popup

Report - vbc.exe

Malicious Library UPX PE File PE32
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.10.27 09:28 Machine s1_win7_x6403
Filename vbc.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
6
 Behavior Score
3.0
ZERO API file : clean
VT API (file) 23 detected (AIDetect, malware2, malicious, high confidence, Unsafe, Save, GVQV, Delf, FileRepMalware, Static AI, Suspicious PE, Phonzy, score, Artemis, R002H07JQ21, Generic@ML, RDML, Awvoyw3FDdzcUfNq4VHmrQ, EQAC, ZelphiCO, @GW@aiRJKMli, confidence)
md5 a1b4d8c4d876a9dc57c0a75bdef1f13b
sha256 b5b4d9ff557a75779e7d90ce17ab8ccb549e10c41be3a67211dae10fe6daec4b
ssdeep 24576:WCGsKsGgpPL50KrzgCfDGjLkEg/0EZcN+fBPLtUqU9PPj2hqp8Zs7SZxD95UCcoe:WCGsL/LGZg/0EZcN+fBPLtUqU9PPj2Ab
imphash c408e5d23334aeef4d12e2007ba01029
impfuzzy 192:f34Hxk1sT4JibuuaxSUvK9y3oaqEho72POQXy:f3iy1s5aq9/KPOQi
  Network IP location

Signature (7cnts)

Level Description
warning File has been identified by 23 AntiVirus engines on VirusTotal as malicious
watch Network activity contains more than one unique useragent
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Performs some HTTP requests
info One or more processes crashed
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (4cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (7cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
https://onedrive.live.com/download?cid=4C66C628080BCD75&resid=4C66C628080BCD75%21115&authkey=AJjK25H3RYrnKoA
whois
US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.13 clean
https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&ct=1635294283&rver=7.3.6962.0&wp=MBI_SSL_SHARED&wreply=https:%2F%2Fonedrive.live.com%2Fdownload%3Fcid%3D4C66C628080BCD75%26resid%3D4C66C628080BCD75%2521115%26authkey%3DAJjK25H3RYrnKoA&lc=1033&id=2502
whois
KR MICROSOFT-CORP-MSN-AS-BLOCK 40.126.16.165 clean
https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&ct=1635294282&rver=7.3.6962.0&wp=MBI_SSL_SHARED&wreply=https:%2F%2Fonedrive.live.com%2Fdownload%3Fcid%3D4C66C628080BCD75%26resid%3D4C66C628080BCD75%2521115%26authkey%3DAJjK25H3RYrnKoA&lc=1033&id=2502
whois
KR MICROSOFT-CORP-MSN-AS-BLOCK 40.126.16.165 clean
login.live.com
whois
SG MICROSOFT-CORP-MSN-AS-BLOCK 40.126.35.129 clean
onedrive.live.com
whois
US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.13 mailcious
13.107.42.13
whois
US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.13 mailcious
40.126.16.165
whois
KR MICROSOFT-CORP-MSN-AS-BLOCK 40.126.16.165 clean

Suricata ids

SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x4ec168 DeleteCriticalSection
 0x4ec16c LeaveCriticalSection
 0x4ec170 EnterCriticalSection
 0x4ec174 InitializeCriticalSection
 0x4ec178 VirtualFree
 0x4ec17c VirtualAlloc
 0x4ec180 LocalFree
 0x4ec184 LocalAlloc
 0x4ec188 GetVersion
 0x4ec18c GetCurrentThreadId
 0x4ec190 InterlockedDecrement
 0x4ec194 InterlockedIncrement
 0x4ec198 VirtualQuery
 0x4ec19c WideCharToMultiByte
 0x4ec1a0 MultiByteToWideChar
 0x4ec1a4 lstrlenA
 0x4ec1a8 lstrcpynA
 0x4ec1ac LoadLibraryExA
 0x4ec1b0 GetThreadLocale
 0x4ec1b4 GetStartupInfoA
 0x4ec1b8 GetProcAddress
 0x4ec1bc GetModuleHandleA
 0x4ec1c0 GetModuleFileNameA
 0x4ec1c4 GetLocaleInfoA
 0x4ec1c8 GetCommandLineA
 0x4ec1cc FreeLibrary
 0x4ec1d0 FindFirstFileA
 0x4ec1d4 FindClose
 0x4ec1d8 ExitProcess
 0x4ec1dc WriteFile
 0x4ec1e0 UnhandledExceptionFilter
 0x4ec1e4 RtlUnwind
 0x4ec1e8 RaiseException
 0x4ec1ec GetStdHandle
user32.dll
 0x4ec1f4 GetKeyboardType
 0x4ec1f8 LoadStringA
 0x4ec1fc MessageBoxA
 0x4ec200 CharNextA
advapi32.dll
 0x4ec208 RegQueryValueExA
 0x4ec20c RegOpenKeyExA
 0x4ec210 RegCloseKey
oleaut32.dll
 0x4ec218 SysFreeString
 0x4ec21c SysReAllocStringLen
 0x4ec220 SysAllocStringLen
kernel32.dll
 0x4ec228 TlsSetValue
 0x4ec22c TlsGetValue
 0x4ec230 LocalAlloc
 0x4ec234 GetModuleHandleA
advapi32.dll
 0x4ec23c RegQueryValueExA
 0x4ec240 RegOpenKeyExA
 0x4ec244 RegCloseKey
kernel32.dll
 0x4ec24c lstrcpyA
 0x4ec250 WriteFile
 0x4ec254 WaitForSingleObject
 0x4ec258 VirtualQuery
 0x4ec25c VirtualProtect
 0x4ec260 VirtualAlloc
 0x4ec264 Sleep
 0x4ec268 SizeofResource
 0x4ec26c SetThreadLocale
 0x4ec270 SetFilePointer
 0x4ec274 SetEvent
 0x4ec278 SetErrorMode
 0x4ec27c SetEndOfFile
 0x4ec280 ResetEvent
 0x4ec284 ReadFile
 0x4ec288 MultiByteToWideChar
 0x4ec28c MulDiv
 0x4ec290 LockResource
 0x4ec294 LoadResource
 0x4ec298 LoadLibraryA
 0x4ec29c LeaveCriticalSection
 0x4ec2a0 InitializeCriticalSection
 0x4ec2a4 GlobalUnlock
 0x4ec2a8 GlobalSize
 0x4ec2ac GlobalReAlloc
 0x4ec2b0 GlobalHandle
 0x4ec2b4 GlobalLock
 0x4ec2b8 GlobalFree
 0x4ec2bc GlobalFindAtomA
 0x4ec2c0 GlobalDeleteAtom
 0x4ec2c4 GlobalAlloc
 0x4ec2c8 GlobalAddAtomA
 0x4ec2cc GetVolumeInformationA
 0x4ec2d0 GetVersionExA
 0x4ec2d4 GetVersion
 0x4ec2d8 GetUserDefaultLCID
 0x4ec2dc GetTickCount
 0x4ec2e0 GetThreadLocale
 0x4ec2e4 GetSystemInfo
 0x4ec2e8 GetStringTypeExA
 0x4ec2ec GetStdHandle
 0x4ec2f0 GetProcAddress
 0x4ec2f4 GetModuleHandleA
 0x4ec2f8 GetModuleFileNameA
 0x4ec2fc GetLocaleInfoA
 0x4ec300 GetLocalTime
 0x4ec304 GetLastError
 0x4ec308 GetFullPathNameA
 0x4ec30c GetDriveTypeA
 0x4ec310 GetDiskFreeSpaceA
 0x4ec314 GetDateFormatA
 0x4ec318 GetCurrentThreadId
 0x4ec31c GetCurrentProcessId
 0x4ec320 GetCPInfo
 0x4ec324 GetACP
 0x4ec328 FreeResource
 0x4ec32c InterlockedExchange
 0x4ec330 FreeLibrary
 0x4ec334 FormatMessageA
 0x4ec338 FindResourceA
 0x4ec33c FindFirstFileA
 0x4ec340 FindClose
 0x4ec344 FileTimeToLocalFileTime
 0x4ec348 FileTimeToDosDateTime
 0x4ec34c EnumCalendarInfoA
 0x4ec350 EnterCriticalSection
 0x4ec354 DeleteFileA
 0x4ec358 DeleteCriticalSection
 0x4ec35c CreateThread
 0x4ec360 CreateFileA
 0x4ec364 CreateEventA
 0x4ec368 CompareStringA
 0x4ec36c CloseHandle
version.dll
 0x4ec374 VerQueryValueA
 0x4ec378 GetFileVersionInfoSizeA
 0x4ec37c GetFileVersionInfoA
gdi32.dll
 0x4ec384 UnrealizeObject
 0x4ec388 StretchDIBits
 0x4ec38c StretchBlt
 0x4ec390 SetWindowOrgEx
 0x4ec394 SetWinMetaFileBits
 0x4ec398 SetViewportOrgEx
 0x4ec39c SetTextColor
 0x4ec3a0 SetStretchBltMode
 0x4ec3a4 SetROP2
 0x4ec3a8 SetPixel
 0x4ec3ac SetPaletteEntries
 0x4ec3b0 SetEnhMetaFileBits
 0x4ec3b4 SetDIBColorTable
 0x4ec3b8 SetBrushOrgEx
 0x4ec3bc SetBkMode
 0x4ec3c0 SetBkColor
 0x4ec3c4 SelectPalette
 0x4ec3c8 SelectObject
 0x4ec3cc SaveDC
 0x4ec3d0 RestoreDC
 0x4ec3d4 ResizePalette
 0x4ec3d8 Rectangle
 0x4ec3dc RectVisible
 0x4ec3e0 RealizePalette
 0x4ec3e4 Polyline
 0x4ec3e8 Polygon
 0x4ec3ec PlayEnhMetaFile
 0x4ec3f0 PatBlt
 0x4ec3f4 MoveToEx
 0x4ec3f8 MaskBlt
 0x4ec3fc LineTo
 0x4ec400 IntersectClipRect
 0x4ec404 GetWindowOrgEx
 0x4ec408 GetWinMetaFileBits
 0x4ec40c GetTextMetricsA
 0x4ec410 GetTextExtentPointA
 0x4ec414 GetTextExtentPoint32A
 0x4ec418 GetSystemPaletteEntries
 0x4ec41c GetStockObject
 0x4ec420 GetPixel
 0x4ec424 GetPaletteEntries
 0x4ec428 GetObjectA
 0x4ec42c GetNearestPaletteIndex
 0x4ec430 GetEnhMetaFilePaletteEntries
 0x4ec434 GetEnhMetaFileHeader
 0x4ec438 GetEnhMetaFileDescriptionA
 0x4ec43c GetEnhMetaFileBits
 0x4ec440 GetDeviceCaps
 0x4ec444 GetDIBits
 0x4ec448 GetDIBColorTable
 0x4ec44c GetDCOrgEx
 0x4ec450 GetCurrentPositionEx
 0x4ec454 GetClipBox
 0x4ec458 GetBrushOrgEx
 0x4ec45c GetBitmapBits
 0x4ec460 GdiFlush
 0x4ec464 ExcludeClipRect
 0x4ec468 DeleteObject
 0x4ec46c DeleteEnhMetaFile
 0x4ec470 DeleteDC
 0x4ec474 CreateSolidBrush
 0x4ec478 CreatePenIndirect
 0x4ec47c CreatePalette
 0x4ec480 CreateHalftonePalette
 0x4ec484 CreateFontIndirectA
 0x4ec488 CreateEnhMetaFileA
 0x4ec48c CreateDIBitmap
 0x4ec490 CreateDIBSection
 0x4ec494 CreateCompatibleDC
 0x4ec498 CreateCompatibleBitmap
 0x4ec49c CreateBrushIndirect
 0x4ec4a0 CreateBitmap
 0x4ec4a4 CopyEnhMetaFileA
 0x4ec4a8 CloseEnhMetaFile
 0x4ec4ac BitBlt
user32.dll
 0x4ec4b4 CreateWindowExA
 0x4ec4b8 WindowFromPoint
 0x4ec4bc WinHelpA
 0x4ec4c0 WaitMessage
 0x4ec4c4 UpdateWindow
 0x4ec4c8 UnregisterClassA
 0x4ec4cc UnhookWindowsHookEx
 0x4ec4d0 TranslateMessage
 0x4ec4d4 TranslateMDISysAccel
 0x4ec4d8 TrackPopupMenu
 0x4ec4dc SystemParametersInfoA
 0x4ec4e0 ShowWindow
 0x4ec4e4 ShowScrollBar
 0x4ec4e8 ShowOwnedPopups
 0x4ec4ec ShowCursor
 0x4ec4f0 ShowCaret
 0x4ec4f4 SetWindowsHookExA
 0x4ec4f8 SetWindowTextA
 0x4ec4fc SetWindowPos
 0x4ec500 SetWindowPlacement
 0x4ec504 SetWindowLongA
 0x4ec508 SetTimer
 0x4ec50c SetScrollRange
 0x4ec510 SetScrollPos
 0x4ec514 SetScrollInfo
 0x4ec518 SetRect
 0x4ec51c SetPropA
 0x4ec520 SetParent
 0x4ec524 SetMenuItemInfoA
 0x4ec528 SetMenu
 0x4ec52c SetForegroundWindow
 0x4ec530 SetFocus
 0x4ec534 SetCursor
 0x4ec538 SetClipboardData
 0x4ec53c SetClassLongA
 0x4ec540 SetCapture
 0x4ec544 SetActiveWindow
 0x4ec548 SendMessageA
 0x4ec54c ScrollWindow
 0x4ec550 ScreenToClient
 0x4ec554 RemovePropA
 0x4ec558 RemoveMenu
 0x4ec55c ReleaseDC
 0x4ec560 ReleaseCapture
 0x4ec564 RegisterWindowMessageA
 0x4ec568 RegisterClipboardFormatA
 0x4ec56c RegisterClassA
 0x4ec570 RedrawWindow
 0x4ec574 PtInRect
 0x4ec578 PostQuitMessage
 0x4ec57c PostMessageA
 0x4ec580 PeekMessageA
 0x4ec584 OpenClipboard
 0x4ec588 OffsetRect
 0x4ec58c OemToCharA
 0x4ec590 MessageBoxA
 0x4ec594 MessageBeep
 0x4ec598 MapWindowPoints
 0x4ec59c MapVirtualKeyA
 0x4ec5a0 LoadStringA
 0x4ec5a4 LoadKeyboardLayoutA
 0x4ec5a8 LoadIconA
 0x4ec5ac LoadCursorA
 0x4ec5b0 LoadBitmapA
 0x4ec5b4 KillTimer
 0x4ec5b8 IsZoomed
 0x4ec5bc IsWindowVisible
 0x4ec5c0 IsWindowEnabled
 0x4ec5c4 IsWindow
 0x4ec5c8 IsRectEmpty
 0x4ec5cc IsIconic
 0x4ec5d0 IsDialogMessageA
 0x4ec5d4 IsChild
 0x4ec5d8 InvalidateRect
 0x4ec5dc IntersectRect
 0x4ec5e0 InsertMenuItemA
 0x4ec5e4 InsertMenuA
 0x4ec5e8 InflateRect
 0x4ec5ec HideCaret
 0x4ec5f0 GetWindowThreadProcessId
 0x4ec5f4 GetWindowTextA
 0x4ec5f8 GetWindowRect
 0x4ec5fc GetWindowPlacement
 0x4ec600 GetWindowLongA
 0x4ec604 GetWindowDC
 0x4ec608 GetTopWindow
 0x4ec60c GetSystemMetrics
 0x4ec610 GetSystemMenu
 0x4ec614 GetSysColorBrush
 0x4ec618 GetSysColor
 0x4ec61c GetSubMenu
 0x4ec620 GetScrollRange
 0x4ec624 GetScrollPos
 0x4ec628 GetScrollInfo
 0x4ec62c GetPropA
 0x4ec630 GetParent
 0x4ec634 GetWindow
 0x4ec638 GetMessageTime
 0x4ec63c GetMenuStringA
 0x4ec640 GetMenuState
 0x4ec644 GetMenuItemInfoA
 0x4ec648 GetMenuItemID
 0x4ec64c GetMenuItemCount
 0x4ec650 GetMenu
 0x4ec654 GetLastActivePopup
 0x4ec658 GetKeyboardState
 0x4ec65c GetKeyboardLayoutList
 0x4ec660 GetKeyboardLayout
 0x4ec664 GetKeyState
 0x4ec668 GetKeyNameTextA
 0x4ec66c GetIconInfo
 0x4ec670 GetForegroundWindow
 0x4ec674 GetFocus
 0x4ec678 GetDesktopWindow
 0x4ec67c GetDCEx
 0x4ec680 GetDC
 0x4ec684 GetCursorPos
 0x4ec688 GetCursor
 0x4ec68c GetClipboardData
 0x4ec690 GetClientRect
 0x4ec694 GetClassNameA
 0x4ec698 GetClassInfoA
 0x4ec69c GetCapture
 0x4ec6a0 GetActiveWindow
 0x4ec6a4 FrameRect
 0x4ec6a8 FindWindowA
 0x4ec6ac FillRect
 0x4ec6b0 EqualRect
 0x4ec6b4 EnumWindows
 0x4ec6b8 EnumThreadWindows
 0x4ec6bc EndPaint
 0x4ec6c0 EnableWindow
 0x4ec6c4 EnableScrollBar
 0x4ec6c8 EnableMenuItem
 0x4ec6cc EmptyClipboard
 0x4ec6d0 DrawTextA
 0x4ec6d4 DrawStateA
 0x4ec6d8 DrawMenuBar
 0x4ec6dc DrawIconEx
 0x4ec6e0 DrawIcon
 0x4ec6e4 DrawFrameControl
 0x4ec6e8 DrawFocusRect
 0x4ec6ec DrawEdge
 0x4ec6f0 DispatchMessageA
 0x4ec6f4 DestroyWindow
 0x4ec6f8 DestroyMenu
 0x4ec6fc DestroyIcon
 0x4ec700 DestroyCursor
 0x4ec704 DeleteMenu
 0x4ec708 DefWindowProcA
 0x4ec70c DefMDIChildProcA
 0x4ec710 DefFrameProcA
 0x4ec714 CreatePopupMenu
 0x4ec718 CreateMenu
 0x4ec71c CreateIcon
 0x4ec720 CloseClipboard
 0x4ec724 ClientToScreen
 0x4ec728 CheckMenuItem
 0x4ec72c CallWindowProcA
 0x4ec730 CallNextHookEx
 0x4ec734 BeginPaint
 0x4ec738 CharNextA
 0x4ec73c CharLowerBuffA
 0x4ec740 CharLowerA
 0x4ec744 CharUpperBuffA
 0x4ec748 CharToOemA
 0x4ec74c AdjustWindowRectEx
 0x4ec750 ActivateKeyboardLayout
kernel32.dll
 0x4ec758 Sleep
oleaut32.dll
 0x4ec760 SafeArrayPtrOfIndex
 0x4ec764 SafeArrayGetUBound
 0x4ec768 SafeArrayGetLBound
 0x4ec76c SafeArrayCreate
 0x4ec770 VariantChangeType
 0x4ec774 VariantCopy
 0x4ec778 VariantClear
 0x4ec77c VariantInit
ole32.dll
 0x4ec784 CreateStreamOnHGlobal
 0x4ec788 IsAccelerator
 0x4ec78c OleDraw
 0x4ec790 OleSetMenuDescriptor
 0x4ec794 CoCreateInstance
 0x4ec798 CoGetClassObject
 0x4ec79c CoUninitialize
 0x4ec7a0 CoInitialize
 0x4ec7a4 IsEqualGUID
oleaut32.dll
 0x4ec7ac GetErrorInfo
 0x4ec7b0 SysFreeString
comctl32.dll
 0x4ec7b8 ImageList_SetIconSize
 0x4ec7bc ImageList_GetIconSize
 0x4ec7c0 ImageList_Write
 0x4ec7c4 ImageList_Read
 0x4ec7c8 ImageList_GetDragImage
 0x4ec7cc ImageList_DragShowNolock
 0x4ec7d0 ImageList_SetDragCursorImage
 0x4ec7d4 ImageList_DragMove
 0x4ec7d8 ImageList_DragLeave
 0x4ec7dc ImageList_DragEnter
 0x4ec7e0 ImageList_EndDrag
 0x4ec7e4 ImageList_BeginDrag
 0x4ec7e8 ImageList_Remove
 0x4ec7ec ImageList_DrawEx
 0x4ec7f0 ImageList_Replace
 0x4ec7f4 ImageList_Draw
 0x4ec7f8 ImageList_GetBkColor
 0x4ec7fc ImageList_SetBkColor
 0x4ec800 ImageList_ReplaceIcon
 0x4ec804 ImageList_Add
 0x4ec808 ImageList_SetImageCount
 0x4ec80c ImageList_GetImageCount
 0x4ec810 ImageList_Destroy
 0x4ec814 ImageList_Create
winmm.dll
 0x4ec81c sndPlaySoundA
winhttp
 0x4ec824 WinHttpCrackUrl

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure