ScreenShot
| Created | 2021.09.24 09:05 | Machine | s1_win7_x6401 |
| Filename | vbc.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 29 detected (malicious, high confidence, Unsafe, Save, Hacktool, ZexaF, lq0@a058ongO, Kryptik, Eldorado, Attribute, HighConfidence, HMOV, FileRepMalware, Emotet, Mokes, susgen, Racealer, score, BScope, MachineLearning, Anomalous, R06CH06IN21, Static AI, Malicious PE, confidence, 100%) | ||
| md5 | 44af6dd32a5f7d9077f00fd4d0d97bc4 | ||
| sha256 | 4d566be76db8dde4b26fc6647932d65750edfb47b46d909ec4d4ef3c6e12dadb | ||
| ssdeep | 3072:6swVLA2YtpE+DhIGOQOQVe4qQUi6YbC75RUVfiM2L//W4:b3BNJhOx4qQXUKf4L// | ||
| imphash | e7d6aacdbba2eaeadcddfcf1af169f5c | ||
| impfuzzy | 24:sirjrZu+VEdvccFaKOrb2fjO5DzrANOovEG1tD2wA+yvEvh/J3vT42l9wjMynNpk:BZfUiVrPprZVG1tSPHevc2enhts | ||
Network IP location
Signature (6cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 29 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Foreign language identified in PE resource |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41e014 InterlockedDecrement
0x41e018 GetEnvironmentStringsW
0x41e01c WaitForSingleObject
0x41e020 SetEvent
0x41e024 GetSystemDefaultLCID
0x41e028 GetEnvironmentStrings
0x41e02c GlobalAlloc
0x41e030 SizeofResource
0x41e034 LeaveCriticalSection
0x41e038 ReadFile
0x41e03c GetModuleFileNameW
0x41e040 GetDevicePowerState
0x41e044 GetConsoleOutputCP
0x41e048 VerLanguageNameA
0x41e04c RemoveDirectoryA
0x41e050 EnterCriticalSection
0x41e054 GlobalGetAtomNameA
0x41e058 PrepareTape
0x41e05c WriteConsoleA
0x41e060 GetProcessId
0x41e064 BeginUpdateResourceA
0x41e068 SetSystemTime
0x41e06c EnumResourceTypesW
0x41e070 GetModuleFileNameA
0x41e074 GetModuleHandleA
0x41e078 FindFirstVolumeA
0x41e07c ReleaseMutex
0x41e080 EndUpdateResourceA
0x41e084 LocalSize
0x41e088 GetWindowsDirectoryW
0x41e08c AddConsoleAliasA
0x41e090 FindActCtxSectionStringW
0x41e094 FindNextVolumeA
0x41e098 lstrcpyA
0x41e09c GetLocaleInfoA
0x41e0a0 GetCommandLineW
0x41e0a4 GetProcAddress
0x41e0a8 GetSystemDefaultLangID
0x41e0ac HeapAlloc
0x41e0b0 GetLastError
0x41e0b4 HeapReAlloc
0x41e0b8 GetCommandLineA
0x41e0bc GetStartupInfoA
0x41e0c0 RaiseException
0x41e0c4 RtlUnwind
0x41e0c8 TerminateProcess
0x41e0cc GetCurrentProcess
0x41e0d0 UnhandledExceptionFilter
0x41e0d4 SetUnhandledExceptionFilter
0x41e0d8 IsDebuggerPresent
0x41e0dc HeapFree
0x41e0e0 DeleteCriticalSection
0x41e0e4 VirtualFree
0x41e0e8 VirtualAlloc
0x41e0ec HeapCreate
0x41e0f0 GetModuleHandleW
0x41e0f4 Sleep
0x41e0f8 ExitProcess
0x41e0fc WriteFile
0x41e100 GetStdHandle
0x41e104 SetHandleCount
0x41e108 GetFileType
0x41e10c SetFilePointer
0x41e110 FreeEnvironmentStringsA
0x41e114 FreeEnvironmentStringsW
0x41e118 WideCharToMultiByte
0x41e11c TlsGetValue
0x41e120 TlsAlloc
0x41e124 TlsSetValue
0x41e128 TlsFree
0x41e12c InterlockedIncrement
0x41e130 SetLastError
0x41e134 GetCurrentThreadId
0x41e138 QueryPerformanceCounter
0x41e13c GetTickCount
0x41e140 GetCurrentProcessId
0x41e144 GetSystemTimeAsFileTime
0x41e148 InitializeCriticalSectionAndSpinCount
0x41e14c LoadLibraryA
0x41e150 SetStdHandle
0x41e154 GetConsoleCP
0x41e158 GetConsoleMode
0x41e15c FlushFileBuffers
0x41e160 HeapSize
0x41e164 GetCPInfo
0x41e168 GetACP
0x41e16c GetOEMCP
0x41e170 IsValidCodePage
0x41e174 WriteConsoleW
0x41e178 MultiByteToWideChar
0x41e17c LCMapStringA
0x41e180 LCMapStringW
0x41e184 GetStringTypeA
0x41e188 GetStringTypeW
0x41e18c CloseHandle
0x41e190 CreateFileA
USER32.dll
0x41e198 RealChildWindowFromPoint
GDI32.dll
0x41e00c GetCharWidthFloatW
ADVAPI32.dll
0x41e000 DeregisterEventSource
0x41e004 CloseEventLog
EAT(Export Address Table) is none
KERNEL32.dll
0x41e014 InterlockedDecrement
0x41e018 GetEnvironmentStringsW
0x41e01c WaitForSingleObject
0x41e020 SetEvent
0x41e024 GetSystemDefaultLCID
0x41e028 GetEnvironmentStrings
0x41e02c GlobalAlloc
0x41e030 SizeofResource
0x41e034 LeaveCriticalSection
0x41e038 ReadFile
0x41e03c GetModuleFileNameW
0x41e040 GetDevicePowerState
0x41e044 GetConsoleOutputCP
0x41e048 VerLanguageNameA
0x41e04c RemoveDirectoryA
0x41e050 EnterCriticalSection
0x41e054 GlobalGetAtomNameA
0x41e058 PrepareTape
0x41e05c WriteConsoleA
0x41e060 GetProcessId
0x41e064 BeginUpdateResourceA
0x41e068 SetSystemTime
0x41e06c EnumResourceTypesW
0x41e070 GetModuleFileNameA
0x41e074 GetModuleHandleA
0x41e078 FindFirstVolumeA
0x41e07c ReleaseMutex
0x41e080 EndUpdateResourceA
0x41e084 LocalSize
0x41e088 GetWindowsDirectoryW
0x41e08c AddConsoleAliasA
0x41e090 FindActCtxSectionStringW
0x41e094 FindNextVolumeA
0x41e098 lstrcpyA
0x41e09c GetLocaleInfoA
0x41e0a0 GetCommandLineW
0x41e0a4 GetProcAddress
0x41e0a8 GetSystemDefaultLangID
0x41e0ac HeapAlloc
0x41e0b0 GetLastError
0x41e0b4 HeapReAlloc
0x41e0b8 GetCommandLineA
0x41e0bc GetStartupInfoA
0x41e0c0 RaiseException
0x41e0c4 RtlUnwind
0x41e0c8 TerminateProcess
0x41e0cc GetCurrentProcess
0x41e0d0 UnhandledExceptionFilter
0x41e0d4 SetUnhandledExceptionFilter
0x41e0d8 IsDebuggerPresent
0x41e0dc HeapFree
0x41e0e0 DeleteCriticalSection
0x41e0e4 VirtualFree
0x41e0e8 VirtualAlloc
0x41e0ec HeapCreate
0x41e0f0 GetModuleHandleW
0x41e0f4 Sleep
0x41e0f8 ExitProcess
0x41e0fc WriteFile
0x41e100 GetStdHandle
0x41e104 SetHandleCount
0x41e108 GetFileType
0x41e10c SetFilePointer
0x41e110 FreeEnvironmentStringsA
0x41e114 FreeEnvironmentStringsW
0x41e118 WideCharToMultiByte
0x41e11c TlsGetValue
0x41e120 TlsAlloc
0x41e124 TlsSetValue
0x41e128 TlsFree
0x41e12c InterlockedIncrement
0x41e130 SetLastError
0x41e134 GetCurrentThreadId
0x41e138 QueryPerformanceCounter
0x41e13c GetTickCount
0x41e140 GetCurrentProcessId
0x41e144 GetSystemTimeAsFileTime
0x41e148 InitializeCriticalSectionAndSpinCount
0x41e14c LoadLibraryA
0x41e150 SetStdHandle
0x41e154 GetConsoleCP
0x41e158 GetConsoleMode
0x41e15c FlushFileBuffers
0x41e160 HeapSize
0x41e164 GetCPInfo
0x41e168 GetACP
0x41e16c GetOEMCP
0x41e170 IsValidCodePage
0x41e174 WriteConsoleW
0x41e178 MultiByteToWideChar
0x41e17c LCMapStringA
0x41e180 LCMapStringW
0x41e184 GetStringTypeA
0x41e188 GetStringTypeW
0x41e18c CloseHandle
0x41e190 CreateFileA
USER32.dll
0x41e198 RealChildWindowFromPoint
GDI32.dll
0x41e00c GetCharWidthFloatW
ADVAPI32.dll
0x41e000 DeregisterEventSource
0x41e004 CloseEventLog
EAT(Export Address Table) is none