ScreenShot
| Created | 2021.09.23 09:01 | Machine | s1_win7_x6401 |
| Filename | vbc.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 49 detected (Malicious, high confidence, Fragtor, Unsafe, Save, Azorult, confidence, 100%, Kryptik, Eldorado, Fareit, Androm, MalwareX, Auto, S + Troj, Krypt, Malware@#22z26p1dd6w1k, Static AI, Malicious PE, LokiBot, rfwau, ai score=100, STOP, se42434, score, CoinMiner, Glupteba, R441722, BScope, VSNW11I21, CLASSIC, GenKryptik, FKSO, ZexaF, nq0@auImkkkO, GdSda, susgen) | ||
| md5 | e50df54836bd38c86239e7f49917cb1c | ||
| sha256 | 25ff1ca479a76808bc6375b28d9c0905aece5d31a98f27ef39afdfafa060996a | ||
| ssdeep | 3072:OokgnLIbp7Xh1THa2ok6bhL1cIGo54IVLSQEOJH4yhJuIJB:LkgnLm7R1T62hqhL1pMIz5JHHz | ||
| imphash | 410705447b2186b51cd6d6e90a878e3a | ||
| impfuzzy | 24:viSrjtZ3aBDYeOdDhbET9VeOCtGTtDYRvDsJ3ISxVOTflmjMW3MEGANpHDJhK/:fZ3ayeOyTdQGTtwDUj0TrBADC/ | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 49 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x421008 LoadResource
0x42100c InterlockedIncrement
0x421010 ReadConsoleA
0x421014 GetCurrentProcess
0x421018 GetSystemWindowsDirectoryW
0x42101c GetEnvironmentStringsW
0x421020 WaitForSingleObject
0x421024 GetSystemDefaultLCID
0x421028 QueryActCtxW
0x42102c LeaveCriticalSection
0x421030 VerifyVersionInfoA
0x421034 GetModuleFileNameW
0x421038 GetLocaleInfoA
0x42103c GetProcAddress
0x421040 EnterCriticalSection
0x421044 DisableThreadLibraryCalls
0x421048 ResetEvent
0x42104c OpenMutexA
0x421050 WriteConsoleA
0x421054 LocalAlloc
0x421058 SetConsoleOutputCP
0x42105c GlobalGetAtomNameW
0x421060 WaitForMultipleObjects
0x421064 SetSystemTime
0x421068 GetModuleFileNameA
0x42106c GetModuleHandleA
0x421070 EraseTape
0x421074 FindFirstVolumeA
0x421078 GetCurrentProcessId
0x42107c AddConsoleAliasA
0x421080 FindActCtxSectionStringW
0x421084 ReleaseSemaphore
0x421088 GetCommandLineW
0x42108c GetLastError
0x421090 HeapReAlloc
0x421094 HeapAlloc
0x421098 GetStartupInfoW
0x42109c RaiseException
0x4210a0 RtlUnwind
0x4210a4 TerminateProcess
0x4210a8 UnhandledExceptionFilter
0x4210ac SetUnhandledExceptionFilter
0x4210b0 IsDebuggerPresent
0x4210b4 HeapFree
0x4210b8 SetHandleCount
0x4210bc GetStdHandle
0x4210c0 GetFileType
0x4210c4 GetStartupInfoA
0x4210c8 DeleteCriticalSection
0x4210cc SetFilePointer
0x4210d0 GetModuleHandleW
0x4210d4 TlsGetValue
0x4210d8 TlsAlloc
0x4210dc TlsSetValue
0x4210e0 TlsFree
0x4210e4 SetLastError
0x4210e8 GetCurrentThreadId
0x4210ec InterlockedDecrement
0x4210f0 HeapCreate
0x4210f4 VirtualFree
0x4210f8 VirtualAlloc
0x4210fc CloseHandle
0x421100 Sleep
0x421104 ExitProcess
0x421108 WriteFile
0x42110c FreeEnvironmentStringsW
0x421110 QueryPerformanceCounter
0x421114 GetTickCount
0x421118 GetSystemTimeAsFileTime
0x42111c CreateFileA
0x421120 InitializeCriticalSectionAndSpinCount
0x421124 SetStdHandle
0x421128 GetCPInfo
0x42112c GetACP
0x421130 GetOEMCP
0x421134 IsValidCodePage
0x421138 WideCharToMultiByte
0x42113c GetConsoleCP
0x421140 GetConsoleMode
0x421144 FlushFileBuffers
0x421148 HeapSize
0x42114c LoadLibraryA
0x421150 SetEndOfFile
0x421154 GetProcessHeap
0x421158 MultiByteToWideChar
0x42115c ReadFile
0x421160 GetStringTypeA
0x421164 GetStringTypeW
0x421168 LCMapStringA
0x42116c LCMapStringW
0x421170 GetConsoleOutputCP
0x421174 WriteConsoleW
USER32.dll
0x42117c RealChildWindowFromPoint
ADVAPI32.dll
0x421000 CloseEventLog
WINHTTP.dll
0x421184 WinHttpSetOption
EAT(Export Address Table) Library
0x401046 @SetFirstEverVice@8
0x40104f @SetViceVariants@12
KERNEL32.dll
0x421008 LoadResource
0x42100c InterlockedIncrement
0x421010 ReadConsoleA
0x421014 GetCurrentProcess
0x421018 GetSystemWindowsDirectoryW
0x42101c GetEnvironmentStringsW
0x421020 WaitForSingleObject
0x421024 GetSystemDefaultLCID
0x421028 QueryActCtxW
0x42102c LeaveCriticalSection
0x421030 VerifyVersionInfoA
0x421034 GetModuleFileNameW
0x421038 GetLocaleInfoA
0x42103c GetProcAddress
0x421040 EnterCriticalSection
0x421044 DisableThreadLibraryCalls
0x421048 ResetEvent
0x42104c OpenMutexA
0x421050 WriteConsoleA
0x421054 LocalAlloc
0x421058 SetConsoleOutputCP
0x42105c GlobalGetAtomNameW
0x421060 WaitForMultipleObjects
0x421064 SetSystemTime
0x421068 GetModuleFileNameA
0x42106c GetModuleHandleA
0x421070 EraseTape
0x421074 FindFirstVolumeA
0x421078 GetCurrentProcessId
0x42107c AddConsoleAliasA
0x421080 FindActCtxSectionStringW
0x421084 ReleaseSemaphore
0x421088 GetCommandLineW
0x42108c GetLastError
0x421090 HeapReAlloc
0x421094 HeapAlloc
0x421098 GetStartupInfoW
0x42109c RaiseException
0x4210a0 RtlUnwind
0x4210a4 TerminateProcess
0x4210a8 UnhandledExceptionFilter
0x4210ac SetUnhandledExceptionFilter
0x4210b0 IsDebuggerPresent
0x4210b4 HeapFree
0x4210b8 SetHandleCount
0x4210bc GetStdHandle
0x4210c0 GetFileType
0x4210c4 GetStartupInfoA
0x4210c8 DeleteCriticalSection
0x4210cc SetFilePointer
0x4210d0 GetModuleHandleW
0x4210d4 TlsGetValue
0x4210d8 TlsAlloc
0x4210dc TlsSetValue
0x4210e0 TlsFree
0x4210e4 SetLastError
0x4210e8 GetCurrentThreadId
0x4210ec InterlockedDecrement
0x4210f0 HeapCreate
0x4210f4 VirtualFree
0x4210f8 VirtualAlloc
0x4210fc CloseHandle
0x421100 Sleep
0x421104 ExitProcess
0x421108 WriteFile
0x42110c FreeEnvironmentStringsW
0x421110 QueryPerformanceCounter
0x421114 GetTickCount
0x421118 GetSystemTimeAsFileTime
0x42111c CreateFileA
0x421120 InitializeCriticalSectionAndSpinCount
0x421124 SetStdHandle
0x421128 GetCPInfo
0x42112c GetACP
0x421130 GetOEMCP
0x421134 IsValidCodePage
0x421138 WideCharToMultiByte
0x42113c GetConsoleCP
0x421140 GetConsoleMode
0x421144 FlushFileBuffers
0x421148 HeapSize
0x42114c LoadLibraryA
0x421150 SetEndOfFile
0x421154 GetProcessHeap
0x421158 MultiByteToWideChar
0x42115c ReadFile
0x421160 GetStringTypeA
0x421164 GetStringTypeW
0x421168 LCMapStringA
0x42116c LCMapStringW
0x421170 GetConsoleOutputCP
0x421174 WriteConsoleW
USER32.dll
0x42117c RealChildWindowFromPoint
ADVAPI32.dll
0x421000 CloseEventLog
WINHTTP.dll
0x421184 WinHttpSetOption
EAT(Export Address Table) Library
0x401046 @SetFirstEverVice@8
0x40104f @SetViceVariants@12