popup

Report - vbc.exe

Malicious Library PE32 OS Processor Check PE File
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.07.10 09:15 Machine s1_win7_x6402
Filename vbc.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
5
 Behavior Score
2.8
ZERO API file : clean
VT API (file) 27 detected (AIDetect, malware1, malicious, high confidence, Artemis, Unsafe, Save, confidence, 100%, Hacktool, Emotet, Eldorado, Attribute, HighConfidence, score, PWSX, A + Troj, Kryptik, Static AI, Malicious PE, Azorult, BScope, Wacatac, susgen, GenKryptik, FHJF, ZexaF, vuW@ayKfpqJG, QVM10)
md5 d85950bc6166358539e77a46202d80d9
sha256 749437c88e2c14c1e8f366cbdc97d1a1eb7ee21ea949d57eef55deb553191aca
ssdeep 6144:7POaTPY0s+xjhI8gcdrUdGtFm+51Lyp4q8cGq2M5AAVIzJz4qppT/B8:7Ps0zVI8gcdrv4U1D1M5AASJ4gpTZ
imphash f4d7fcad78ad4238551571019fa352ad
impfuzzy 48:YeKmJy5vTi8NprYr+OS+fcft2KaEGsjlk6O9D:Ytr7JVYr+j+fcftaEGsjW6O5
  Network IP location

Signature (7cnts)

Level Description
warning File has been identified by 27 AntiVirus engines on VirusTotal as malicious
watch Tries to unhook Windows functions monitored by Cuckoo
notice Allocates read-write-execute memory (usually to unpack itself)
notice The binary likely contains encrypted or compressed data indicative of a packer
info One or more processes crashed
info The file contains an unknown PE resource name possibly indicative of a packer
info This executable has a PDB path

Rules (4cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x43a000 ExitProcess
 0x43a004 GetFileSize
 0x43a008 GlobalDeleteAtom
 0x43a00c SetFilePointer
 0x43a010 TlsGetValue
 0x43a014 GetConsoleAliasExesA
 0x43a018 SetLocalTime
 0x43a01c CommConfigDialogA
 0x43a020 FreeLibrary
 0x43a024 InterlockedDecrement
 0x43a028 ZombifyActCtx
 0x43a02c SetFirmwareEnvironmentVariableA
 0x43a030 GetNamedPipeHandleStateA
 0x43a034 CreateDirectoryW
 0x43a038 GetProfileSectionA
 0x43a03c SetComputerNameW
 0x43a040 GetComputerNameW
 0x43a044 SetTapeParameters
 0x43a048 GetTickCount
 0x43a04c CreateNamedPipeW
 0x43a050 GetConsoleAliasesLengthA
 0x43a054 GetPrivateProfileStringW
 0x43a058 WriteFile
 0x43a05c EnumTimeFormatsW
 0x43a060 CreateDirectoryExW
 0x43a064 SetProcessPriorityBoost
 0x43a068 GetSystemDirectoryW
 0x43a06c LoadLibraryW
 0x43a070 GetConsoleMode
 0x43a074 SetCommConfig
 0x43a078 _hread
 0x43a07c SizeofResource
 0x43a080 GetSystemWow64DirectoryW
 0x43a084 SetSystemTimeAdjustment
 0x43a088 GetSystemWindowsDirectoryA
 0x43a08c GetVersionExW
 0x43a090 InterlockedPopEntrySList
 0x43a094 GlobalFlags
 0x43a098 GetAtomNameW
 0x43a09c ReadFile
 0x43a0a0 GetBinaryTypeW
 0x43a0a4 GetOverlappedResult
 0x43a0a8 CompareStringW
 0x43a0ac lstrlenW
 0x43a0b0 SetConsoleTitleA
 0x43a0b4 GlobalUnlock
 0x43a0b8 VerifyVersionInfoW
 0x43a0bc GetStartupInfoA
 0x43a0c0 GetCurrentDirectoryW
 0x43a0c4 ReadConsoleOutputCharacterA
 0x43a0c8 GetProcessHeaps
 0x43a0cc GetComputerNameExW
 0x43a0d0 SetStdHandle
 0x43a0d4 FreeUserPhysicalPages
 0x43a0d8 VerLanguageNameW
 0x43a0dc LoadLibraryA
 0x43a0e0 Process32FirstW
 0x43a0e4 CreateSemaphoreW
 0x43a0e8 LocalAlloc
 0x43a0ec SetCalendarInfoW
 0x43a0f0 SetConsoleCtrlHandler
 0x43a0f4 SetCurrentDirectoryW
 0x43a0f8 WriteProfileSectionW
 0x43a0fc VirtualLock
 0x43a100 SetConsoleWindowInfo
 0x43a104 FindAtomA
 0x43a108 GetTapeParameters
 0x43a10c WriteProfileStringA
 0x43a110 GetProcessShutdownParameters
 0x43a114 QueryMemoryResourceNotification
 0x43a118 FreeEnvironmentStringsW
 0x43a11c VirtualProtect
 0x43a120 GetFileAttributesExW
 0x43a124 GetCPInfoExA
 0x43a128 _lopen
 0x43a12c TlsAlloc
 0x43a130 GetWindowsDirectoryW
 0x43a134 GetVersion
 0x43a138 GetVolumeNameForVolumeMountPointW
 0x43a13c GetCurrentProcessId
 0x43a140 FindActCtxSectionStringW
 0x43a144 LCMapStringW
 0x43a148 CopyFileExA
 0x43a14c DeleteFileA
 0x43a150 InterlockedIncrement
 0x43a154 Sleep
 0x43a158 InitializeCriticalSection
 0x43a15c DeleteCriticalSection
 0x43a160 EnterCriticalSection
 0x43a164 LeaveCriticalSection
 0x43a168 TerminateProcess
 0x43a16c GetCurrentProcess
 0x43a170 UnhandledExceptionFilter
 0x43a174 SetUnhandledExceptionFilter
 0x43a178 IsDebuggerPresent
 0x43a17c GetModuleFileNameW
 0x43a180 GetCommandLineA
 0x43a184 HeapValidate
 0x43a188 IsBadReadPtr
 0x43a18c RaiseException
 0x43a190 RtlUnwind
 0x43a194 GetProcAddress
 0x43a198 GetModuleHandleW
 0x43a19c TlsSetValue
 0x43a1a0 GetCurrentThreadId
 0x43a1a4 TlsFree
 0x43a1a8 SetLastError
 0x43a1ac GetLastError
 0x43a1b0 DebugBreak
 0x43a1b4 GetStdHandle
 0x43a1b8 OutputDebugStringA
 0x43a1bc WriteConsoleW
 0x43a1c0 GetFileType
 0x43a1c4 OutputDebugStringW
 0x43a1c8 QueryPerformanceCounter
 0x43a1cc GetSystemTimeAsFileTime
 0x43a1d0 GetModuleFileNameA
 0x43a1d4 FreeEnvironmentStringsA
 0x43a1d8 GetEnvironmentStrings
 0x43a1dc WideCharToMultiByte
 0x43a1e0 GetEnvironmentStringsW
 0x43a1e4 SetHandleCount
 0x43a1e8 HeapDestroy
 0x43a1ec HeapCreate
 0x43a1f0 HeapFree
 0x43a1f4 VirtualFree
 0x43a1f8 FlushFileBuffers
 0x43a1fc GetConsoleCP
 0x43a200 HeapAlloc
 0x43a204 HeapSize
 0x43a208 HeapReAlloc
 0x43a20c VirtualAlloc
 0x43a210 GetACP
 0x43a214 GetOEMCP
 0x43a218 GetCPInfo
 0x43a21c IsValidCodePage
 0x43a220 MultiByteToWideChar
 0x43a224 GetStringTypeA
 0x43a228 GetStringTypeW
 0x43a22c GetLocaleInfoA
 0x43a230 InitializeCriticalSectionAndSpinCount
 0x43a234 WriteConsoleA
 0x43a238 GetConsoleOutputCP
 0x43a23c LCMapStringA
 0x43a240 GetModuleHandleA
 0x43a244 CloseHandle
 0x43a248 CreateFileA
USER32.dll
 0x43a250 GetCursorInfo

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure