popup

Report - vbc.exe

UPX Malicious Library PE32 OS Processor Check PE File
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.07.30 11:08 Machine s1_win7_x6401
Filename vbc.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
4
 Behavior Score
3.0
ZERO API file : malware
VT API (file) 50 detected (AIDetect, malware1, Androm, malicious, high confidence, Siggen14, GenericKDZ, Fragtor, Save, None, ZexaF, quW@ay480CiG, Attribute, HighConfidence, Kryptik, HLWM, Stop, PWSX, Fareit, Auto, Malware@#39033nah9rmim, Unsafe, Score, LokiBot, jiabi, kcloud, Azorult, R434797, ai score=100, BScope, R002H0DGT21, CLASSIC, Static AI, Malicious PE, susgen, Behavior, GdSda, confidence, 100%, HwoCueAA)
md5 af4ec0bc13149037006f88effdbd7643
sha256 c589ffaa33d14dab47ceff46ff04c32286f4d14f17ddd9c7cf64b1de69525c48
ssdeep 6144:18hySTUMuJfUqMURwSUZdfDNUahafv9O1Fk4mwyE:KySIMuJfUqMURedfDNUX3I1FKL
imphash ebe339f33228ec9cb9963341e6449ca2
impfuzzy 48:MZznFfOYCodplOEwW4pSYsFOWKaE8fcRhV85oceLXk7BY:MZEUplOJVRSbE8fcRhV85leLXkO
  Network IP location

Signature (6cnts)

Level Description
danger File has been identified by 50 AntiVirus engines on VirusTotal as malicious
watch Tries to unhook Windows functions monitored by Cuckoo
notice Allocates read-write-execute memory (usually to unpack itself)
notice The binary likely contains encrypted or compressed data indicative of a packer
info One or more processes crashed
info This executable has a PDB path

Rules (5cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x421000 GetComputerNameA
 0x421004 UnregisterWait
 0x421008 SetFilePointer
 0x42100c lstrlenA
 0x421010 GetConsoleAliasesLengthW
 0x421014 CopyFileExW
 0x421018 TlsGetValue
 0x42101c GetConsoleAliasExesA
 0x421020 GetConsoleAliasExesLengthA
 0x421024 MapUserPhysicalPages
 0x421028 InterlockedIncrement
 0x42102c VerSetConditionMask
 0x421030 InterlockedDecrement
 0x421034 ZombifyActCtx
 0x421038 CompareFileTime
 0x42103c GetSystemWindowsDirectoryW
 0x421040 SetEnvironmentVariableW
 0x421044 GlobalLock
 0x421048 WriteConsoleInputA
 0x42104c FreeEnvironmentStringsA
 0x421050 VirtualFree
 0x421054 GenerateConsoleCtrlEvent
 0x421058 WriteFile
 0x42105c SetCommState
 0x421060 SetProcessPriorityBoost
 0x421064 FindResourceExA
 0x421068 LoadLibraryW
 0x42106c GetCalendarInfoA
 0x421070 InitAtomTable
 0x421074 GlobalFlags
 0x421078 GetComputerNameExA
 0x42107c GetConsoleAliasW
 0x421080 SetConsoleCursorPosition
 0x421084 GetBinaryTypeW
 0x421088 InterlockedExchange
 0x42108c GetFileSizeEx
 0x421090 SetCurrentDirectoryA
 0x421094 GetStartupInfoA
 0x421098 GetCPInfoExW
 0x42109c FreeLibraryAndExitThread
 0x4210a0 GetCurrentDirectoryW
 0x4210a4 ReadConsoleOutputCharacterA
 0x4210a8 GetProcAddress
 0x4210ac SetFirmwareEnvironmentVariableW
 0x4210b0 CreateNamedPipeA
 0x4210b4 ReadFileEx
 0x4210b8 SetStdHandle
 0x4210bc SetComputerNameA
 0x4210c0 GetPrivateProfileStringA
 0x4210c4 GetLocalTime
 0x4210c8 LoadLibraryA
 0x4210cc OpenMutexA
 0x4210d0 CreateSemaphoreW
 0x4210d4 LocalAlloc
 0x4210d8 WriteProfileSectionW
 0x4210dc FindAtomA
 0x4210e0 SetSystemTime
 0x4210e4 CreateIoCompletionPort
 0x4210e8 SetConsoleTitleW
 0x4210ec EnumResourceNamesA
 0x4210f0 WriteProfileStringW
 0x4210f4 BuildCommDCBA
 0x4210f8 CompareStringA
 0x4210fc GetFileAttributesExW
 0x421100 GetConsoleCursorInfo
 0x421104 FatalAppExitA
 0x421108 GetCPInfoExA
 0x42110c _lopen
 0x421110 GetVersionExA
 0x421114 FindAtomW
 0x421118 GetProfileSectionW
 0x42111c AreFileApisANSI
 0x421120 CommConfigDialogW
 0x421124 DeleteFileA
 0x421128 FlushFileBuffers
 0x42112c GetLastError
 0x421130 MoveFileA
 0x421134 GetCommandLineA
 0x421138 HeapValidate
 0x42113c IsBadReadPtr
 0x421140 RaiseException
 0x421144 DeleteCriticalSection
 0x421148 EnterCriticalSection
 0x42114c LeaveCriticalSection
 0x421150 GetModuleFileNameW
 0x421154 SetUnhandledExceptionFilter
 0x421158 QueryPerformanceCounter
 0x42115c GetTickCount
 0x421160 GetCurrentThreadId
 0x421164 GetCurrentProcessId
 0x421168 GetSystemTimeAsFileTime
 0x42116c GetModuleHandleW
 0x421170 Sleep
 0x421174 ExitProcess
 0x421178 GetModuleFileNameA
 0x42117c GetEnvironmentStrings
 0x421180 FreeEnvironmentStringsW
 0x421184 WideCharToMultiByte
 0x421188 GetEnvironmentStringsW
 0x42118c SetHandleCount
 0x421190 GetStdHandle
 0x421194 GetFileType
 0x421198 TlsAlloc
 0x42119c TlsSetValue
 0x4211a0 TlsFree
 0x4211a4 SetLastError
 0x4211a8 HeapDestroy
 0x4211ac HeapCreate
 0x4211b0 HeapFree
 0x4211b4 HeapAlloc
 0x4211b8 TerminateProcess
 0x4211bc GetCurrentProcess
 0x4211c0 UnhandledExceptionFilter
 0x4211c4 IsDebuggerPresent
 0x4211c8 HeapSize
 0x4211cc HeapReAlloc
 0x4211d0 VirtualAlloc
 0x4211d4 GetACP
 0x4211d8 GetOEMCP
 0x4211dc GetCPInfo
 0x4211e0 IsValidCodePage
 0x4211e4 RtlUnwind
 0x4211e8 InitializeCriticalSectionAndSpinCount
 0x4211ec DebugBreak
 0x4211f0 OutputDebugStringA
 0x4211f4 WriteConsoleW
 0x4211f8 OutputDebugStringW
 0x4211fc MultiByteToWideChar
 0x421200 LCMapStringA
 0x421204 LCMapStringW
 0x421208 GetStringTypeA
 0x42120c GetStringTypeW
 0x421210 GetLocaleInfoA
 0x421214 GetConsoleCP
 0x421218 GetConsoleMode
 0x42121c WriteConsoleA
 0x421220 GetConsoleOutputCP
 0x421224 CreateFileA
 0x421228 CloseHandle
 0x42122c GetModuleHandleA
USER32.dll
 0x421234 GetMessageTime
 0x421238 GetMenuInfo

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure