popup

Report - vbc.exe

Malicious Library UPX PE File PE32
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.11.09 09:52 Machine s1_win7_x6401
Filename vbc.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
4
 Behavior Score
3.0
ZERO API file : clean
VT API (file) 17 detected (malicious, high confidence, EQMJ, FileRepMalware, kcloud, Delfinject, Artemis, BScope, Noon, Generic@ML, RDML, weKRhTMTQQQo1k62Mo1YMg, susgen, EQAC)
md5 5ecf66273f0e0a3755cc65792c0379dc
sha256 1fc33c4cccbeac1f2a0a7a4145ab2248848d349ec89f0594a564aa6ef7704a89
ssdeep 24576:qXl9a+cwnxqZ9vh9aRWBDvHnVDmlRZYtYtb0v:qXTSQ0iSHnVDmlRZY2tIv
imphash 6e392f8dc2c8cc2d39a7098cedc92259
impfuzzy 192:33IF9BG1QImpbuuArSUvK9aqooqEse7CPbOQ0X:33Oe12AA9ovPbOQe
  Network IP location

Signature (8cnts)

Level Description
watch File has been identified by 17 AntiVirus engines on VirusTotal as malicious
watch Network activity contains more than one unique useragent
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Performs some HTTP requests
info One or more processes crashed
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The executable uses a known packer

Rules (4cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (6cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&ct=1636418955&rver=7.3.6962.0&wp=MBI_SSL_SHARED&wreply=https:%2F%2Fonedrive.live.com%2Fdownload%3Fcid%3D3AD292385C59C809%26resid%3D3AD292385C59C809%2521106%26authkey%3DAHXb1biR0zpJmSw&lc=1033&id=2502
whois
KR MICROSOFT-CORP-MSN-AS-BLOCK 20.190.144.161 clean
https://onedrive.live.com/download?cid=3AD292385C59C809&resid=3AD292385C59C809%21106&authkey=AHXb1biR0zpJmSw
whois
US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.13 clean
login.live.com
whois
SG MICROSOFT-CORP-MSN-AS-BLOCK 40.126.35.64 clean
onedrive.live.com
whois
US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.13 mailcious
13.107.42.13
whois
US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.13 mailcious
20.190.144.161
whois
KR MICROSOFT-CORP-MSN-AS-BLOCK 20.190.144.161 clean

Suricata ids

SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x498168 DeleteCriticalSection
 0x49816c LeaveCriticalSection
 0x498170 EnterCriticalSection
 0x498174 InitializeCriticalSection
 0x498178 VirtualFree
 0x49817c VirtualAlloc
 0x498180 LocalFree
 0x498184 LocalAlloc
 0x498188 GetTickCount
 0x49818c QueryPerformanceCounter
 0x498190 GetVersion
 0x498194 GetCurrentThreadId
 0x498198 InterlockedDecrement
 0x49819c InterlockedIncrement
 0x4981a0 VirtualQuery
 0x4981a4 WideCharToMultiByte
 0x4981a8 MultiByteToWideChar
 0x4981ac lstrlenA
 0x4981b0 lstrcpynA
 0x4981b4 LoadLibraryExA
 0x4981b8 GetThreadLocale
 0x4981bc GetStartupInfoA
 0x4981c0 GetProcAddress
 0x4981c4 GetModuleHandleA
 0x4981c8 GetModuleFileNameA
 0x4981cc GetLocaleInfoA
 0x4981d0 GetCommandLineA
 0x4981d4 FreeLibrary
 0x4981d8 FindFirstFileA
 0x4981dc FindClose
 0x4981e0 ExitProcess
 0x4981e4 ExitThread
 0x4981e8 CreateThread
 0x4981ec WriteFile
 0x4981f0 UnhandledExceptionFilter
 0x4981f4 RtlUnwind
 0x4981f8 RaiseException
 0x4981fc GetStdHandle
user32.dll
 0x498204 GetKeyboardType
 0x498208 LoadStringA
 0x49820c MessageBoxA
 0x498210 CharNextA
advapi32.dll
 0x498218 RegQueryValueExA
 0x49821c RegOpenKeyExA
 0x498220 RegCloseKey
oleaut32.dll
 0x498228 SysFreeString
 0x49822c SysReAllocStringLen
 0x498230 SysAllocStringLen
kernel32.dll
 0x498238 TlsSetValue
 0x49823c TlsGetValue
 0x498240 LocalAlloc
 0x498244 GetModuleHandleA
advapi32.dll
 0x49824c RegQueryValueExA
 0x498250 RegOpenKeyExA
 0x498254 RegCloseKey
kernel32.dll
 0x49825c lstrcpyA
 0x498260 WriteFile
 0x498264 WaitForSingleObject
 0x498268 VirtualQuery
 0x49826c VirtualProtect
 0x498270 VirtualAlloc
 0x498274 SuspendThread
 0x498278 Sleep
 0x49827c SizeofResource
 0x498280 SetThreadPriority
 0x498284 SetThreadLocale
 0x498288 SetFilePointer
 0x49828c SetEvent
 0x498290 SetErrorMode
 0x498294 SetEndOfFile
 0x498298 ResumeThread
 0x49829c ResetEvent
 0x4982a0 ReadFile
 0x4982a4 MultiByteToWideChar
 0x4982a8 MulDiv
 0x4982ac LockResource
 0x4982b0 LoadResource
 0x4982b4 LoadLibraryA
 0x4982b8 LeaveCriticalSection
 0x4982bc InitializeCriticalSection
 0x4982c0 GlobalUnlock
 0x4982c4 GlobalReAlloc
 0x4982c8 GlobalHandle
 0x4982cc GlobalLock
 0x4982d0 GlobalFree
 0x4982d4 GlobalFindAtomA
 0x4982d8 GlobalDeleteAtom
 0x4982dc GlobalAlloc
 0x4982e0 GlobalAddAtomA
 0x4982e4 GetVersionExA
 0x4982e8 GetVersion
 0x4982ec GetTickCount
 0x4982f0 GetThreadLocale
 0x4982f4 GetSystemInfo
 0x4982f8 GetStringTypeExA
 0x4982fc GetStdHandle
 0x498300 GetProcAddress
 0x498304 GetModuleHandleA
 0x498308 GetModuleFileNameA
 0x49830c GetLocaleInfoA
 0x498310 GetLocalTime
 0x498314 GetLastError
 0x498318 GetFullPathNameA
 0x49831c GetExitCodeThread
 0x498320 GetDiskFreeSpaceA
 0x498324 GetDateFormatA
 0x498328 GetCurrentThreadId
 0x49832c GetCurrentProcessId
 0x498330 GetCPInfo
 0x498334 GetACP
 0x498338 FreeResource
 0x49833c InterlockedIncrement
 0x498340 InterlockedExchange
 0x498344 InterlockedDecrement
 0x498348 FreeLibrary
 0x49834c FormatMessageA
 0x498350 FindResourceA
 0x498354 EnumCalendarInfoA
 0x498358 EnterCriticalSection
 0x49835c DeleteCriticalSection
 0x498360 CreateThread
 0x498364 CreateFileA
 0x498368 CreateEventA
 0x49836c CompareStringA
 0x498370 CloseHandle
version.dll
 0x498378 VerQueryValueA
 0x49837c GetFileVersionInfoSizeA
 0x498380 GetFileVersionInfoA
gdi32.dll
 0x498388 UnrealizeObject
 0x49838c StretchBlt
 0x498390 SetWindowOrgEx
 0x498394 SetWinMetaFileBits
 0x498398 SetViewportOrgEx
 0x49839c SetTextColor
 0x4983a0 SetStretchBltMode
 0x4983a4 SetROP2
 0x4983a8 SetPixel
 0x4983ac SetEnhMetaFileBits
 0x4983b0 SetDIBColorTable
 0x4983b4 SetBrushOrgEx
 0x4983b8 SetBkMode
 0x4983bc SetBkColor
 0x4983c0 SelectPalette
 0x4983c4 SelectObject
 0x4983c8 SelectClipRgn
 0x4983cc SaveDC
 0x4983d0 RestoreDC
 0x4983d4 Rectangle
 0x4983d8 RectVisible
 0x4983dc RealizePalette
 0x4983e0 Polyline
 0x4983e4 PlayEnhMetaFile
 0x4983e8 PatBlt
 0x4983ec MoveToEx
 0x4983f0 MaskBlt
 0x4983f4 LineTo
 0x4983f8 IntersectClipRect
 0x4983fc GetWindowOrgEx
 0x498400 GetWinMetaFileBits
 0x498404 GetTextMetricsA
 0x498408 GetTextExtentPoint32A
 0x49840c GetSystemPaletteEntries
 0x498410 GetStockObject
 0x498414 GetPixel
 0x498418 GetPaletteEntries
 0x49841c GetObjectA
 0x498420 GetEnhMetaFilePaletteEntries
 0x498424 GetEnhMetaFileHeader
 0x498428 GetEnhMetaFileBits
 0x49842c GetDeviceCaps
 0x498430 GetDIBits
 0x498434 GetDIBColorTable
 0x498438 GetDCOrgEx
 0x49843c GetCurrentPositionEx
 0x498440 GetClipBox
 0x498444 GetBrushOrgEx
 0x498448 GetBitmapBits
 0x49844c GdiFlush
 0x498450 ExcludeClipRect
 0x498454 DeleteObject
 0x498458 DeleteEnhMetaFile
 0x49845c DeleteDC
 0x498460 CreateSolidBrush
 0x498464 CreatePenIndirect
 0x498468 CreatePalette
 0x49846c CreateHalftonePalette
 0x498470 CreateFontIndirectA
 0x498474 CreateDIBitmap
 0x498478 CreateDIBSection
 0x49847c CreateCompatibleDC
 0x498480 CreateCompatibleBitmap
 0x498484 CreateBrushIndirect
 0x498488 CreateBitmap
 0x49848c CopyEnhMetaFileA
 0x498490 BitBlt
user32.dll
 0x498498 CreateWindowExA
 0x49849c WindowFromPoint
 0x4984a0 WinHelpA
 0x4984a4 WaitMessage
 0x4984a8 UpdateWindow
 0x4984ac UnregisterClassA
 0x4984b0 UnhookWindowsHookEx
 0x4984b4 TranslateMessage
 0x4984b8 TranslateMDISysAccel
 0x4984bc TrackPopupMenu
 0x4984c0 SystemParametersInfoA
 0x4984c4 ShowWindow
 0x4984c8 ShowScrollBar
 0x4984cc ShowOwnedPopups
 0x4984d0 ShowCursor
 0x4984d4 SetWindowsHookExA
 0x4984d8 SetWindowTextA
 0x4984dc SetWindowPos
 0x4984e0 SetWindowPlacement
 0x4984e4 SetWindowLongA
 0x4984e8 SetTimer
 0x4984ec SetScrollRange
 0x4984f0 SetScrollPos
 0x4984f4 SetScrollInfo
 0x4984f8 SetRect
 0x4984fc SetPropA
 0x498500 SetParent
 0x498504 SetMenuItemInfoA
 0x498508 SetMenu
 0x49850c SetForegroundWindow
 0x498510 SetFocus
 0x498514 SetCursor
 0x498518 SetClassLongA
 0x49851c SetCapture
 0x498520 SetActiveWindow
 0x498524 SendMessageA
 0x498528 ScrollWindow
 0x49852c ScreenToClient
 0x498530 RemovePropA
 0x498534 RemoveMenu
 0x498538 ReleaseDC
 0x49853c ReleaseCapture
 0x498540 RegisterWindowMessageA
 0x498544 RegisterClipboardFormatA
 0x498548 RegisterClassA
 0x49854c RedrawWindow
 0x498550 PtInRect
 0x498554 PostQuitMessage
 0x498558 PostMessageA
 0x49855c PeekMessageA
 0x498560 OffsetRect
 0x498564 OemToCharA
 0x498568 MsgWaitForMultipleObjects
 0x49856c MessageBoxA
 0x498570 MapWindowPoints
 0x498574 MapVirtualKeyA
 0x498578 LoadStringA
 0x49857c LoadKeyboardLayoutA
 0x498580 LoadIconA
 0x498584 LoadCursorA
 0x498588 LoadBitmapA
 0x49858c KillTimer
 0x498590 IsZoomed
 0x498594 IsWindowVisible
 0x498598 IsWindowEnabled
 0x49859c IsWindow
 0x4985a0 IsRectEmpty
 0x4985a4 IsIconic
 0x4985a8 IsDialogMessageA
 0x4985ac IsChild
 0x4985b0 InvalidateRect
 0x4985b4 IntersectRect
 0x4985b8 InsertMenuItemA
 0x4985bc InsertMenuA
 0x4985c0 InflateRect
 0x4985c4 GetWindowThreadProcessId
 0x4985c8 GetWindowTextA
 0x4985cc GetWindowRect
 0x4985d0 GetWindowPlacement
 0x4985d4 GetWindowLongA
 0x4985d8 GetWindowDC
 0x4985dc GetTopWindow
 0x4985e0 GetSystemMetrics
 0x4985e4 GetSystemMenu
 0x4985e8 GetSysColorBrush
 0x4985ec GetSysColor
 0x4985f0 GetSubMenu
 0x4985f4 GetScrollRange
 0x4985f8 GetScrollPos
 0x4985fc GetScrollInfo
 0x498600 GetPropA
 0x498604 GetParent
 0x498608 GetWindow
 0x49860c GetMenuStringA
 0x498610 GetMenuState
 0x498614 GetMenuItemInfoA
 0x498618 GetMenuItemID
 0x49861c GetMenuItemCount
 0x498620 GetMenu
 0x498624 GetLastActivePopup
 0x498628 GetKeyboardState
 0x49862c GetKeyboardLayoutList
 0x498630 GetKeyboardLayout
 0x498634 GetKeyState
 0x498638 GetKeyNameTextA
 0x49863c GetIconInfo
 0x498640 GetForegroundWindow
 0x498644 GetFocus
 0x498648 GetDesktopWindow
 0x49864c GetDCEx
 0x498650 GetDC
 0x498654 GetCursorPos
 0x498658 GetCursor
 0x49865c GetClipboardData
 0x498660 GetClientRect
 0x498664 GetClassNameA
 0x498668 GetClassInfoA
 0x49866c GetCapture
 0x498670 GetActiveWindow
 0x498674 FrameRect
 0x498678 FindWindowA
 0x49867c FillRect
 0x498680 EqualRect
 0x498684 EnumWindows
 0x498688 EnumThreadWindows
 0x49868c EndPaint
 0x498690 EnableWindow
 0x498694 EnableScrollBar
 0x498698 EnableMenuItem
 0x49869c DrawTextA
 0x4986a0 DrawMenuBar
 0x4986a4 DrawIconEx
 0x4986a8 DrawIcon
 0x4986ac DrawFrameControl
 0x4986b0 DrawEdge
 0x4986b4 DispatchMessageA
 0x4986b8 DestroyWindow
 0x4986bc DestroyMenu
 0x4986c0 DestroyIcon
 0x4986c4 DestroyCursor
 0x4986c8 DeleteMenu
 0x4986cc DefWindowProcA
 0x4986d0 DefMDIChildProcA
 0x4986d4 DefFrameProcA
 0x4986d8 CreatePopupMenu
 0x4986dc CreateMenu
 0x4986e0 CreateIcon
 0x4986e4 ClientToScreen
 0x4986e8 CheckMenuItem
 0x4986ec CallWindowProcA
 0x4986f0 CallNextHookEx
 0x4986f4 BeginPaint
 0x4986f8 CharNextA
 0x4986fc CharLowerBuffA
 0x498700 CharLowerA
 0x498704 CharUpperBuffA
 0x498708 CharToOemA
 0x49870c AdjustWindowRectEx
 0x498710 ActivateKeyboardLayout
kernel32.dll
 0x498718 Sleep
oleaut32.dll
 0x498720 SafeArrayPtrOfIndex
 0x498724 SafeArrayPutElement
 0x498728 SafeArrayGetElement
 0x49872c SafeArrayUnaccessData
 0x498730 SafeArrayAccessData
 0x498734 SafeArrayGetUBound
 0x498738 SafeArrayGetLBound
 0x49873c SafeArrayCreate
 0x498740 VariantChangeType
 0x498744 VariantCopyInd
 0x498748 VariantCopy
 0x49874c VariantClear
 0x498750 VariantInit
ole32.dll
 0x498758 CoUninitialize
 0x49875c CoInitialize
oleaut32.dll
 0x498764 GetErrorInfo
 0x498768 SysFreeString
comctl32.dll
 0x498770 ImageList_SetIconSize
 0x498774 ImageList_GetIconSize
 0x498778 ImageList_Write
 0x49877c ImageList_Read
 0x498780 ImageList_GetDragImage
 0x498784 ImageList_DragShowNolock
 0x498788 ImageList_SetDragCursorImage
 0x49878c ImageList_DragMove
 0x498790 ImageList_DragLeave
 0x498794 ImageList_DragEnter
 0x498798 ImageList_EndDrag
 0x49879c ImageList_BeginDrag
 0x4987a0 ImageList_Remove
 0x4987a4 ImageList_DrawEx
 0x4987a8 ImageList_Replace
 0x4987ac ImageList_Draw
 0x4987b0 ImageList_GetBkColor
 0x4987b4 ImageList_SetBkColor
 0x4987b8 ImageList_ReplaceIcon
 0x4987bc ImageList_Add
 0x4987c0 ImageList_SetImageCount
 0x4987c4 ImageList_GetImageCount
 0x4987c8 ImageList_Destroy
 0x4987cc ImageList_Create
advapi32.dll
 0x4987d4 QueryServiceStatus
 0x4987d8 OpenServiceA
 0x4987dc OpenSCManagerA
 0x4987e0 CloseServiceHandle
winhttp
 0x4987e8 WinHttpCrackUrl

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure