ScreenShot
Created | 2021.08.19 19:06 | Machine | s1_win7_x6402 |
Filename | vbc.exe | ||
Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
AI Score |
|
Behavior Score |
|
ZERO API | file : malware | ||
VT API (file) | 24 detected (AIDetect, malware2, malicious, high confidence, GenericRXAA, Unsafe, Save, ZexaF, rqW@aGD1V7jK, Attribute, HighConfidence, Androm, Glupteba, susgen, Lokibot, score, Azorult, Obscure, CLASSIC, Static AI, Malicious PE, confidence, 100%, QVM10) | ||
md5 | 3044a22ab226af46ec2210a6b599580d | ||
sha256 | 326a1d117e9ef923d501834a27d9879e838906747cd53beb64d63ccd380a163d | ||
ssdeep | 6144:w+evJx4cigYNFj2Sr3jgyLjvbR/rwKyl38CmM3c:iL4cgNFLr3j1vz1MKyFK | ||
imphash | 62fa754aafe9b531ba4be35dd30caae7 | ||
impfuzzy | 48:OizCRxOD6r0q25V1YpXYGphGXTfOtaELtQkfcJSoXl/g0:Nj+WVMXYghGXTffELtQkfcJSul/g0 |
Network IP location
Signature (5cnts)
Level | Description |
---|---|
warning | File has been identified by 24 AntiVirus engines on VirusTotal as malicious |
notice | Allocates read-write-execute memory (usually to unpack itself) |
notice | The binary likely contains encrypted or compressed data indicative of a packer |
info | The file contains an unknown PE resource name possibly indicative of a packer |
info | This executable has a PDB path |
Rules (4cnts)
Level | Name | Description | Collection |
---|---|---|---|
watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
watch | UPX_Zero | UPX packed file | binaries (upload) |
info | IsPE32 | (no description) | binaries (upload) |
info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41d000 GetComputerNameA
0x41d004 GetThreadContext
0x41d008 FileTimeToDosDateTime
0x41d00c GetNativeSystemInfo
0x41d010 SetFilePointer
0x41d014 lstrlenA
0x41d018 GetConsoleAliasesLengthW
0x41d01c SetLocalTime
0x41d020 InterlockedIncrement
0x41d024 GetQueuedCompletionStatus
0x41d028 InterlockedDecrement
0x41d02c GetSystemWindowsDirectoryW
0x41d030 WaitForSingleObject
0x41d034 GetComputerNameW
0x41d038 FreeEnvironmentStringsA
0x41d03c GetTickCount
0x41d040 WaitNamedPipeW
0x41d044 WriteFile
0x41d048 SetCommState
0x41d04c GetCommandLineA
0x41d050 TlsSetValue
0x41d054 GetPriorityClass
0x41d058 AddRefActCtx
0x41d05c GetConsoleMode
0x41d060 FatalAppExitW
0x41d064 CopyFileW
0x41d068 GetVersionExW
0x41d06c SetConsoleMode
0x41d070 GetBinaryTypeA
0x41d074 TerminateProcess
0x41d078 IsDBCSLeadByte
0x41d07c GetOverlappedResult
0x41d080 GlobalUnlock
0x41d084 VerifyVersionInfoW
0x41d088 CreateDirectoryA
0x41d08c GetFileSizeEx
0x41d090 GetStartupInfoA
0x41d094 GetLastError
0x41d098 ReadConsoleOutputCharacterA
0x41d09c GetProcAddress
0x41d0a0 VirtualAlloc
0x41d0a4 WriteProfileSectionA
0x41d0a8 GetPrivateProfileStringA
0x41d0ac ResetEvent
0x41d0b0 OpenWaitableTimerA
0x41d0b4 LoadLibraryA
0x41d0b8 OpenMutexA
0x41d0bc CreateSemaphoreW
0x41d0c0 LocalAlloc
0x41d0c4 SetCurrentDirectoryW
0x41d0c8 HeapWalk
0x41d0cc WriteProfileStringA
0x41d0d0 SetConsoleCursorInfo
0x41d0d4 CreateIoCompletionPort
0x41d0d8 GetModuleHandleA
0x41d0dc EnumResourceNamesA
0x41d0e0 CompareStringA
0x41d0e4 GetCurrentThreadId
0x41d0e8 GetCPInfoExA
0x41d0ec SetThreadAffinityMask
0x41d0f0 OpenSemaphoreW
0x41d0f4 FindAtomW
0x41d0f8 UnregisterWaitEx
0x41d0fc LCMapStringW
0x41d100 CopyFileExA
0x41d104 DeleteFileA
0x41d108 WideCharToMultiByte
0x41d10c HeapValidate
0x41d110 IsBadReadPtr
0x41d114 RaiseException
0x41d118 GetCurrentProcess
0x41d11c UnhandledExceptionFilter
0x41d120 SetUnhandledExceptionFilter
0x41d124 IsDebuggerPresent
0x41d128 GetModuleFileNameW
0x41d12c GetACP
0x41d130 GetOEMCP
0x41d134 GetCPInfo
0x41d138 IsValidCodePage
0x41d13c TlsGetValue
0x41d140 GetModuleHandleW
0x41d144 TlsAlloc
0x41d148 TlsFree
0x41d14c SetLastError
0x41d150 Sleep
0x41d154 ExitProcess
0x41d158 DeleteCriticalSection
0x41d15c EnterCriticalSection
0x41d160 LeaveCriticalSection
0x41d164 QueryPerformanceCounter
0x41d168 GetCurrentProcessId
0x41d16c GetSystemTimeAsFileTime
0x41d170 GetModuleFileNameA
0x41d174 GetEnvironmentStrings
0x41d178 FreeEnvironmentStringsW
0x41d17c GetEnvironmentStringsW
0x41d180 SetHandleCount
0x41d184 GetStdHandle
0x41d188 GetFileType
0x41d18c HeapDestroy
0x41d190 HeapCreate
0x41d194 HeapFree
0x41d198 VirtualFree
0x41d19c HeapAlloc
0x41d1a0 HeapSize
0x41d1a4 HeapReAlloc
0x41d1a8 DebugBreak
0x41d1ac OutputDebugStringA
0x41d1b0 WriteConsoleW
0x41d1b4 OutputDebugStringW
0x41d1b8 LoadLibraryW
0x41d1bc RtlUnwind
0x41d1c0 MultiByteToWideChar
0x41d1c4 LCMapStringA
0x41d1c8 GetStringTypeA
0x41d1cc GetStringTypeW
0x41d1d0 GetLocaleInfoA
0x41d1d4 InitializeCriticalSectionAndSpinCount
0x41d1d8 GetConsoleCP
0x41d1dc SetStdHandle
0x41d1e0 WriteConsoleA
0x41d1e4 GetConsoleOutputCP
0x41d1e8 CreateFileA
0x41d1ec CloseHandle
0x41d1f0 FlushFileBuffers
EAT(Export Address Table) is none
KERNEL32.dll
0x41d000 GetComputerNameA
0x41d004 GetThreadContext
0x41d008 FileTimeToDosDateTime
0x41d00c GetNativeSystemInfo
0x41d010 SetFilePointer
0x41d014 lstrlenA
0x41d018 GetConsoleAliasesLengthW
0x41d01c SetLocalTime
0x41d020 InterlockedIncrement
0x41d024 GetQueuedCompletionStatus
0x41d028 InterlockedDecrement
0x41d02c GetSystemWindowsDirectoryW
0x41d030 WaitForSingleObject
0x41d034 GetComputerNameW
0x41d038 FreeEnvironmentStringsA
0x41d03c GetTickCount
0x41d040 WaitNamedPipeW
0x41d044 WriteFile
0x41d048 SetCommState
0x41d04c GetCommandLineA
0x41d050 TlsSetValue
0x41d054 GetPriorityClass
0x41d058 AddRefActCtx
0x41d05c GetConsoleMode
0x41d060 FatalAppExitW
0x41d064 CopyFileW
0x41d068 GetVersionExW
0x41d06c SetConsoleMode
0x41d070 GetBinaryTypeA
0x41d074 TerminateProcess
0x41d078 IsDBCSLeadByte
0x41d07c GetOverlappedResult
0x41d080 GlobalUnlock
0x41d084 VerifyVersionInfoW
0x41d088 CreateDirectoryA
0x41d08c GetFileSizeEx
0x41d090 GetStartupInfoA
0x41d094 GetLastError
0x41d098 ReadConsoleOutputCharacterA
0x41d09c GetProcAddress
0x41d0a0 VirtualAlloc
0x41d0a4 WriteProfileSectionA
0x41d0a8 GetPrivateProfileStringA
0x41d0ac ResetEvent
0x41d0b0 OpenWaitableTimerA
0x41d0b4 LoadLibraryA
0x41d0b8 OpenMutexA
0x41d0bc CreateSemaphoreW
0x41d0c0 LocalAlloc
0x41d0c4 SetCurrentDirectoryW
0x41d0c8 HeapWalk
0x41d0cc WriteProfileStringA
0x41d0d0 SetConsoleCursorInfo
0x41d0d4 CreateIoCompletionPort
0x41d0d8 GetModuleHandleA
0x41d0dc EnumResourceNamesA
0x41d0e0 CompareStringA
0x41d0e4 GetCurrentThreadId
0x41d0e8 GetCPInfoExA
0x41d0ec SetThreadAffinityMask
0x41d0f0 OpenSemaphoreW
0x41d0f4 FindAtomW
0x41d0f8 UnregisterWaitEx
0x41d0fc LCMapStringW
0x41d100 CopyFileExA
0x41d104 DeleteFileA
0x41d108 WideCharToMultiByte
0x41d10c HeapValidate
0x41d110 IsBadReadPtr
0x41d114 RaiseException
0x41d118 GetCurrentProcess
0x41d11c UnhandledExceptionFilter
0x41d120 SetUnhandledExceptionFilter
0x41d124 IsDebuggerPresent
0x41d128 GetModuleFileNameW
0x41d12c GetACP
0x41d130 GetOEMCP
0x41d134 GetCPInfo
0x41d138 IsValidCodePage
0x41d13c TlsGetValue
0x41d140 GetModuleHandleW
0x41d144 TlsAlloc
0x41d148 TlsFree
0x41d14c SetLastError
0x41d150 Sleep
0x41d154 ExitProcess
0x41d158 DeleteCriticalSection
0x41d15c EnterCriticalSection
0x41d160 LeaveCriticalSection
0x41d164 QueryPerformanceCounter
0x41d168 GetCurrentProcessId
0x41d16c GetSystemTimeAsFileTime
0x41d170 GetModuleFileNameA
0x41d174 GetEnvironmentStrings
0x41d178 FreeEnvironmentStringsW
0x41d17c GetEnvironmentStringsW
0x41d180 SetHandleCount
0x41d184 GetStdHandle
0x41d188 GetFileType
0x41d18c HeapDestroy
0x41d190 HeapCreate
0x41d194 HeapFree
0x41d198 VirtualFree
0x41d19c HeapAlloc
0x41d1a0 HeapSize
0x41d1a4 HeapReAlloc
0x41d1a8 DebugBreak
0x41d1ac OutputDebugStringA
0x41d1b0 WriteConsoleW
0x41d1b4 OutputDebugStringW
0x41d1b8 LoadLibraryW
0x41d1bc RtlUnwind
0x41d1c0 MultiByteToWideChar
0x41d1c4 LCMapStringA
0x41d1c8 GetStringTypeA
0x41d1cc GetStringTypeW
0x41d1d0 GetLocaleInfoA
0x41d1d4 InitializeCriticalSectionAndSpinCount
0x41d1d8 GetConsoleCP
0x41d1dc SetStdHandle
0x41d1e0 WriteConsoleA
0x41d1e4 GetConsoleOutputCP
0x41d1e8 CreateFileA
0x41d1ec CloseHandle
0x41d1f0 FlushFileBuffers
EAT(Export Address Table) is none