ScreenShot
| Created | 2021.11.03 07:50 | Machine | s1_win7_x6401 |
| Filename | vbc.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 38 detected (AIDetect, malware1, malicious, high confidence, Fragtor, Save, confidence, 100%, Kryptik, Eldorado, HNDW, DiskWriter, A + Troj, Krypt, Static AI, Malicious PE, Primarypass, score, SmokeLoader, R448265, ZexaF, lu0@aefAx7fG, ai score=81, Unsafe, ET#95%, RDMK, cmRtazpUL6tXXl4vbY+U5utmu, GenKryptik, FMYB, Genetic, susgen) | ||
| md5 | bf5ad5ce60c095fd0e15435c7c7ab862 | ||
| sha256 | 64ffb73a1276e203228435365263f1f53ce13722454ac08f092533b02c05104e | ||
| ssdeep | 3072:g8UwhW8UFLiE+LnCm5ORYIqLC8HpUufaXZxsfB/Vs:gb8UN+LnDORYfHpJisfBa | ||
| imphash | ed38ab5cc3f4fd753cddd79c6cfea0fc | ||
| impfuzzy | 24:bhEq+fqWS+IIFD0OR/uAkhS1OovCZt5cpluiRv9jIgJ3In4FNS5jM6L3n:CG+NRMjt5cpsS9zZjSfL3 | ||
Network IP location
Signature (6cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 38 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41e000 HeapReAlloc
0x41e004 LoadResource
0x41e008 HeapAlloc
0x41e00c SetMailslotInfo
0x41e010 GetEnvironmentStringsW
0x41e014 SetConsoleScreenBufferSize
0x41e018 SetEvent
0x41e01c GetTickCount
0x41e020 TlsSetValue
0x41e024 FindResourceExA
0x41e028 GlobalAlloc
0x41e02c LoadLibraryW
0x41e030 InitAtomTable
0x41e034 FindNextVolumeW
0x41e038 WriteConsoleW
0x41e03c CreateActCtxA
0x41e040 BindIoCompletionCallback
0x41e044 GetProcAddress
0x41e048 VirtualAlloc
0x41e04c BeginUpdateResourceW
0x41e050 PrepareTape
0x41e054 GetAtomNameA
0x41e058 LoadLibraryA
0x41e05c WriteConsoleA
0x41e060 SetEnvironmentVariableA
0x41e064 GetModuleFileNameA
0x41e068 FindFirstChangeNotificationA
0x41e06c GetProcessAffinityMask
0x41e070 AddConsoleAliasA
0x41e074 CreateFileW
0x41e078 HeapSize
0x41e07c DecodePointer
0x41e080 EncodePointer
0x41e084 GetCommandLineA
0x41e088 HeapSetInformation
0x41e08c GetStartupInfoW
0x41e090 IsProcessorFeaturePresent
0x41e094 ReadFile
0x41e098 UnhandledExceptionFilter
0x41e09c SetUnhandledExceptionFilter
0x41e0a0 IsDebuggerPresent
0x41e0a4 TerminateProcess
0x41e0a8 GetCurrentProcess
0x41e0ac EnterCriticalSection
0x41e0b0 LeaveCriticalSection
0x41e0b4 InitializeCriticalSectionAndSpinCount
0x41e0b8 RtlUnwind
0x41e0bc SetHandleCount
0x41e0c0 GetStdHandle
0x41e0c4 GetFileType
0x41e0c8 DeleteCriticalSection
0x41e0cc GetLastError
0x41e0d0 SetFilePointer
0x41e0d4 TlsAlloc
0x41e0d8 TlsGetValue
0x41e0dc TlsFree
0x41e0e0 InterlockedIncrement
0x41e0e4 GetModuleHandleW
0x41e0e8 SetLastError
0x41e0ec GetCurrentThreadId
0x41e0f0 InterlockedDecrement
0x41e0f4 HeapFree
0x41e0f8 CloseHandle
0x41e0fc ExitProcess
0x41e100 WriteFile
0x41e104 GetModuleFileNameW
0x41e108 FreeEnvironmentStringsW
0x41e10c WideCharToMultiByte
0x41e110 HeapCreate
0x41e114 QueryPerformanceCounter
0x41e118 GetCurrentProcessId
0x41e11c GetSystemTimeAsFileTime
0x41e120 MultiByteToWideChar
0x41e124 Sleep
0x41e128 GetCPInfo
0x41e12c GetACP
0x41e130 GetOEMCP
0x41e134 IsValidCodePage
0x41e138 CreateFileA
0x41e13c SetStdHandle
0x41e140 GetConsoleCP
0x41e144 GetConsoleMode
0x41e148 FlushFileBuffers
0x41e14c RaiseException
0x41e150 LCMapStringW
0x41e154 GetStringTypeW
0x41e158 SetEndOfFile
0x41e15c GetProcessHeap
USER32.dll
0x41e164 GetCursorPos
EAT(Export Address Table) is none
KERNEL32.dll
0x41e000 HeapReAlloc
0x41e004 LoadResource
0x41e008 HeapAlloc
0x41e00c SetMailslotInfo
0x41e010 GetEnvironmentStringsW
0x41e014 SetConsoleScreenBufferSize
0x41e018 SetEvent
0x41e01c GetTickCount
0x41e020 TlsSetValue
0x41e024 FindResourceExA
0x41e028 GlobalAlloc
0x41e02c LoadLibraryW
0x41e030 InitAtomTable
0x41e034 FindNextVolumeW
0x41e038 WriteConsoleW
0x41e03c CreateActCtxA
0x41e040 BindIoCompletionCallback
0x41e044 GetProcAddress
0x41e048 VirtualAlloc
0x41e04c BeginUpdateResourceW
0x41e050 PrepareTape
0x41e054 GetAtomNameA
0x41e058 LoadLibraryA
0x41e05c WriteConsoleA
0x41e060 SetEnvironmentVariableA
0x41e064 GetModuleFileNameA
0x41e068 FindFirstChangeNotificationA
0x41e06c GetProcessAffinityMask
0x41e070 AddConsoleAliasA
0x41e074 CreateFileW
0x41e078 HeapSize
0x41e07c DecodePointer
0x41e080 EncodePointer
0x41e084 GetCommandLineA
0x41e088 HeapSetInformation
0x41e08c GetStartupInfoW
0x41e090 IsProcessorFeaturePresent
0x41e094 ReadFile
0x41e098 UnhandledExceptionFilter
0x41e09c SetUnhandledExceptionFilter
0x41e0a0 IsDebuggerPresent
0x41e0a4 TerminateProcess
0x41e0a8 GetCurrentProcess
0x41e0ac EnterCriticalSection
0x41e0b0 LeaveCriticalSection
0x41e0b4 InitializeCriticalSectionAndSpinCount
0x41e0b8 RtlUnwind
0x41e0bc SetHandleCount
0x41e0c0 GetStdHandle
0x41e0c4 GetFileType
0x41e0c8 DeleteCriticalSection
0x41e0cc GetLastError
0x41e0d0 SetFilePointer
0x41e0d4 TlsAlloc
0x41e0d8 TlsGetValue
0x41e0dc TlsFree
0x41e0e0 InterlockedIncrement
0x41e0e4 GetModuleHandleW
0x41e0e8 SetLastError
0x41e0ec GetCurrentThreadId
0x41e0f0 InterlockedDecrement
0x41e0f4 HeapFree
0x41e0f8 CloseHandle
0x41e0fc ExitProcess
0x41e100 WriteFile
0x41e104 GetModuleFileNameW
0x41e108 FreeEnvironmentStringsW
0x41e10c WideCharToMultiByte
0x41e110 HeapCreate
0x41e114 QueryPerformanceCounter
0x41e118 GetCurrentProcessId
0x41e11c GetSystemTimeAsFileTime
0x41e120 MultiByteToWideChar
0x41e124 Sleep
0x41e128 GetCPInfo
0x41e12c GetACP
0x41e130 GetOEMCP
0x41e134 IsValidCodePage
0x41e138 CreateFileA
0x41e13c SetStdHandle
0x41e140 GetConsoleCP
0x41e144 GetConsoleMode
0x41e148 FlushFileBuffers
0x41e14c RaiseException
0x41e150 LCMapStringW
0x41e154 GetStringTypeW
0x41e158 SetEndOfFile
0x41e15c GetProcessHeap
USER32.dll
0x41e164 GetCursorPos
EAT(Export Address Table) is none