Report - vbc.exe

UPX Malicious Library PE File PE32
ScreenShot
Created 2021.08.19 19:06 Machine s1_win7_x6402
Filename vbc.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
2
Behavior Score
2.0
ZERO API file : malware
VT API (file) 24 detected (AIDetect, malware2, malicious, high confidence, GenericRXAA, Unsafe, Save, ZexaF, rqW@aGD1V7jK, Attribute, HighConfidence, Androm, Glupteba, susgen, Lokibot, score, Azorult, Obscure, CLASSIC, Static AI, Malicious PE, confidence, 100%, QVM10)
md5 3044a22ab226af46ec2210a6b599580d
sha256 326a1d117e9ef923d501834a27d9879e838906747cd53beb64d63ccd380a163d
ssdeep 6144:w+evJx4cigYNFj2Sr3jgyLjvbR/rwKyl38CmM3c:iL4cgNFLr3j1vz1MKyFK
imphash 62fa754aafe9b531ba4be35dd30caae7
impfuzzy 48:OizCRxOD6r0q25V1YpXYGphGXTfOtaELtQkfcJSoXl/g0:Nj+WVMXYghGXTffELtQkfcJSul/g0
  Network IP location

Signature (5cnts)

Level Description
warning File has been identified by 24 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice The binary likely contains encrypted or compressed data indicative of a packer
info The file contains an unknown PE resource name possibly indicative of a packer
info This executable has a PDB path

Rules (4cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x41d000 GetComputerNameA
 0x41d004 GetThreadContext
 0x41d008 FileTimeToDosDateTime
 0x41d00c GetNativeSystemInfo
 0x41d010 SetFilePointer
 0x41d014 lstrlenA
 0x41d018 GetConsoleAliasesLengthW
 0x41d01c SetLocalTime
 0x41d020 InterlockedIncrement
 0x41d024 GetQueuedCompletionStatus
 0x41d028 InterlockedDecrement
 0x41d02c GetSystemWindowsDirectoryW
 0x41d030 WaitForSingleObject
 0x41d034 GetComputerNameW
 0x41d038 FreeEnvironmentStringsA
 0x41d03c GetTickCount
 0x41d040 WaitNamedPipeW
 0x41d044 WriteFile
 0x41d048 SetCommState
 0x41d04c GetCommandLineA
 0x41d050 TlsSetValue
 0x41d054 GetPriorityClass
 0x41d058 AddRefActCtx
 0x41d05c GetConsoleMode
 0x41d060 FatalAppExitW
 0x41d064 CopyFileW
 0x41d068 GetVersionExW
 0x41d06c SetConsoleMode
 0x41d070 GetBinaryTypeA
 0x41d074 TerminateProcess
 0x41d078 IsDBCSLeadByte
 0x41d07c GetOverlappedResult
 0x41d080 GlobalUnlock
 0x41d084 VerifyVersionInfoW
 0x41d088 CreateDirectoryA
 0x41d08c GetFileSizeEx
 0x41d090 GetStartupInfoA
 0x41d094 GetLastError
 0x41d098 ReadConsoleOutputCharacterA
 0x41d09c GetProcAddress
 0x41d0a0 VirtualAlloc
 0x41d0a4 WriteProfileSectionA
 0x41d0a8 GetPrivateProfileStringA
 0x41d0ac ResetEvent
 0x41d0b0 OpenWaitableTimerA
 0x41d0b4 LoadLibraryA
 0x41d0b8 OpenMutexA
 0x41d0bc CreateSemaphoreW
 0x41d0c0 LocalAlloc
 0x41d0c4 SetCurrentDirectoryW
 0x41d0c8 HeapWalk
 0x41d0cc WriteProfileStringA
 0x41d0d0 SetConsoleCursorInfo
 0x41d0d4 CreateIoCompletionPort
 0x41d0d8 GetModuleHandleA
 0x41d0dc EnumResourceNamesA
 0x41d0e0 CompareStringA
 0x41d0e4 GetCurrentThreadId
 0x41d0e8 GetCPInfoExA
 0x41d0ec SetThreadAffinityMask
 0x41d0f0 OpenSemaphoreW
 0x41d0f4 FindAtomW
 0x41d0f8 UnregisterWaitEx
 0x41d0fc LCMapStringW
 0x41d100 CopyFileExA
 0x41d104 DeleteFileA
 0x41d108 WideCharToMultiByte
 0x41d10c HeapValidate
 0x41d110 IsBadReadPtr
 0x41d114 RaiseException
 0x41d118 GetCurrentProcess
 0x41d11c UnhandledExceptionFilter
 0x41d120 SetUnhandledExceptionFilter
 0x41d124 IsDebuggerPresent
 0x41d128 GetModuleFileNameW
 0x41d12c GetACP
 0x41d130 GetOEMCP
 0x41d134 GetCPInfo
 0x41d138 IsValidCodePage
 0x41d13c TlsGetValue
 0x41d140 GetModuleHandleW
 0x41d144 TlsAlloc
 0x41d148 TlsFree
 0x41d14c SetLastError
 0x41d150 Sleep
 0x41d154 ExitProcess
 0x41d158 DeleteCriticalSection
 0x41d15c EnterCriticalSection
 0x41d160 LeaveCriticalSection
 0x41d164 QueryPerformanceCounter
 0x41d168 GetCurrentProcessId
 0x41d16c GetSystemTimeAsFileTime
 0x41d170 GetModuleFileNameA
 0x41d174 GetEnvironmentStrings
 0x41d178 FreeEnvironmentStringsW
 0x41d17c GetEnvironmentStringsW
 0x41d180 SetHandleCount
 0x41d184 GetStdHandle
 0x41d188 GetFileType
 0x41d18c HeapDestroy
 0x41d190 HeapCreate
 0x41d194 HeapFree
 0x41d198 VirtualFree
 0x41d19c HeapAlloc
 0x41d1a0 HeapSize
 0x41d1a4 HeapReAlloc
 0x41d1a8 DebugBreak
 0x41d1ac OutputDebugStringA
 0x41d1b0 WriteConsoleW
 0x41d1b4 OutputDebugStringW
 0x41d1b8 LoadLibraryW
 0x41d1bc RtlUnwind
 0x41d1c0 MultiByteToWideChar
 0x41d1c4 LCMapStringA
 0x41d1c8 GetStringTypeA
 0x41d1cc GetStringTypeW
 0x41d1d0 GetLocaleInfoA
 0x41d1d4 InitializeCriticalSectionAndSpinCount
 0x41d1d8 GetConsoleCP
 0x41d1dc SetStdHandle
 0x41d1e0 WriteConsoleA
 0x41d1e4 GetConsoleOutputCP
 0x41d1e8 CreateFileA
 0x41d1ec CloseHandle
 0x41d1f0 FlushFileBuffers

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure