Report - vbc.exe

Emotet Generic Malware Malicious Library UPX PE File PE32
ScreenShot
Created 2021.10.27 10:19 Machine s1_win7_x6401
Filename vbc.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
3
Behavior Score
2.4
ZERO API file : clean
VT API (file) 15 detected (Siggen15, GenericRXAA, Delf, Eldorado, EQIH, Malicious, Daou, Remcos, InjectorX, Generic@ML, RDML, 0OXJKFC6J2bYGo5hB6Mfrg, Unsafe, Score, Sabsik, BScope, Noon, susgen, EQAC)
md5 2bd0212a01ee6f425e6eb61ae258def9
sha256 3045902d7104e67ca88ca54360d9ef5bfe5bec8b575580bc28205ca67eeba96d
ssdeep 12288:4XP/GqooPN90ke+TV6nRsT3qoHsXmlN3TQQKKyB4pV:4nNNaL+Td6WCgEQsB4p
imphash cd903ee6199fd8a23728e08912cd0b83
impfuzzy 192:f34nG1ODmibuuSrSUvK9RqoaqEseSPOQXk:f3t1ASA9LdPOQ0
  Network IP location

Signature (7cnts)

Level Description
watch File has been identified by 15 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Performs some HTTP requests
info One or more processes crashed
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The executable uses a known packer

Rules (6cnts)

Level Name Description Collection
danger Win32_Trojan_Emotet_2_Zero Win32 Trojan Emotet binaries (upload)
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (3cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
https://cdn.discordapp.com/attachments/902132472924479511/902136733435592744/Wbjhzkbevojgqfhfalbqxnykvunmobi Unknown 162.159.129.233 clean
cdn.discordapp.com Unknown 162.159.135.233 malware
162.159.129.233 Unknown 162.159.129.233 malware

Suricata ids

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x48b168 DeleteCriticalSection
 0x48b16c LeaveCriticalSection
 0x48b170 EnterCriticalSection
 0x48b174 InitializeCriticalSection
 0x48b178 VirtualFree
 0x48b17c VirtualAlloc
 0x48b180 LocalFree
 0x48b184 LocalAlloc
 0x48b188 GetVersion
 0x48b18c GetCurrentThreadId
 0x48b190 InterlockedDecrement
 0x48b194 InterlockedIncrement
 0x48b198 VirtualQuery
 0x48b19c WideCharToMultiByte
 0x48b1a0 MultiByteToWideChar
 0x48b1a4 lstrlenA
 0x48b1a8 lstrcpynA
 0x48b1ac LoadLibraryExA
 0x48b1b0 GetThreadLocale
 0x48b1b4 GetStartupInfoA
 0x48b1b8 GetProcAddress
 0x48b1bc GetModuleHandleA
 0x48b1c0 GetModuleFileNameA
 0x48b1c4 GetLocaleInfoA
 0x48b1c8 GetCommandLineA
 0x48b1cc FreeLibrary
 0x48b1d0 FindFirstFileA
 0x48b1d4 FindClose
 0x48b1d8 ExitProcess
 0x48b1dc WriteFile
 0x48b1e0 UnhandledExceptionFilter
 0x48b1e4 RtlUnwind
 0x48b1e8 RaiseException
 0x48b1ec GetStdHandle
user32.dll
 0x48b1f4 GetKeyboardType
 0x48b1f8 LoadStringA
 0x48b1fc MessageBoxA
 0x48b200 CharNextA
advapi32.dll
 0x48b208 RegQueryValueExA
 0x48b20c RegOpenKeyExA
 0x48b210 RegCloseKey
oleaut32.dll
 0x48b218 SysFreeString
 0x48b21c SysReAllocStringLen
 0x48b220 SysAllocStringLen
kernel32.dll
 0x48b228 TlsSetValue
 0x48b22c TlsGetValue
 0x48b230 LocalAlloc
 0x48b234 GetModuleHandleA
advapi32.dll
 0x48b23c RegQueryValueExA
 0x48b240 RegOpenKeyExA
 0x48b244 RegCloseKey
kernel32.dll
 0x48b24c lstrcpyA
 0x48b250 WriteFile
 0x48b254 WaitForSingleObject
 0x48b258 VirtualQuery
 0x48b25c VirtualProtect
 0x48b260 VirtualAlloc
 0x48b264 Sleep
 0x48b268 SizeofResource
 0x48b26c SetThreadLocale
 0x48b270 SetFilePointer
 0x48b274 SetEvent
 0x48b278 SetErrorMode
 0x48b27c SetEndOfFile
 0x48b280 ResetEvent
 0x48b284 ReadFile
 0x48b288 MultiByteToWideChar
 0x48b28c MulDiv
 0x48b290 LockResource
 0x48b294 LoadResource
 0x48b298 LoadLibraryA
 0x48b29c LeaveCriticalSection
 0x48b2a0 InitializeCriticalSection
 0x48b2a4 GlobalUnlock
 0x48b2a8 GlobalSize
 0x48b2ac GlobalReAlloc
 0x48b2b0 GlobalHandle
 0x48b2b4 GlobalLock
 0x48b2b8 GlobalFree
 0x48b2bc GlobalFindAtomA
 0x48b2c0 GlobalDeleteAtom
 0x48b2c4 GlobalAlloc
 0x48b2c8 GlobalAddAtomA
 0x48b2cc GetVersionExA
 0x48b2d0 GetVersion
 0x48b2d4 GetUserDefaultLCID
 0x48b2d8 GetTickCount
 0x48b2dc GetThreadLocale
 0x48b2e0 GetSystemInfo
 0x48b2e4 GetStringTypeExA
 0x48b2e8 GetStdHandle
 0x48b2ec GetProcAddress
 0x48b2f0 GetModuleHandleA
 0x48b2f4 GetModuleFileNameA
 0x48b2f8 GetLocaleInfoA
 0x48b2fc GetLocalTime
 0x48b300 GetLastError
 0x48b304 GetFullPathNameA
 0x48b308 GetDiskFreeSpaceA
 0x48b30c GetDateFormatA
 0x48b310 GetCurrentThreadId
 0x48b314 GetCurrentProcessId
 0x48b318 GetCurrentProcess
 0x48b31c GetCPInfo
 0x48b320 GetACP
 0x48b324 FreeResource
 0x48b328 InterlockedExchange
 0x48b32c FreeLibrary
 0x48b330 FormatMessageA
 0x48b334 FlushInstructionCache
 0x48b338 FindResourceA
 0x48b33c EnumCalendarInfoA
 0x48b340 EnterCriticalSection
 0x48b344 DeleteCriticalSection
 0x48b348 CreateThread
 0x48b34c CreateFileA
 0x48b350 CreateEventA
 0x48b354 CompareStringA
 0x48b358 CloseHandle
version.dll
 0x48b360 VerQueryValueA
 0x48b364 GetFileVersionInfoSizeA
 0x48b368 GetFileVersionInfoA
gdi32.dll
 0x48b370 UnrealizeObject
 0x48b374 StretchBlt
 0x48b378 SetWindowOrgEx
 0x48b37c SetWinMetaFileBits
 0x48b380 SetViewportOrgEx
 0x48b384 SetTextColor
 0x48b388 SetStretchBltMode
 0x48b38c SetROP2
 0x48b390 SetPixel
 0x48b394 SetEnhMetaFileBits
 0x48b398 SetDIBColorTable
 0x48b39c SetBrushOrgEx
 0x48b3a0 SetBkMode
 0x48b3a4 SetBkColor
 0x48b3a8 SelectPalette
 0x48b3ac SelectObject
 0x48b3b0 SaveDC
 0x48b3b4 RestoreDC
 0x48b3b8 RectVisible
 0x48b3bc RealizePalette
 0x48b3c0 PlayEnhMetaFile
 0x48b3c4 PatBlt
 0x48b3c8 MoveToEx
 0x48b3cc MaskBlt
 0x48b3d0 LineTo
 0x48b3d4 IntersectClipRect
 0x48b3d8 GetWindowOrgEx
 0x48b3dc GetWinMetaFileBits
 0x48b3e0 GetTextMetricsA
 0x48b3e4 GetTextExtentPoint32A
 0x48b3e8 GetSystemPaletteEntries
 0x48b3ec GetStockObject
 0x48b3f0 GetPixel
 0x48b3f4 GetPaletteEntries
 0x48b3f8 GetObjectA
 0x48b3fc GetEnhMetaFilePaletteEntries
 0x48b400 GetEnhMetaFileHeader
 0x48b404 GetEnhMetaFileDescriptionA
 0x48b408 GetEnhMetaFileBits
 0x48b40c GetDeviceCaps
 0x48b410 GetDIBits
 0x48b414 GetDIBColorTable
 0x48b418 GetDCOrgEx
 0x48b41c GetCurrentPositionEx
 0x48b420 GetClipBox
 0x48b424 GetBrushOrgEx
 0x48b428 GetBitmapBits
 0x48b42c GdiFlush
 0x48b430 ExcludeClipRect
 0x48b434 DeleteObject
 0x48b438 DeleteEnhMetaFile
 0x48b43c DeleteDC
 0x48b440 CreateSolidBrush
 0x48b444 CreatePenIndirect
 0x48b448 CreatePalette
 0x48b44c CreateHalftonePalette
 0x48b450 CreateFontIndirectA
 0x48b454 CreateEnhMetaFileA
 0x48b458 CreateDIBitmap
 0x48b45c CreateDIBSection
 0x48b460 CreateCompatibleDC
 0x48b464 CreateCompatibleBitmap
 0x48b468 CreateBrushIndirect
 0x48b46c CreateBitmap
 0x48b470 CopyEnhMetaFileA
 0x48b474 CloseEnhMetaFile
 0x48b478 BitBlt
user32.dll
 0x48b480 CreateWindowExA
 0x48b484 WindowFromPoint
 0x48b488 WinHelpA
 0x48b48c WaitMessage
 0x48b490 UpdateWindow
 0x48b494 UnregisterClassA
 0x48b498 UnhookWindowsHookEx
 0x48b49c TranslateMessage
 0x48b4a0 TranslateMDISysAccel
 0x48b4a4 TrackPopupMenu
 0x48b4a8 SystemParametersInfoA
 0x48b4ac ShowWindow
 0x48b4b0 ShowScrollBar
 0x48b4b4 ShowOwnedPopups
 0x48b4b8 ShowCursor
 0x48b4bc SetWindowsHookExA
 0x48b4c0 SetWindowPos
 0x48b4c4 SetWindowPlacement
 0x48b4c8 SetWindowLongA
 0x48b4cc SetTimer
 0x48b4d0 SetScrollRange
 0x48b4d4 SetScrollPos
 0x48b4d8 SetScrollInfo
 0x48b4dc SetRect
 0x48b4e0 SetPropA
 0x48b4e4 SetParent
 0x48b4e8 SetMenuItemInfoA
 0x48b4ec SetMenu
 0x48b4f0 SetForegroundWindow
 0x48b4f4 SetFocus
 0x48b4f8 SetCursor
 0x48b4fc SetClassLongA
 0x48b500 SetCapture
 0x48b504 SetActiveWindow
 0x48b508 SendMessageA
 0x48b50c ScrollWindow
 0x48b510 ScreenToClient
 0x48b514 RemovePropA
 0x48b518 RemoveMenu
 0x48b51c ReleaseDC
 0x48b520 ReleaseCapture
 0x48b524 RegisterWindowMessageA
 0x48b528 RegisterClipboardFormatA
 0x48b52c RegisterClassA
 0x48b530 RedrawWindow
 0x48b534 PtInRect
 0x48b538 PostQuitMessage
 0x48b53c PostMessageA
 0x48b540 PeekMessageA
 0x48b544 OffsetRect
 0x48b548 OemToCharA
 0x48b54c MessageBoxA
 0x48b550 MapWindowPoints
 0x48b554 MapVirtualKeyA
 0x48b558 LoadStringA
 0x48b55c LoadKeyboardLayoutA
 0x48b560 LoadIconA
 0x48b564 LoadCursorA
 0x48b568 LoadBitmapA
 0x48b56c KillTimer
 0x48b570 IsZoomed
 0x48b574 IsWindowVisible
 0x48b578 IsWindowEnabled
 0x48b57c IsWindow
 0x48b580 IsRectEmpty
 0x48b584 IsIconic
 0x48b588 IsDialogMessageA
 0x48b58c IsChild
 0x48b590 InvalidateRect
 0x48b594 IntersectRect
 0x48b598 InsertMenuItemA
 0x48b59c InsertMenuA
 0x48b5a0 InflateRect
 0x48b5a4 GetWindowThreadProcessId
 0x48b5a8 GetWindowTextA
 0x48b5ac GetWindowRect
 0x48b5b0 GetWindowPlacement
 0x48b5b4 GetWindowLongA
 0x48b5b8 GetWindowDC
 0x48b5bc GetTopWindow
 0x48b5c0 GetSystemMetrics
 0x48b5c4 GetSystemMenu
 0x48b5c8 GetSysColorBrush
 0x48b5cc GetSysColor
 0x48b5d0 GetSubMenu
 0x48b5d4 GetScrollRange
 0x48b5d8 GetScrollPos
 0x48b5dc GetScrollInfo
 0x48b5e0 GetPropA
 0x48b5e4 GetParent
 0x48b5e8 GetWindow
 0x48b5ec GetMessageTime
 0x48b5f0 GetMenuStringA
 0x48b5f4 GetMenuState
 0x48b5f8 GetMenuItemInfoA
 0x48b5fc GetMenuItemID
 0x48b600 GetMenuItemCount
 0x48b604 GetMenu
 0x48b608 GetLastActivePopup
 0x48b60c GetKeyboardState
 0x48b610 GetKeyboardLayoutList
 0x48b614 GetKeyboardLayout
 0x48b618 GetKeyState
 0x48b61c GetKeyNameTextA
 0x48b620 GetIconInfo
 0x48b624 GetForegroundWindow
 0x48b628 GetFocus
 0x48b62c GetDesktopWindow
 0x48b630 GetDCEx
 0x48b634 GetDC
 0x48b638 GetCursorPos
 0x48b63c GetCursor
 0x48b640 GetClipboardData
 0x48b644 GetClientRect
 0x48b648 GetClassNameA
 0x48b64c GetClassInfoA
 0x48b650 GetCapture
 0x48b654 GetActiveWindow
 0x48b658 FrameRect
 0x48b65c FindWindowA
 0x48b660 FillRect
 0x48b664 EqualRect
 0x48b668 EnumWindows
 0x48b66c EnumThreadWindows
 0x48b670 EndPaint
 0x48b674 EnableWindow
 0x48b678 EnableScrollBar
 0x48b67c EnableMenuItem
 0x48b680 DrawTextA
 0x48b684 DrawMenuBar
 0x48b688 DrawIconEx
 0x48b68c DrawIcon
 0x48b690 DrawFrameControl
 0x48b694 DrawEdge
 0x48b698 DispatchMessageA
 0x48b69c DestroyWindow
 0x48b6a0 DestroyMenu
 0x48b6a4 DestroyIcon
 0x48b6a8 DestroyCursor
 0x48b6ac DeleteMenu
 0x48b6b0 DefWindowProcA
 0x48b6b4 DefMDIChildProcA
 0x48b6b8 DefFrameProcA
 0x48b6bc CreatePopupMenu
 0x48b6c0 CreateMenu
 0x48b6c4 CreateIcon
 0x48b6c8 ClientToScreen
 0x48b6cc CheckMenuItem
 0x48b6d0 CallWindowProcA
 0x48b6d4 CallNextHookEx
 0x48b6d8 BeginPaint
 0x48b6dc CharNextA
 0x48b6e0 CharLowerBuffA
 0x48b6e4 CharLowerA
 0x48b6e8 CharToOemA
 0x48b6ec AdjustWindowRectEx
 0x48b6f0 ActivateKeyboardLayout
kernel32.dll
 0x48b6f8 Sleep
oleaut32.dll
 0x48b700 SafeArrayPtrOfIndex
 0x48b704 SafeArrayGetUBound
 0x48b708 SafeArrayGetLBound
 0x48b70c SafeArrayCreate
 0x48b710 VariantChangeType
 0x48b714 VariantCopy
 0x48b718 VariantClear
 0x48b71c VariantInit
ole32.dll
 0x48b724 CreateStreamOnHGlobal
 0x48b728 IsAccelerator
 0x48b72c OleDraw
 0x48b730 OleSetMenuDescriptor
 0x48b734 CoCreateInstance
 0x48b738 CoGetClassObject
 0x48b73c CoUninitialize
 0x48b740 CoInitialize
 0x48b744 IsEqualGUID
oleaut32.dll
 0x48b74c GetErrorInfo
 0x48b750 SysFreeString
comctl32.dll
 0x48b758 ImageList_SetIconSize
 0x48b75c ImageList_GetIconSize
 0x48b760 ImageList_Write
 0x48b764 ImageList_Read
 0x48b768 ImageList_GetDragImage
 0x48b76c ImageList_DragShowNolock
 0x48b770 ImageList_SetDragCursorImage
 0x48b774 ImageList_DragMove
 0x48b778 ImageList_DragLeave
 0x48b77c ImageList_DragEnter
 0x48b780 ImageList_EndDrag
 0x48b784 ImageList_BeginDrag
 0x48b788 ImageList_Remove
 0x48b78c ImageList_DrawEx
 0x48b790 ImageList_Draw
 0x48b794 ImageList_GetBkColor
 0x48b798 ImageList_SetBkColor
 0x48b79c ImageList_ReplaceIcon
 0x48b7a0 ImageList_Add
 0x48b7a4 ImageList_SetImageCount
 0x48b7a8 ImageList_GetImageCount
 0x48b7ac ImageList_Destroy
 0x48b7b0 ImageList_Create
uRL
 0x48b7b8 InetIsOffline
winhttp
 0x48b7c0 WinHttpCrackUrl

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure