Report - vbc.exe

Generic Malware Malicious Packer UPX PE File PE32
ScreenShot
Created 2021.09.23 17:57 Machine s1_win7_x6401
Filename vbc.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
6
Behavior Score
2.2
ZERO API file : malware
VT API (file) 11 detected (AIDetect, malware2, malicious, high confidence, Unsafe, Save, Static AI, Suspicious PE, Sabsik, score, VBKrand, ZevbaCO, hm0@aeMJNImj)
md5 ccb092ded62c0a7ce793daa1873db0cb
sha256 abc97d710760f9449d691364d7ab0a7c3185f868625b8f05a8ab8facdebe54f1
ssdeep 1536:Zm+Fp/INAWumDNEoQ3AOoJtski0suyF/hz8Gi+u3IBZ:ZhvWf+R3ATB8W+u3OZ
imphash 59f9582f251e861f2c149d17f4ba80d5
impfuzzy 48:nhDGwzQwgPweTVkzBx4rk3u93F+xr1SxgdZ33dTlFNmW0yHLhw+3IkVWqxblMTSS:nhDGGQfPZTVkzBx4Q+91+xrwxgdZnVlo
  Network IP location

Signature (6cnts)

Level Description
watch File has been identified by 11 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Foreign language identified in PE resource
info Checks amount of memory in system
info The file contains an unknown PE resource name possibly indicative of a packer

Rules (5cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

MSVBVM60.DLL
 0x401000 None
 0x401004 _CIcos
 0x401008 _adj_fptan
 0x40100c __vbaVarMove
 0x401010 None
 0x401014 None
 0x401018 __vbaFreeVar
 0x40101c __vbaStrVarMove
 0x401020 __vbaFreeVarList
 0x401024 _adj_fdiv_m64
 0x401028 __vbaFreeObjList
 0x40102c _adj_fprem1
 0x401030 __vbaRecAnsiToUni
 0x401034 None
 0x401038 None
 0x40103c __vbaSetSystemError
 0x401040 __vbaRecDestruct
 0x401044 __vbaHresultCheckObj
 0x401048 None
 0x40104c _adj_fdiv_m32
 0x401050 None
 0x401054 __vbaAryDestruct
 0x401058 None
 0x40105c __vbaStrBool
 0x401060 None
 0x401064 None
 0x401068 __vbaObjSet
 0x40106c __vbaOnError
 0x401070 _adj_fdiv_m16i
 0x401074 __vbaObjSetAddref
 0x401078 _adj_fdivr_m16i
 0x40107c None
 0x401080 __vbaFpR8
 0x401084 _CIsin
 0x401088 None
 0x40108c __vbaChkstk
 0x401090 EVENT_SINK_AddRef
 0x401094 __vbaGenerateBoundsError
 0x401098 __vbaStrCmp
 0x40109c __vbaAryConstruct2
 0x4010a0 __vbaVarTstEq
 0x4010a4 __vbaI2I4
 0x4010a8 __vbaObjVar
 0x4010ac DllFunctionCall
 0x4010b0 _adj_fpatan
 0x4010b4 None
 0x4010b8 __vbaRecUniToAnsi
 0x4010bc EVENT_SINK_Release
 0x4010c0 _CIsqrt
 0x4010c4 EVENT_SINK_QueryInterface
 0x4010c8 __vbaExceptHandler
 0x4010cc _adj_fprem
 0x4010d0 _adj_fdivr_m64
 0x4010d4 __vbaFPException
 0x4010d8 __vbaStrVarVal
 0x4010dc __vbaVarCat
 0x4010e0 None
 0x4010e4 _CIlog
 0x4010e8 None
 0x4010ec __vbaFileOpen
 0x4010f0 None
 0x4010f4 __vbaNew2
 0x4010f8 None
 0x4010fc __vbaInStr
 0x401100 _adj_fdiv_m32i
 0x401104 _adj_fdivr_m32i
 0x401108 __vbaStrCopy
 0x40110c __vbaFreeStrList
 0x401110 _adj_fdivr_m32
 0x401114 _adj_fdiv_r
 0x401118 None
 0x40111c __vbaVarTstNe
 0x401120 None
 0x401124 __vbaStrToAnsi
 0x401128 __vbaVarDup
 0x40112c None
 0x401130 None
 0x401134 __vbaFpI4
 0x401138 __vbaRecDestructAnsi
 0x40113c _CIatan
 0x401140 __vbaStrMove
 0x401144 None
 0x401148 _allmul
 0x40114c __vbaLateIdSt
 0x401150 _CItan
 0x401154 None
 0x401158 __vbaFPInt
 0x40115c _CIexp
 0x401160 __vbaFreeObj
 0x401164 __vbaFreeStr

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure