Report - vbc.exe

Generic Malware Admin Tool (Sysinternals etc ...) Malicious Library UPX PE File PE32
ScreenShot
Created 2021.11.03 09:44 Machine s1_win7_x6403
Filename vbc.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
6
Behavior Score
4.0
ZERO API file : clean
VT API (file) 13 detected (Save, malicious, EQKY, Injuke, ezjr, Phonzy, BScope, Noon, Generic@ML, RDML, nYi5Hh8Ck6, CKjWNTULY7w, Remcos, susgen, Delf, ZelphiCO, 5GW@amrcUrbi)
md5 91fb23dcf91534e17f881f58d5aa746c
sha256 8db032a108bfbc9b5d4d2be6f466add20a81685196253867b99e6456e02adadf
ssdeep 6144:xZEcZy5taWXTZBSG5fB/i/goaOeD32RFbLCdF9ae8FvSxUjewQhM4kqlPyn+lP3:P857TZBpL5jeFWFQeYjdGdkAPya
imphash 8daf0b024930cce1318dd6208076cf0a
impfuzzy 192:P3hNk1Q/mwbuuXrSUvK9aqooqEseSPOQ0J:P381sXA9orPOQ2
  Network IP location

Signature (10cnts)

Level Description
watch File has been identified by 13 AntiVirus engines on VirusTotal as malicious
watch Installs itself for autorun at Windows startup
watch Network activity contains more than one unique useragent
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Creates executable files on the filesystem
notice Performs some HTTP requests
info One or more processes crashed
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The executable uses a known packer

Rules (12cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (download)
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Admin_Tool_IN_Zero Admin Tool Sysinternals binaries (download)
watch Admin_Tool_IN_Zero Admin Tool Sysinternals binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (download)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)

Network (7cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
https://onedrive.live.com/download?cid=65A7AE11B0C1F12A&resid=65A7AE11B0C1F12A%21131&authkey=ANpUFMDPATtP4fk US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.13 clean
https://wy8ibg.bn.files.1drv.com/y4m1cNBZE9_FQOZ4xf3bA19aNEhp3Ab4BU2F4-Tenf3GyCVS2_kFUOwcVgQfw1r_3nJ56Wn8Ci8_BkJ-AvCULuY53Ut5_WJJePsTWx7FB4oMCe91LzkgvzmJLm7OKGh8De1E-tOx_l9q4gmlVgkbOkk2TiDECU6BZF10dZl0_7M98PwhX46z_tOwEbFMGo1ajXGMgqn3VufVwC6juHcT_g81w/Jffp US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.12 clean
https://wy8ibg.bn.files.1drv.com/y4mO0cDT-Q4gjkLDcr6Uj33ueteGAGczsvHOWgZv7zEPxywH4AJS-BsPzt18HXfTFqRo7iBJ48BmdSQLlXigD0EtHU2nvSqiUA7hX1rR4-WBcMvCXCS6mLZoAKU46veesHVltlDppC89XA_QBoaueJdbK3hhb7UM6rinbS6u3p5kMYPz-ytjRxaS4VzXtVTfjVUABR-LAgYdT4w5WYKeVyfiw/Jffp US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.12 clean
wy8ibg.bn.files.1drv.com US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.12 clean
onedrive.live.com US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.13 mailcious
13.107.42.13 US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.13 mailcious
13.107.42.12 US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.12 malware

Suricata ids

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x45c17c DeleteCriticalSection
 0x45c180 LeaveCriticalSection
 0x45c184 EnterCriticalSection
 0x45c188 InitializeCriticalSection
 0x45c18c VirtualFree
 0x45c190 VirtualAlloc
 0x45c194 LocalFree
 0x45c198 LocalAlloc
 0x45c19c GetVersion
 0x45c1a0 GetCurrentThreadId
 0x45c1a4 InterlockedDecrement
 0x45c1a8 InterlockedIncrement
 0x45c1ac VirtualQuery
 0x45c1b0 WideCharToMultiByte
 0x45c1b4 MultiByteToWideChar
 0x45c1b8 lstrlenA
 0x45c1bc lstrcpynA
 0x45c1c0 LoadLibraryExA
 0x45c1c4 GetThreadLocale
 0x45c1c8 GetStartupInfoA
 0x45c1cc GetProcAddress
 0x45c1d0 GetModuleHandleA
 0x45c1d4 GetModuleFileNameA
 0x45c1d8 GetLocaleInfoA
 0x45c1dc GetLastError
 0x45c1e0 GetCommandLineA
 0x45c1e4 FreeLibrary
 0x45c1e8 FindFirstFileA
 0x45c1ec FindClose
 0x45c1f0 ExitProcess
 0x45c1f4 WriteFile
 0x45c1f8 UnhandledExceptionFilter
 0x45c1fc SetFilePointer
 0x45c200 SetEndOfFile
 0x45c204 RtlUnwind
 0x45c208 ReadFile
 0x45c20c RaiseException
 0x45c210 GetStdHandle
 0x45c214 GetFileSize
 0x45c218 GetFileType
 0x45c21c CreateFileA
 0x45c220 CloseHandle
user32.dll
 0x45c228 GetKeyboardType
 0x45c22c LoadStringA
 0x45c230 MessageBoxA
 0x45c234 CharNextA
advapi32.dll
 0x45c23c RegQueryValueExA
 0x45c240 RegOpenKeyExA
 0x45c244 RegCloseKey
oleaut32.dll
 0x45c24c SysFreeString
 0x45c250 SysReAllocStringLen
 0x45c254 SysAllocStringLen
kernel32.dll
 0x45c25c TlsSetValue
 0x45c260 TlsGetValue
 0x45c264 LocalAlloc
 0x45c268 GetModuleHandleA
advapi32.dll
 0x45c270 RegQueryValueExA
 0x45c274 RegOpenKeyExA
 0x45c278 RegCloseKey
kernel32.dll
 0x45c280 lstrcpyA
 0x45c284 WriteFile
 0x45c288 WaitForSingleObject
 0x45c28c VirtualQuery
 0x45c290 VirtualProtect
 0x45c294 VirtualAlloc
 0x45c298 Sleep
 0x45c29c SizeofResource
 0x45c2a0 SetThreadLocale
 0x45c2a4 SetFilePointer
 0x45c2a8 SetEvent
 0x45c2ac SetErrorMode
 0x45c2b0 SetEndOfFile
 0x45c2b4 ResetEvent
 0x45c2b8 ReadFile
 0x45c2bc MultiByteToWideChar
 0x45c2c0 MulDiv
 0x45c2c4 LockResource
 0x45c2c8 LoadResource
 0x45c2cc LoadLibraryA
 0x45c2d0 LeaveCriticalSection
 0x45c2d4 InitializeCriticalSection
 0x45c2d8 GlobalUnlock
 0x45c2dc GlobalReAlloc
 0x45c2e0 GlobalHandle
 0x45c2e4 GlobalLock
 0x45c2e8 GlobalFree
 0x45c2ec GlobalFindAtomA
 0x45c2f0 GlobalDeleteAtom
 0x45c2f4 GlobalAlloc
 0x45c2f8 GlobalAddAtomA
 0x45c2fc GetVersionExA
 0x45c300 GetVersion
 0x45c304 GetTickCount
 0x45c308 GetThreadLocale
 0x45c30c GetSystemInfo
 0x45c310 GetStringTypeExA
 0x45c314 GetStdHandle
 0x45c318 GetProcAddress
 0x45c31c GetModuleHandleA
 0x45c320 GetModuleFileNameA
 0x45c324 GetLocaleInfoA
 0x45c328 GetLocalTime
 0x45c32c GetLastError
 0x45c330 GetFullPathNameA
 0x45c334 GetDiskFreeSpaceA
 0x45c338 GetDateFormatA
 0x45c33c GetCurrentThreadId
 0x45c340 GetCurrentProcessId
 0x45c344 GetCPInfo
 0x45c348 GetACP
 0x45c34c FreeResource
 0x45c350 InterlockedExchange
 0x45c354 FreeLibrary
 0x45c358 FormatMessageA
 0x45c35c FindResourceA
 0x45c360 EnumCalendarInfoA
 0x45c364 EnterCriticalSection
 0x45c368 DeleteCriticalSection
 0x45c36c CreateThread
 0x45c370 CreateFileA
 0x45c374 CreateEventA
 0x45c378 CompareStringA
 0x45c37c CloseHandle
version.dll
 0x45c384 VerQueryValueA
 0x45c388 GetFileVersionInfoSizeA
 0x45c38c GetFileVersionInfoA
gdi32.dll
 0x45c394 UnrealizeObject
 0x45c398 StretchBlt
 0x45c39c SetWindowOrgEx
 0x45c3a0 SetWinMetaFileBits
 0x45c3a4 SetViewportOrgEx
 0x45c3a8 SetTextColor
 0x45c3ac SetStretchBltMode
 0x45c3b0 SetROP2
 0x45c3b4 SetPixel
 0x45c3b8 SetEnhMetaFileBits
 0x45c3bc SetDIBColorTable
 0x45c3c0 SetBrushOrgEx
 0x45c3c4 SetBkMode
 0x45c3c8 SetBkColor
 0x45c3cc SelectPalette
 0x45c3d0 SelectObject
 0x45c3d4 SaveDC
 0x45c3d8 RestoreDC
 0x45c3dc Rectangle
 0x45c3e0 RectVisible
 0x45c3e4 RealizePalette
 0x45c3e8 PlayEnhMetaFile
 0x45c3ec PatBlt
 0x45c3f0 MoveToEx
 0x45c3f4 MaskBlt
 0x45c3f8 LineTo
 0x45c3fc IntersectClipRect
 0x45c400 GetWindowOrgEx
 0x45c404 GetWinMetaFileBits
 0x45c408 GetTextMetricsA
 0x45c40c GetTextExtentPoint32A
 0x45c410 GetSystemPaletteEntries
 0x45c414 GetStockObject
 0x45c418 GetPixel
 0x45c41c GetPaletteEntries
 0x45c420 GetObjectA
 0x45c424 GetEnhMetaFilePaletteEntries
 0x45c428 GetEnhMetaFileHeader
 0x45c42c GetEnhMetaFileBits
 0x45c430 GetDeviceCaps
 0x45c434 GetDIBits
 0x45c438 GetDIBColorTable
 0x45c43c GetDCOrgEx
 0x45c440 GetCurrentPositionEx
 0x45c444 GetClipBox
 0x45c448 GetBrushOrgEx
 0x45c44c GetBitmapBits
 0x45c450 GdiFlush
 0x45c454 ExcludeClipRect
 0x45c458 DeleteObject
 0x45c45c DeleteEnhMetaFile
 0x45c460 DeleteDC
 0x45c464 CreateSolidBrush
 0x45c468 CreateRectRgn
 0x45c46c CreatePenIndirect
 0x45c470 CreatePalette
 0x45c474 CreateHalftonePalette
 0x45c478 CreateFontIndirectA
 0x45c47c CreateDIBitmap
 0x45c480 CreateDIBSection
 0x45c484 CreateCompatibleDC
 0x45c488 CreateCompatibleBitmap
 0x45c48c CreateBrushIndirect
 0x45c490 CreateBitmap
 0x45c494 CopyEnhMetaFileA
 0x45c498 CombineRgn
 0x45c49c BitBlt
user32.dll
 0x45c4a4 CreateWindowExA
 0x45c4a8 WindowFromPoint
 0x45c4ac WinHelpA
 0x45c4b0 WaitMessage
 0x45c4b4 UpdateWindow
 0x45c4b8 UnregisterClassA
 0x45c4bc UnhookWindowsHookEx
 0x45c4c0 TranslateMessage
 0x45c4c4 TranslateMDISysAccel
 0x45c4c8 TrackPopupMenu
 0x45c4cc SystemParametersInfoA
 0x45c4d0 ShowWindow
 0x45c4d4 ShowScrollBar
 0x45c4d8 ShowOwnedPopups
 0x45c4dc ShowCursor
 0x45c4e0 SetWindowRgn
 0x45c4e4 SetWindowsHookExA
 0x45c4e8 SetWindowTextA
 0x45c4ec SetWindowPos
 0x45c4f0 SetWindowPlacement
 0x45c4f4 SetWindowLongA
 0x45c4f8 SetTimer
 0x45c4fc SetScrollRange
 0x45c500 SetScrollPos
 0x45c504 SetScrollInfo
 0x45c508 SetRect
 0x45c50c SetPropA
 0x45c510 SetParent
 0x45c514 SetMenuItemInfoA
 0x45c518 SetMenu
 0x45c51c SetForegroundWindow
 0x45c520 SetFocus
 0x45c524 SetCursor
 0x45c528 SetClassLongA
 0x45c52c SetCapture
 0x45c530 SetActiveWindow
 0x45c534 SendMessageA
 0x45c538 ScrollWindow
 0x45c53c ScreenToClient
 0x45c540 RemovePropA
 0x45c544 RemoveMenu
 0x45c548 ReleaseDC
 0x45c54c ReleaseCapture
 0x45c550 RegisterWindowMessageA
 0x45c554 RegisterClipboardFormatA
 0x45c558 RegisterClassA
 0x45c55c RedrawWindow
 0x45c560 PtInRect
 0x45c564 PostQuitMessage
 0x45c568 PostMessageA
 0x45c56c PeekMessageA
 0x45c570 OffsetRect
 0x45c574 OemToCharA
 0x45c578 MsgWaitForMultipleObjects
 0x45c57c MessageBoxA
 0x45c580 MapWindowPoints
 0x45c584 MapVirtualKeyA
 0x45c588 LoadStringA
 0x45c58c LoadKeyboardLayoutA
 0x45c590 LoadIconA
 0x45c594 LoadCursorA
 0x45c598 LoadBitmapA
 0x45c59c KillTimer
 0x45c5a0 IsZoomed
 0x45c5a4 IsWindowVisible
 0x45c5a8 IsWindowEnabled
 0x45c5ac IsWindow
 0x45c5b0 IsRectEmpty
 0x45c5b4 IsIconic
 0x45c5b8 IsDialogMessageA
 0x45c5bc IsChild
 0x45c5c0 InvalidateRect
 0x45c5c4 IntersectRect
 0x45c5c8 InsertMenuItemA
 0x45c5cc InsertMenuA
 0x45c5d0 InflateRect
 0x45c5d4 GetWindowThreadProcessId
 0x45c5d8 GetWindowTextA
 0x45c5dc GetWindowRect
 0x45c5e0 GetWindowPlacement
 0x45c5e4 GetWindowLongA
 0x45c5e8 GetWindowDC
 0x45c5ec GetTopWindow
 0x45c5f0 GetSystemMetrics
 0x45c5f4 GetSystemMenu
 0x45c5f8 GetSysColorBrush
 0x45c5fc GetSysColor
 0x45c600 GetSubMenu
 0x45c604 GetScrollRange
 0x45c608 GetScrollPos
 0x45c60c GetScrollInfo
 0x45c610 GetPropA
 0x45c614 GetParent
 0x45c618 GetWindow
 0x45c61c GetMenuStringA
 0x45c620 GetMenuState
 0x45c624 GetMenuItemInfoA
 0x45c628 GetMenuItemID
 0x45c62c GetMenuItemCount
 0x45c630 GetMenu
 0x45c634 GetLastActivePopup
 0x45c638 GetKeyboardState
 0x45c63c GetKeyboardLayoutList
 0x45c640 GetKeyboardLayout
 0x45c644 GetKeyState
 0x45c648 GetKeyNameTextA
 0x45c64c GetIconInfo
 0x45c650 GetForegroundWindow
 0x45c654 GetFocus
 0x45c658 GetDesktopWindow
 0x45c65c GetDCEx
 0x45c660 GetDC
 0x45c664 GetCursorPos
 0x45c668 GetCursor
 0x45c66c GetClipboardData
 0x45c670 GetClientRect
 0x45c674 GetClassNameA
 0x45c678 GetClassInfoA
 0x45c67c GetCapture
 0x45c680 GetActiveWindow
 0x45c684 FrameRect
 0x45c688 FindWindowA
 0x45c68c FillRect
 0x45c690 EqualRect
 0x45c694 EnumWindows
 0x45c698 EnumThreadWindows
 0x45c69c EndPaint
 0x45c6a0 EnableWindow
 0x45c6a4 EnableScrollBar
 0x45c6a8 EnableMenuItem
 0x45c6ac DrawTextA
 0x45c6b0 DrawMenuBar
 0x45c6b4 DrawIconEx
 0x45c6b8 DrawIcon
 0x45c6bc DrawFrameControl
 0x45c6c0 DrawEdge
 0x45c6c4 DispatchMessageA
 0x45c6c8 DestroyWindow
 0x45c6cc DestroyMenu
 0x45c6d0 DestroyIcon
 0x45c6d4 DestroyCursor
 0x45c6d8 DeleteMenu
 0x45c6dc DefWindowProcA
 0x45c6e0 DefMDIChildProcA
 0x45c6e4 DefFrameProcA
 0x45c6e8 CreatePopupMenu
 0x45c6ec CreateMenu
 0x45c6f0 CreateIcon
 0x45c6f4 ClientToScreen
 0x45c6f8 CheckMenuItem
 0x45c6fc CallWindowProcA
 0x45c700 CallNextHookEx
 0x45c704 BeginPaint
 0x45c708 CharNextA
 0x45c70c CharLowerBuffA
 0x45c710 CharLowerA
 0x45c714 CharToOemA
 0x45c718 AdjustWindowRectEx
 0x45c71c ActivateKeyboardLayout
kernel32.dll
 0x45c724 Sleep
oleaut32.dll
 0x45c72c SafeArrayPtrOfIndex
 0x45c730 SafeArrayGetUBound
 0x45c734 SafeArrayGetLBound
 0x45c738 SafeArrayCreate
 0x45c73c VariantChangeType
 0x45c740 VariantCopy
 0x45c744 VariantClear
 0x45c748 VariantInit
ole32.dll
 0x45c750 CoUninitialize
 0x45c754 CoInitialize
oleaut32.dll
 0x45c75c GetErrorInfo
 0x45c760 SysFreeString
comctl32.dll
 0x45c768 ImageList_SetIconSize
 0x45c76c ImageList_GetIconSize
 0x45c770 ImageList_Write
 0x45c774 ImageList_Read
 0x45c778 ImageList_GetDragImage
 0x45c77c ImageList_DragShowNolock
 0x45c780 ImageList_SetDragCursorImage
 0x45c784 ImageList_DragMove
 0x45c788 ImageList_DragLeave
 0x45c78c ImageList_DragEnter
 0x45c790 ImageList_EndDrag
 0x45c794 ImageList_BeginDrag
 0x45c798 ImageList_Remove
 0x45c79c ImageList_DrawEx
 0x45c7a0 ImageList_Draw
 0x45c7a4 ImageList_GetBkColor
 0x45c7a8 ImageList_SetBkColor
 0x45c7ac ImageList_ReplaceIcon
 0x45c7b0 ImageList_Add
 0x45c7b4 ImageList_SetImageCount
 0x45c7b8 ImageList_GetImageCount
 0x45c7bc ImageList_Destroy
 0x45c7c0 ImageList_Create
shell32.dll
 0x45c7c8 Shell_NotifyIconA
winmm.dll
 0x45c7d0 mciSendCommandA
rasapi32
 0x45c7d8 RasDialA

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure