43a260 CloseHandle
0x43a264 CreateFileA
USER32.dll
0x43a26c GetMessageTime
0x43a270 GetMenuCheckMarkDimensions
EAT(Export Address Table) is none
KERNEL32.dll
0x43a000 GetCommandLineW
0x43a004 GetComputerNameA
0x43a008 SetVolumeLabelA
0x43a00c CreateMutexW
0x43a010 WriteConsoleInputW
0x43a014 WritePrivateProfileStructA
0x43a018 GetConsoleAliasesLengthW
0x43a01c CommConfigDialogA
0x43a020 GetProfileIntW
0x43a024 GetDefaultCommConfigW
0x43a028 FindResourceExW
0x43a02c FreeLibrary
0x43a030 CallNamedPipeA
0x43a034 SetConsoleTextAttribute
0x43a038 GetCommState
0x43a03c InterlockedDecrement
0x43a040 ZombifyActCtx
0x43a044 ScrollConsoleScreenBufferW
0x43a048 GetNamedPipeHandleStateA
0x43a04c CreateDirectoryExA
0x43a050 GetProcessPriorityBoost
0x43a054 GetModuleHandleW
0x43a058 GetCommConfig
0x43a05c GetPrivateProfileStringW
0x43a060 FindActCtxSectionStringA
0x43a064 TlsSetValue
0x43a068 ActivateActCtx
0x43a06c GlobalAlloc
0x43a070 GetSystemDirectoryW
0x43a074 LoadLibraryW
0x43a078 GetConsoleMode
0x43a07c SizeofResource
0x43a080 GetCalendarInfoA
0x43a084 ReadFileScatter
0x43a088 GetSystemWow64DirectoryW
0x43a08c GetSystemWindowsDirectoryA
0x43a090 GetSystemTimeAdjustment
0x43a094 GetVersionExW
0x43a098 GlobalFlags
0x43a09c SetConsoleCursorPosition
0x43a0a0 GetBinaryTypeA
0x43a0a4 IsDBCSLeadByte
0x43a0a8 ReadFile
0x43a0ac GetOverlappedResult
0x43a0b0 ExitThread
0x43a0b4 lstrlenW
0x43a0b8 SetConsoleTitleA
0x43a0bc GlobalUnlock
0x43a0c0 VerifyVersionInfoW
0x43a0c4 CreateDirectoryA
0x43a0c8 GetFileSizeEx
0x43a0cc SetCurrentDirectoryA
0x43a0d0 SetThreadLocale
0x43a0d4 GetCPInfoExW
0x43a0d8 GetCurrentDirectoryW
0x43a0dc ReadConsoleOutputCharacterA
0x43a0e0 WriteProfileSectionA
0x43a0e4 FreeUserPhysicalPages
0x43a0e8 SetComputerNameA
0x43a0ec SearchPathA
0x43a0f0 GetLocalTime
0x43a0f4 GetAtomNameA
0x43a0f8 LoadLibraryA
0x43a0fc SetConsoleOutputCP
0x43a100 SetConsoleWindowInfo
0x43a104 GetTapeParameters
0x43a108 WTSGetActiveConsoleSessionId
0x43a10c SetConsoleCursorInfo
0x43a110 GetProcessShutdownParameters
0x43a114 FreeEnvironmentStringsW
0x43a118 RequestWakeupLatency
0x43a11c VirtualProtect
0x43a120 CompareStringA
0x43a124 GetConsoleCursorInfo
0x43a128 FindAtomW
0x43a12c GetWindowsDirectoryW
0x43a130 FileTimeToLocalFileTime
0x43a134 GetVolumeNameForVolumeMountPointW
0x43a138 InterlockedPushEntrySList
0x43a13c GetProfileSectionW
0x43a140 LCMapStringW
0x43a144 CopyFileExA
0x43a148 CommConfigDialogW
0x43a14c DeleteFileA
0x43a150 GetModuleHandleA
0x43a154 InterlockedIncrement
0x43a158 Sleep
0x43a15c InitializeCriticalSection
0x43a160 DeleteCriticalSection
0x43a164 EnterCriticalSection
0x43a168 LeaveCriticalSection
0x43a16c MultiByteToWideChar
0x43a170 GetCommandLineA
0x43a174 GetStartupInfoA
0x43a178 UnhandledExceptionFilter
0x43a17c SetUnhandledExceptionFilter
0x43a180 GetModuleFileNameW
0x43a184 HeapValidate
0x43a188 IsBadReadPtr
0x43a18c RaiseException
0x43a190 RtlUnwind
0x43a194 TerminateProcess
0x43a198 GetCurrentProcess
0x43a19c IsDebuggerPresent
0x43a1a0 SetHandleCount
0x43a1a4 GetStdHandle
0x43a1a8 GetFileType
0x43a1ac GetACP
0x43a1b0 GetOEMCP
0x43a1b4 GetCPInfo
0x43a1b8 IsValidCodePage
0x43a1bc GetProcAddress
0x43a1c0 TlsGetValue
0x43a1c4 TlsAlloc
0x43a1c8 GetCurrentThreadId
0x43a1cc TlsFree
0x43a1d0 SetLastError
0x43a1d4 GetLastError
0x43a1d8 QueryPerformanceCounter
0x43a1dc GetTickCount
0x43a1e0 GetCurrentProcessId
0x43a1e4 GetSystemTimeAsFileTime
0x43a1e8 ExitProcess
0x43a1ec GetModuleFileNameA
0x43a1f0 FreeEnvironmentStringsA
0x43a1f4 GetEnvironmentStrings
0x43a1f8 WideCharToMultiByte
0x43a1fc GetEnvironmentStringsW
0x43a200 HeapDestroy
0x43a204 HeapCreate
0x43a208 HeapFree
0x43a20c VirtualFree
0x43a210 WriteFile
0x43a214 FlushFileBuffers
0x43a218 GetConsoleCP
0x43a21c DebugBreak
0x43a220 OutputDebugStringA
0x43a224 WriteConsoleW
0x43a228 OutputDebugStringW
0x43a22c HeapAlloc
0x43a230 HeapSize
0x43a234 HeapReAlloc
0x43a238 VirtualAlloc
0x43a23c GetStringTypeA
0x43a240 GetStringTypeW
0x43a244 GetLocaleInfoA
0x43a248 InitializeCriticalSectionAndSpinCount
0x43a24c SetFilePointer
0x43a250 LCMapStringA
0x43a254 SetStdHandle
0x43a258 WriteConsoleA
0x43a25c GetConsoleOutputCP
0x43a260 CloseHandle
0x43a264 CreateFileA
USER32.dll
0x43a26c GetMessageTime
0x43a270 GetMenuCheckMarkDimensions
EAT(Export Address Table) is none