ScreenShot
| Created | 2021.09.01 09:24 | Machine | s1_win7_x6402 |
| Filename | vbc.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 18 detected (AIDetect, malware2, Artemis, Unsafe, malicious, confidence, FileRepMalware, Generic ML PUA, TrojanAitInject, Score, 100%, Sabsik, susgen, AutoIt) | ||
| md5 | 29cf935bafff5bf4047f666dd4bc69e2 | ||
| sha256 | 91e8ea3e431c0ad9faf6dfe01eb29e4834940054379deb8b657d9cbe23e91682 | ||
| ssdeep | 24576:2hloDX0XOf4acOevCIhraMZ0JyWKtvGe:2hloJfbDevCuraMZ0JyWKo | ||
| imphash | ef471c0edf1877cd5a881a6a8bf647b9 | ||
| impfuzzy | 12:VA/DzqYOZQDe78r4B3ExjLAkcOaiTQQnd3mxCHoJ:V0DBace7PxExjLAkcOV2kw | ||
Network IP location
Signature (7cnts)
| Level | Description |
|---|---|
| watch | File has been identified by 18 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Terminates another process |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | The executable is compressed using UPX |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Schwerer_IN | Schwerer | binaries (upload) |
| warning | AutoIt | autoit | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.DLL
0x5c5760 LoadLibraryA
0x5c5764 GetProcAddress
0x5c5768 VirtualProtect
0x5c576c VirtualAlloc
0x5c5770 VirtualFree
0x5c5774 ExitProcess
ADVAPI32.dll
0x5c577c AddAce
COMCTL32.dll
0x5c5784 ImageList_Remove
COMDLG32.dll
0x5c578c GetSaveFileNameW
GDI32.dll
0x5c5794 LineTo
IPHLPAPI.DLL
0x5c579c IcmpSendEcho
MPR.dll
0x5c57a4 WNetUseConnectionW
ole32.dll
0x5c57ac CoGetObject
OLEAUT32.dll
0x5c57b4 VariantInit
PSAPI.DLL
0x5c57bc GetProcessMemoryInfo
SHELL32.dll
0x5c57c4 DragFinish
USER32.dll
0x5c57cc GetDC
USERENV.dll
0x5c57d4 LoadUserProfileW
UxTheme.dll
0x5c57dc IsThemeActive
VERSION.dll
0x5c57e4 VerQueryValueW
WININET.dll
0x5c57ec FtpOpenFileW
WINMM.dll
0x5c57f4 timeGetTime
WSOCK32.dll
0x5c57fc socket
EAT(Export Address Table) is none
KERNEL32.DLL
0x5c5760 LoadLibraryA
0x5c5764 GetProcAddress
0x5c5768 VirtualProtect
0x5c576c VirtualAlloc
0x5c5770 VirtualFree
0x5c5774 ExitProcess
ADVAPI32.dll
0x5c577c AddAce
COMCTL32.dll
0x5c5784 ImageList_Remove
COMDLG32.dll
0x5c578c GetSaveFileNameW
GDI32.dll
0x5c5794 LineTo
IPHLPAPI.DLL
0x5c579c IcmpSendEcho
MPR.dll
0x5c57a4 WNetUseConnectionW
ole32.dll
0x5c57ac CoGetObject
OLEAUT32.dll
0x5c57b4 VariantInit
PSAPI.DLL
0x5c57bc GetProcessMemoryInfo
SHELL32.dll
0x5c57c4 DragFinish
USER32.dll
0x5c57cc GetDC
USERENV.dll
0x5c57d4 LoadUserProfileW
UxTheme.dll
0x5c57dc IsThemeActive
VERSION.dll
0x5c57e4 VerQueryValueW
WININET.dll
0x5c57ec FtpOpenFileW
WINMM.dll
0x5c57f4 timeGetTime
WSOCK32.dll
0x5c57fc socket
EAT(Export Address Table) is none