Report - vbc.exe

Malicious Library PE File PE32
ScreenShot
Created 2021.09.23 08:54 Machine s1_win7_x6401
Filename vbc.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
4
Behavior Score
2.6
ZERO API file : clean
VT API (file) 48 detected (malicious, high confidence, Siggen3, GenericKD, Stop, Unsafe, Save, StopCrypt, ZexaF, quW@aqK3ABkO, Kryptik, Eldorado, Attribute, HighConfidence, HMMU, jbmmwc, DropperX, Fareit, Auto, Krypt, rhgco, ai score=80, XGXYJ9, score, MalPE, R441918, Azorult, VSNW11I21, CLASSIC, Static AI, Malicious PE, susgen, HMNW, GdSda, confidence, 100%)
md5 f7896603ae14a91903ac46e5f31b182f
sha256 9e6517b60e2944a83b71cff5a2115ca5ff5cf44ccddc545fa9c8eee8ca5aa2b8
ssdeep 6144:3MW1mxsZjLVTfMiBxMoZ/eyjX24CR46rgFMe1jfC7V:c1+vhfMjorjXiZUFBLC7
imphash bf7145a8be1827f6adef042a2aa5d4db
impfuzzy 48:CkPOJ4iOYe4Ud6qerZF+Sj4KaEZtJocJc+eTVy:Mq6Eperj+SjMEZtJocJc+EVy
  Network IP location

Signature (5cnts)

Level Description
danger File has been identified by 48 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice Foreign language identified in PE resource
notice The binary likely contains encrypted or compressed data indicative of a packer
info This executable has a PDB path

Rules (3cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x41f000 GetCommandLineW
 0x41f004 GetThreadContext
 0x41f008 FileTimeToDosDateTime
 0x41f00c HeapReAlloc
 0x41f010 GetNativeSystemInfo
 0x41f014 FindFirstChangeNotificationW
 0x41f018 CopyFileExW
 0x41f01c TlsGetValue
 0x41f020 GetStringTypeA
 0x41f024 SetLocalTime
 0x41f028 CallNamedPipeA
 0x41f02c SetWaitableTimer
 0x41f030 InterlockedIncrement
 0x41f034 GetNamedPipeHandleStateA
 0x41f038 CreateDirectoryW
 0x41f03c GlobalLock
 0x41f040 SetHandleInformation
 0x41f044 GetProfileStringW
 0x41f048 GetProfileSectionA
 0x41f04c FreeEnvironmentStringsA
 0x41f050 GetModuleHandleW
 0x41f054 GetPrivateProfileStringW
 0x41f058 ReadConsoleW
 0x41f05c GetCompressedFileSizeW
 0x41f060 SetCommState
 0x41f064 SetProcessPriorityBoost
 0x41f068 GlobalAlloc
 0x41f06c GetVolumeInformationA
 0x41f070 LoadLibraryW
 0x41f074 TerminateThread
 0x41f078 GetSystemWindowsDirectoryA
 0x41f07c VerifyVersionInfoA
 0x41f080 EnumResourceLanguagesA
 0x41f084 IsDBCSLeadByte
 0x41f088 GetSystemDirectoryA
 0x41f08c lstrlenW
 0x41f090 WritePrivateProfileStringW
 0x41f094 DeactivateActCtx
 0x41f098 LCMapStringA
 0x41f09c GetPrivateProfileIntW
 0x41f0a0 InterlockedExchange
 0x41f0a4 GetStartupInfoA
 0x41f0a8 GetCPInfoExW
 0x41f0ac GetLastError
 0x41f0b0 GetThreadLocale
 0x41f0b4 GetProcAddress
 0x41f0b8 SetStdHandle
 0x41f0bc EnterCriticalSection
 0x41f0c0 DisableThreadLibraryCalls
 0x41f0c4 LoadLibraryA
 0x41f0c8 FindAtomA
 0x41f0cc GetOEMCP
 0x41f0d0 Process32NextW
 0x41f0d4 WriteProfileStringA
 0x41f0d8 GetThreadPriority
 0x41f0dc QueryMemoryResourceNotification
 0x41f0e0 HeapSetInformation
 0x41f0e4 FreeEnvironmentStringsW
 0x41f0e8 FindNextFileW
 0x41f0ec GetCurrentDirectoryA
 0x41f0f0 GetCurrentThreadId
 0x41f0f4 LocalSize
 0x41f0f8 UnregisterWaitEx
 0x41f0fc GetSystemTime
 0x41f100 GetCommandLineA
 0x41f104 HeapValidate
 0x41f108 IsBadReadPtr
 0x41f10c RaiseException
 0x41f110 TerminateProcess
 0x41f114 GetCurrentProcess
 0x41f118 UnhandledExceptionFilter
 0x41f11c SetUnhandledExceptionFilter
 0x41f120 IsDebuggerPresent
 0x41f124 GetModuleFileNameW
 0x41f128 InterlockedDecrement
 0x41f12c RtlUnwind
 0x41f130 GetACP
 0x41f134 GetCPInfo
 0x41f138 IsValidCodePage
 0x41f13c TlsAlloc
 0x41f140 TlsSetValue
 0x41f144 TlsFree
 0x41f148 SetLastError
 0x41f14c DeleteCriticalSection
 0x41f150 LeaveCriticalSection
 0x41f154 QueryPerformanceCounter
 0x41f158 GetTickCount
 0x41f15c GetCurrentProcessId
 0x41f160 GetSystemTimeAsFileTime
 0x41f164 Sleep
 0x41f168 ExitProcess
 0x41f16c GetModuleFileNameA
 0x41f170 GetEnvironmentStrings
 0x41f174 WideCharToMultiByte
 0x41f178 GetEnvironmentStringsW
 0x41f17c SetHandleCount
 0x41f180 GetStdHandle
 0x41f184 GetFileType
 0x41f188 HeapDestroy
 0x41f18c HeapCreate
 0x41f190 HeapFree
 0x41f194 VirtualFree
 0x41f198 WriteFile
 0x41f19c HeapAlloc
 0x41f1a0 HeapSize
 0x41f1a4 VirtualAlloc
 0x41f1a8 SetFilePointer
 0x41f1ac GetConsoleCP
 0x41f1b0 GetConsoleMode
 0x41f1b4 DebugBreak
 0x41f1b8 OutputDebugStringA
 0x41f1bc WriteConsoleW
 0x41f1c0 OutputDebugStringW
 0x41f1c4 MultiByteToWideChar
 0x41f1c8 GetStringTypeW
 0x41f1cc GetLocaleInfoA
 0x41f1d0 LCMapStringW
 0x41f1d4 InitializeCriticalSectionAndSpinCount
 0x41f1d8 WriteConsoleA
 0x41f1dc GetConsoleOutputCP
 0x41f1e0 CreateFileA
 0x41f1e4 CloseHandle
 0x41f1e8 FlushFileBuffers
WINHTTP.dll
 0x41f1f0 WinHttpQueryOption

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure