ScreenShot
| Created | 2021.09.17 09:45 | Machine | s1_win7_x6402 |
| Filename | vbc.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 47 detected (malicious, high confidence, GenericKD, GenericRXPZ, Unsafe, Save, Androm, Kryptik, Eldorado, HMKO, RansomX, Fareit, Auto, HPGen, Static AI, Malicious PE, bbnt, mbsgo, StopCrypt, score, CoinMiner, Glupteba, R440970, CLASSIC, susgen, ZexaF, lq0@aG5ZoKU, GdSda, confidence, 100%) | ||
| md5 | 7789bd4d79ad897126a68bf3e74f4e1b | ||
| sha256 | 40b073c5ab4b0d8bd6e03bec7553e2f4a03fed27442b4bcd01db5297f103573c | ||
| ssdeep | 3072:4AvBvFx1+GJtDUhWSH0fsYf/usOOdF+Z/j5W5Eaw2/N:4A+GJShWScnb3cc3w21 | ||
| imphash | 311b6c030e043059833e0196a691b0ad | ||
| impfuzzy | 24:UAkVZZZyxj1bXDYOZ94OGOovLt/J3JdObPv8Ryv9kRTAjMcTplHv9:UVZZZWuOZZB0thPOx9gAttV | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 47 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x421000 GetLocaleInfoA
0x421004 DebugActiveProcessStop
0x421008 lstrcpynA
0x42100c InterlockedIncrement
0x421010 InterlockedDecrement
0x421014 GetCurrentProcess
0x421018 GetSystemWindowsDirectoryW
0x42101c GetUserDefaultLCID
0x421020 GetSystemDefaultLCID
0x421024 ReadConsoleW
0x421028 GetEnvironmentStrings
0x42102c GetLocaleInfoW
0x421030 LeaveCriticalSection
0x421034 GetModuleFileNameW
0x421038 GetACP
0x42103c SetConsoleTitleA
0x421040 GetConsoleOutputCP
0x421044 VerifyVersionInfoW
0x421048 GetProcAddress
0x42104c EnterCriticalSection
0x421050 ResetEvent
0x421054 GetAtomNameA
0x421058 WriteConsoleA
0x42105c LocalAlloc
0x421060 SetSystemTime
0x421064 GetModuleHandleA
0x421068 Module32Next
0x42106c GetCurrentProcessId
0x421070 AddConsoleAliasA
0x421074 GetCommandLineW
0x421078 GetCommandLineA
0x42107c GetStartupInfoA
0x421080 TerminateProcess
0x421084 UnhandledExceptionFilter
0x421088 SetUnhandledExceptionFilter
0x42108c IsDebuggerPresent
0x421090 GetModuleHandleW
0x421094 TlsGetValue
0x421098 TlsAlloc
0x42109c TlsSetValue
0x4210a0 TlsFree
0x4210a4 SetLastError
0x4210a8 GetCurrentThreadId
0x4210ac GetLastError
0x4210b0 HeapAlloc
0x4210b4 Sleep
0x4210b8 HeapSize
0x4210bc ExitProcess
0x4210c0 RtlUnwind
0x4210c4 HeapFree
0x4210c8 SetFilePointer
0x4210cc WriteFile
0x4210d0 GetStdHandle
0x4210d4 GetModuleFileNameA
0x4210d8 FreeEnvironmentStringsA
0x4210dc FreeEnvironmentStringsW
0x4210e0 WideCharToMultiByte
0x4210e4 GetEnvironmentStringsW
0x4210e8 SetHandleCount
0x4210ec GetFileType
0x4210f0 DeleteCriticalSection
0x4210f4 HeapCreate
0x4210f8 VirtualFree
0x4210fc QueryPerformanceCounter
0x421100 GetTickCount
0x421104 GetSystemTimeAsFileTime
0x421108 GetConsoleCP
0x42110c GetConsoleMode
0x421110 GetCPInfo
0x421114 GetOEMCP
0x421118 IsValidCodePage
0x42111c RaiseException
0x421120 VirtualAlloc
0x421124 HeapReAlloc
0x421128 LoadLibraryA
0x42112c InitializeCriticalSectionAndSpinCount
0x421130 CloseHandle
0x421134 CreateFileA
0x421138 SetStdHandle
0x42113c FlushFileBuffers
0x421140 WriteConsoleW
0x421144 MultiByteToWideChar
0x421148 LCMapStringA
0x42114c LCMapStringW
0x421150 GetStringTypeA
0x421154 GetStringTypeW
0x421158 SetEndOfFile
0x42115c GetProcessHeap
0x421160 ReadFile
EAT(Export Address Table) Library
0x401046 @GetAnotherVice@12
KERNEL32.dll
0x421000 GetLocaleInfoA
0x421004 DebugActiveProcessStop
0x421008 lstrcpynA
0x42100c InterlockedIncrement
0x421010 InterlockedDecrement
0x421014 GetCurrentProcess
0x421018 GetSystemWindowsDirectoryW
0x42101c GetUserDefaultLCID
0x421020 GetSystemDefaultLCID
0x421024 ReadConsoleW
0x421028 GetEnvironmentStrings
0x42102c GetLocaleInfoW
0x421030 LeaveCriticalSection
0x421034 GetModuleFileNameW
0x421038 GetACP
0x42103c SetConsoleTitleA
0x421040 GetConsoleOutputCP
0x421044 VerifyVersionInfoW
0x421048 GetProcAddress
0x42104c EnterCriticalSection
0x421050 ResetEvent
0x421054 GetAtomNameA
0x421058 WriteConsoleA
0x42105c LocalAlloc
0x421060 SetSystemTime
0x421064 GetModuleHandleA
0x421068 Module32Next
0x42106c GetCurrentProcessId
0x421070 AddConsoleAliasA
0x421074 GetCommandLineW
0x421078 GetCommandLineA
0x42107c GetStartupInfoA
0x421080 TerminateProcess
0x421084 UnhandledExceptionFilter
0x421088 SetUnhandledExceptionFilter
0x42108c IsDebuggerPresent
0x421090 GetModuleHandleW
0x421094 TlsGetValue
0x421098 TlsAlloc
0x42109c TlsSetValue
0x4210a0 TlsFree
0x4210a4 SetLastError
0x4210a8 GetCurrentThreadId
0x4210ac GetLastError
0x4210b0 HeapAlloc
0x4210b4 Sleep
0x4210b8 HeapSize
0x4210bc ExitProcess
0x4210c0 RtlUnwind
0x4210c4 HeapFree
0x4210c8 SetFilePointer
0x4210cc WriteFile
0x4210d0 GetStdHandle
0x4210d4 GetModuleFileNameA
0x4210d8 FreeEnvironmentStringsA
0x4210dc FreeEnvironmentStringsW
0x4210e0 WideCharToMultiByte
0x4210e4 GetEnvironmentStringsW
0x4210e8 SetHandleCount
0x4210ec GetFileType
0x4210f0 DeleteCriticalSection
0x4210f4 HeapCreate
0x4210f8 VirtualFree
0x4210fc QueryPerformanceCounter
0x421100 GetTickCount
0x421104 GetSystemTimeAsFileTime
0x421108 GetConsoleCP
0x42110c GetConsoleMode
0x421110 GetCPInfo
0x421114 GetOEMCP
0x421118 IsValidCodePage
0x42111c RaiseException
0x421120 VirtualAlloc
0x421124 HeapReAlloc
0x421128 LoadLibraryA
0x42112c InitializeCriticalSectionAndSpinCount
0x421130 CloseHandle
0x421134 CreateFileA
0x421138 SetStdHandle
0x42113c FlushFileBuffers
0x421140 WriteConsoleW
0x421144 MultiByteToWideChar
0x421148 LCMapStringA
0x42114c LCMapStringW
0x421150 GetStringTypeA
0x421154 GetStringTypeW
0x421158 SetEndOfFile
0x42115c GetProcessHeap
0x421160 ReadFile
EAT(Export Address Table) Library
0x401046 @GetAnotherVice@12