popup

Report - vbc.exe

Malicious Library UPX PE File PE32
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.11.19 17:17 Machine s1_win7_x6401
Filename vbc.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
6
 Behavior Score
3.6
ZERO API file : clean
VT API (file) 19 detected (AIDetect, malware2, Artemis, Unsafe, BXOQ, EQOF, R002H07KI21, Fareit, Malicious, kcloud, Phonzy, score, EQAC)
md5 d93485214a34d7f7a47854960cf51e89
sha256 8968808899b3e810e675fc87e6ff0f61c82b444183fd7f8febdb276eee05e683
ssdeep 24576:IAysw0SxuOso3abg4gGJaysrP/mJXgESvLqk:IAySo3vGJaysrP/mJXg6
imphash 9932ed6ef0f007ba412ff7a0ba590c83
impfuzzy 192:P3vdNxk1aTEYbuuAxSUvK9yqoaqEXo7X2POQXg/A:P3vXy1cAq9AoPOQt
  Network IP location

Signature (10cnts)

Level Description
watch File has been identified by 19 AntiVirus engines on VirusTotal as malicious
watch Network activity contains more than one unique useragent
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Performs some HTTP requests
notice The binary likely contains encrypted or compressed data indicative of a packer
info One or more processes crashed
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The executable uses a known packer
info The file contains an unknown PE resource name possibly indicative of a packer

Rules (4cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (7cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&ct=1637309693&rver=7.3.6962.0&wp=MBI_SSL_SHARED&wreply=https:%2F%2Fonedrive.live.com%2Fdownload%3Fcid%3D12E1C0826CE1E631%26resid%3D12E1C0826CE1E631%2521111%26authkey%3DADdmmgbfTgMAmYM&lc=1033&id=2502
whois
SG MICROSOFT-CORP-MSN-AS-BLOCK 40.126.35.87 clean
https://onedrive.live.com/download?cid=12E1C0826CE1E631&resid=12E1C0826CE1E631%21111&authkey=ADdmmgbfTgMAmYM
whois
US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.13 clean
https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&ct=1637309694&rver=7.3.6962.0&wp=MBI_SSL_SHARED&wreply=https:%2F%2Fonedrive.live.com%2Fdownload%3Fcid%3D12E1C0826CE1E631%26resid%3D12E1C0826CE1E631%2521111%26authkey%3DADdmmgbfTgMAmYM&lc=1033&id=2502
whois
SG MICROSOFT-CORP-MSN-AS-BLOCK 40.126.35.87 clean
login.live.com
whois
JP MICROSOFT-CORP-MSN-AS-BLOCK 20.190.166.5 clean
onedrive.live.com
whois
US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.13 mailcious
40.126.35.87
whois
SG MICROSOFT-CORP-MSN-AS-BLOCK 40.126.35.87 clean
13.107.42.13
whois
US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.13 mailcious

Suricata ids

SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x4a0190 DeleteCriticalSection
 0x4a0194 LeaveCriticalSection
 0x4a0198 EnterCriticalSection
 0x4a019c InitializeCriticalSection
 0x4a01a0 VirtualFree
 0x4a01a4 VirtualAlloc
 0x4a01a8 LocalFree
 0x4a01ac LocalAlloc
 0x4a01b0 GetVersion
 0x4a01b4 GetCurrentThreadId
 0x4a01b8 InterlockedDecrement
 0x4a01bc InterlockedIncrement
 0x4a01c0 VirtualQuery
 0x4a01c4 WideCharToMultiByte
 0x4a01c8 MultiByteToWideChar
 0x4a01cc lstrlenA
 0x4a01d0 lstrcpynA
 0x4a01d4 LoadLibraryExA
 0x4a01d8 GetThreadLocale
 0x4a01dc GetStartupInfoA
 0x4a01e0 GetProcAddress
 0x4a01e4 GetModuleHandleA
 0x4a01e8 GetModuleFileNameA
 0x4a01ec GetLocaleInfoA
 0x4a01f0 GetLastError
 0x4a01f4 GetCommandLineA
 0x4a01f8 FreeLibrary
 0x4a01fc FindFirstFileA
 0x4a0200 FindClose
 0x4a0204 ExitProcess
 0x4a0208 WriteFile
 0x4a020c UnhandledExceptionFilter
 0x4a0210 SetFilePointer
 0x4a0214 SetEndOfFile
 0x4a0218 RtlUnwind
 0x4a021c ReadFile
 0x4a0220 RaiseException
 0x4a0224 GetStdHandle
 0x4a0228 GetFileSize
 0x4a022c GetFileType
 0x4a0230 DeleteFileA
 0x4a0234 CreateFileA
 0x4a0238 CloseHandle
user32.dll
 0x4a0240 GetKeyboardType
 0x4a0244 LoadStringA
 0x4a0248 MessageBoxA
 0x4a024c CharNextA
advapi32.dll
 0x4a0254 RegQueryValueExA
 0x4a0258 RegOpenKeyExA
 0x4a025c RegCloseKey
oleaut32.dll
 0x4a0264 SysFreeString
 0x4a0268 SysReAllocStringLen
 0x4a026c SysAllocStringLen
kernel32.dll
 0x4a0274 TlsSetValue
 0x4a0278 TlsGetValue
 0x4a027c LocalAlloc
 0x4a0280 GetModuleHandleA
advapi32.dll
 0x4a0288 RegQueryValueExA
 0x4a028c RegOpenKeyExA
 0x4a0290 RegCloseKey
kernel32.dll
 0x4a0298 lstrcpyA
 0x4a029c WriteFile
 0x4a02a0 WaitForSingleObject
 0x4a02a4 VirtualQuery
 0x4a02a8 VirtualProtect
 0x4a02ac VirtualAlloc
 0x4a02b0 Sleep
 0x4a02b4 SizeofResource
 0x4a02b8 SetThreadLocale
 0x4a02bc SetFilePointer
 0x4a02c0 SetEvent
 0x4a02c4 SetErrorMode
 0x4a02c8 SetEndOfFile
 0x4a02cc ResetEvent
 0x4a02d0 ReleaseMutex
 0x4a02d4 ReadFile
 0x4a02d8 MultiByteToWideChar
 0x4a02dc MulDiv
 0x4a02e0 LockResource
 0x4a02e4 LoadResource
 0x4a02e8 LoadLibraryW
 0x4a02ec LoadLibraryA
 0x4a02f0 LeaveCriticalSection
 0x4a02f4 InitializeCriticalSection
 0x4a02f8 GlobalUnlock
 0x4a02fc GlobalSize
 0x4a0300 GlobalReAlloc
 0x4a0304 GlobalHandle
 0x4a0308 GlobalLock
 0x4a030c GlobalFree
 0x4a0310 GlobalFindAtomA
 0x4a0314 GlobalDeleteAtom
 0x4a0318 GlobalAlloc
 0x4a031c GlobalAddAtomA
 0x4a0320 GetVersionExA
 0x4a0324 GetVersion
 0x4a0328 GetUserDefaultLCID
 0x4a032c GetTickCount
 0x4a0330 GetThreadLocale
 0x4a0334 GetSystemInfo
 0x4a0338 GetStringTypeExA
 0x4a033c GetStdHandle
 0x4a0340 GetProcAddress
 0x4a0344 GetModuleHandleA
 0x4a0348 GetModuleFileNameA
 0x4a034c GetLocaleInfoA
 0x4a0350 GetLocalTime
 0x4a0354 GetLastError
 0x4a0358 GetFullPathNameA
 0x4a035c GetExitCodeThread
 0x4a0360 GetDriveTypeA
 0x4a0364 GetDiskFreeSpaceA
 0x4a0368 GetDateFormatA
 0x4a036c GetCurrentThreadId
 0x4a0370 GetCurrentProcessId
 0x4a0374 GetCPInfo
 0x4a0378 GetACP
 0x4a037c FreeResource
 0x4a0380 InterlockedExchange
 0x4a0384 FreeLibrary
 0x4a0388 FormatMessageA
 0x4a038c FindResourceA
 0x4a0390 FindFirstFileA
 0x4a0394 FindClose
 0x4a0398 FileTimeToLocalFileTime
 0x4a039c FileTimeToDosDateTime
 0x4a03a0 EnumCalendarInfoA
 0x4a03a4 EnterCriticalSection
 0x4a03a8 DeleteCriticalSection
 0x4a03ac CreateThread
 0x4a03b0 CreateFileA
 0x4a03b4 CreateEventA
 0x4a03b8 CompareStringA
 0x4a03bc CloseHandle
version.dll
 0x4a03c4 VerQueryValueA
 0x4a03c8 GetFileVersionInfoSizeA
 0x4a03cc GetFileVersionInfoA
gdi32.dll
 0x4a03d4 UnrealizeObject
 0x4a03d8 TextOutA
 0x4a03dc StretchBlt
 0x4a03e0 SetWindowOrgEx
 0x4a03e4 SetWinMetaFileBits
 0x4a03e8 SetViewportOrgEx
 0x4a03ec SetTextColor
 0x4a03f0 SetStretchBltMode
 0x4a03f4 SetROP2
 0x4a03f8 SetPixel
 0x4a03fc SetEnhMetaFileBits
 0x4a0400 SetDIBColorTable
 0x4a0404 SetBrushOrgEx
 0x4a0408 SetBkMode
 0x4a040c SetBkColor
 0x4a0410 SelectPalette
 0x4a0414 SelectObject
 0x4a0418 SelectClipRgn
 0x4a041c SaveDC
 0x4a0420 RestoreDC
 0x4a0424 Rectangle
 0x4a0428 RectVisible
 0x4a042c RealizePalette
 0x4a0430 Polyline
 0x4a0434 PlayEnhMetaFile
 0x4a0438 PatBlt
 0x4a043c OffsetRgn
 0x4a0440 MoveToEx
 0x4a0444 MaskBlt
 0x4a0448 LineTo
 0x4a044c IntersectClipRect
 0x4a0450 GetWindowOrgEx
 0x4a0454 GetWinMetaFileBits
 0x4a0458 GetTextMetricsA
 0x4a045c GetTextExtentPointA
 0x4a0460 GetTextExtentPoint32A
 0x4a0464 GetTextExtentExPointA
 0x4a0468 GetSystemPaletteEntries
 0x4a046c GetStockObject
 0x4a0470 GetPixel
 0x4a0474 GetPaletteEntries
 0x4a0478 GetObjectA
 0x4a047c GetEnhMetaFilePaletteEntries
 0x4a0480 GetEnhMetaFileHeader
 0x4a0484 GetEnhMetaFileDescriptionA
 0x4a0488 GetEnhMetaFileBits
 0x4a048c GetDeviceCaps
 0x4a0490 GetDIBits
 0x4a0494 GetDIBColorTable
 0x4a0498 GetDCOrgEx
 0x4a049c GetCurrentPositionEx
 0x4a04a0 GetClipBox
 0x4a04a4 GetBrushOrgEx
 0x4a04a8 GetBitmapBits
 0x4a04ac GdiFlush
 0x4a04b0 ExtTextOutA
 0x4a04b4 ExcludeClipRect
 0x4a04b8 DeleteObject
 0x4a04bc DeleteEnhMetaFile
 0x4a04c0 DeleteDC
 0x4a04c4 CreateSolidBrush
 0x4a04c8 CreateRectRgn
 0x4a04cc CreatePenIndirect
 0x4a04d0 CreatePalette
 0x4a04d4 CreateHalftonePalette
 0x4a04d8 CreateFontIndirectA
 0x4a04dc CreateEnhMetaFileA
 0x4a04e0 CreateDIBitmap
 0x4a04e4 CreateDIBSection
 0x4a04e8 CreateCompatibleDC
 0x4a04ec CreateCompatibleBitmap
 0x4a04f0 CreateBrushIndirect
 0x4a04f4 CreateBitmap
 0x4a04f8 CopyEnhMetaFileA
 0x4a04fc CloseEnhMetaFile
 0x4a0500 BitBlt
user32.dll
 0x4a0508 CreateWindowExA
 0x4a050c WindowFromPoint
 0x4a0510 WinHelpA
 0x4a0514 WaitMessage
 0x4a0518 UpdateWindow
 0x4a051c UnregisterClassA
 0x4a0520 UnhookWindowsHookEx
 0x4a0524 TranslateMessage
 0x4a0528 TranslateMDISysAccel
 0x4a052c TrackPopupMenu
 0x4a0530 SystemParametersInfoA
 0x4a0534 ShowWindow
 0x4a0538 ShowScrollBar
 0x4a053c ShowOwnedPopups
 0x4a0540 ShowCursor
 0x4a0544 SetWindowsHookExA
 0x4a0548 SetWindowTextA
 0x4a054c SetWindowPos
 0x4a0550 SetWindowPlacement
 0x4a0554 SetWindowLongA
 0x4a0558 SetTimer
 0x4a055c SetScrollRange
 0x4a0560 SetScrollPos
 0x4a0564 SetScrollInfo
 0x4a0568 SetRect
 0x4a056c SetPropA
 0x4a0570 SetParent
 0x4a0574 SetMenuItemInfoA
 0x4a0578 SetMenu
 0x4a057c SetForegroundWindow
 0x4a0580 SetFocus
 0x4a0584 SetCursor
 0x4a0588 SetClipboardData
 0x4a058c SetClassLongA
 0x4a0590 SetCapture
 0x4a0594 SetActiveWindow
 0x4a0598 SendMessageA
 0x4a059c ScrollWindow
 0x4a05a0 ScreenToClient
 0x4a05a4 RemovePropA
 0x4a05a8 RemoveMenu
 0x4a05ac ReleaseDC
 0x4a05b0 ReleaseCapture
 0x4a05b4 RegisterWindowMessageA
 0x4a05b8 RegisterClipboardFormatA
 0x4a05bc RegisterClassA
 0x4a05c0 RedrawWindow
 0x4a05c4 PtInRect
 0x4a05c8 PostQuitMessage
 0x4a05cc PostMessageA
 0x4a05d0 PeekMessageA
 0x4a05d4 OpenClipboard
 0x4a05d8 OffsetRect
 0x4a05dc OemToCharA
 0x4a05e0 MessageBoxA
 0x4a05e4 MessageBeep
 0x4a05e8 MapWindowPoints
 0x4a05ec MapVirtualKeyA
 0x4a05f0 LoadStringA
 0x4a05f4 LoadKeyboardLayoutA
 0x4a05f8 LoadIconA
 0x4a05fc LoadCursorA
 0x4a0600 LoadBitmapA
 0x4a0604 KillTimer
 0x4a0608 IsZoomed
 0x4a060c IsWindowVisible
 0x4a0610 IsWindowEnabled
 0x4a0614 IsWindow
 0x4a0618 IsRectEmpty
 0x4a061c IsIconic
 0x4a0620 IsDialogMessageA
 0x4a0624 IsChild
 0x4a0628 InvalidateRect
 0x4a062c IntersectRect
 0x4a0630 InsertMenuItemA
 0x4a0634 InsertMenuA
 0x4a0638 InflateRect
 0x4a063c GetWindowThreadProcessId
 0x4a0640 GetWindowTextA
 0x4a0644 GetWindowRect
 0x4a0648 GetWindowPlacement
 0x4a064c GetWindowLongA
 0x4a0650 GetWindowDC
 0x4a0654 GetTopWindow
 0x4a0658 GetSystemMetrics
 0x4a065c GetSystemMenu
 0x4a0660 GetSysColorBrush
 0x4a0664 GetSysColor
 0x4a0668 GetSubMenu
 0x4a066c GetScrollRange
 0x4a0670 GetScrollPos
 0x4a0674 GetScrollInfo
 0x4a0678 GetPropA
 0x4a067c GetParent
 0x4a0680 GetWindow
 0x4a0684 GetMessageTime
 0x4a0688 GetMenuStringA
 0x4a068c GetMenuState
 0x4a0690 GetMenuItemInfoA
 0x4a0694 GetMenuItemID
 0x4a0698 GetMenuItemCount
 0x4a069c GetMenu
 0x4a06a0 GetLastActivePopup
 0x4a06a4 GetKeyboardState
 0x4a06a8 GetKeyboardLayoutList
 0x4a06ac GetKeyboardLayout
 0x4a06b0 GetKeyState
 0x4a06b4 GetKeyNameTextA
 0x4a06b8 GetIconInfo
 0x4a06bc GetForegroundWindow
 0x4a06c0 GetFocus
 0x4a06c4 GetDesktopWindow
 0x4a06c8 GetDCEx
 0x4a06cc GetDC
 0x4a06d0 GetCursorPos
 0x4a06d4 GetCursor
 0x4a06d8 GetClipboardData
 0x4a06dc GetClientRect
 0x4a06e0 GetClassNameA
 0x4a06e4 GetClassInfoA
 0x4a06e8 GetCapture
 0x4a06ec GetActiveWindow
 0x4a06f0 FrameRect
 0x4a06f4 FindWindowA
 0x4a06f8 FillRect
 0x4a06fc EqualRect
 0x4a0700 EnumWindows
 0x4a0704 EnumThreadWindows
 0x4a0708 EndPaint
 0x4a070c EnableWindow
 0x4a0710 EnableScrollBar
 0x4a0714 EnableMenuItem
 0x4a0718 EmptyClipboard
 0x4a071c DrawTextA
 0x4a0720 DrawMenuBar
 0x4a0724 DrawIconEx
 0x4a0728 DrawIcon
 0x4a072c DrawFrameControl
 0x4a0730 DrawFocusRect
 0x4a0734 DrawEdge
 0x4a0738 DispatchMessageA
 0x4a073c DestroyWindow
 0x4a0740 DestroyMenu
 0x4a0744 DestroyIcon
 0x4a0748 DestroyCursor
 0x4a074c DeleteMenu
 0x4a0750 DefWindowProcA
 0x4a0754 DefMDIChildProcA
 0x4a0758 DefFrameProcA
 0x4a075c CreatePopupMenu
 0x4a0760 CreateMenu
 0x4a0764 CreateIcon
 0x4a0768 CloseClipboard
 0x4a076c ClientToScreen
 0x4a0770 CheckMenuItem
 0x4a0774 CallWindowProcA
 0x4a0778 CallNextHookEx
 0x4a077c BeginPaint
 0x4a0780 CharNextA
 0x4a0784 CharLowerBuffA
 0x4a0788 CharLowerA
 0x4a078c CharUpperBuffA
 0x4a0790 CharToOemBuffA
 0x4a0794 CharToOemA
 0x4a0798 AdjustWindowRectEx
 0x4a079c ActivateKeyboardLayout
kernel32.dll
 0x4a07a4 Sleep
oleaut32.dll
 0x4a07ac SafeArrayPtrOfIndex
 0x4a07b0 SafeArrayGetUBound
 0x4a07b4 SafeArrayGetLBound
 0x4a07b8 SafeArrayCreate
 0x4a07bc VariantChangeType
 0x4a07c0 VariantCopy
 0x4a07c4 VariantClear
 0x4a07c8 VariantInit
ole32.dll
 0x4a07d0 CreateStreamOnHGlobal
 0x4a07d4 IsAccelerator
 0x4a07d8 OleDraw
 0x4a07dc OleSetMenuDescriptor
 0x4a07e0 CoCreateInstance
 0x4a07e4 CoGetClassObject
 0x4a07e8 CoUninitialize
 0x4a07ec CoInitialize
 0x4a07f0 IsEqualGUID
oleaut32.dll
 0x4a07f8 GetErrorInfo
 0x4a07fc SysFreeString
comctl32.dll
 0x4a0804 ImageList_SetIconSize
 0x4a0808 ImageList_GetIconSize
 0x4a080c ImageList_Write
 0x4a0810 ImageList_Read
 0x4a0814 ImageList_GetDragImage
 0x4a0818 ImageList_DragShowNolock
 0x4a081c ImageList_SetDragCursorImage
 0x4a0820 ImageList_DragMove
 0x4a0824 ImageList_DragLeave
 0x4a0828 ImageList_DragEnter
 0x4a082c ImageList_EndDrag
 0x4a0830 ImageList_BeginDrag
 0x4a0834 ImageList_Remove
 0x4a0838 ImageList_DrawEx
 0x4a083c ImageList_Replace
 0x4a0840 ImageList_Draw
 0x4a0844 ImageList_GetBkColor
 0x4a0848 ImageList_SetBkColor
 0x4a084c ImageList_ReplaceIcon
 0x4a0850 ImageList_Add
 0x4a0854 ImageList_SetImageCount
 0x4a0858 ImageList_GetImageCount
 0x4a085c ImageList_Destroy
 0x4a0860 ImageList_Create
 0x4a0864 InitCommonControls
winmm.dll
 0x4a086c waveOutUnprepareHeader
 0x4a0870 waveOutReset
 0x4a0874 waveOutGetNumDevs
 0x4a0878 waveOutGetErrorTextA
 0x4a087c waveOutGetDevCapsA
 0x4a0880 waveOutClose
 0x4a0884 mixerOpen
 0x4a0888 mixerGetNumDevs
 0x4a088c mixerGetLineInfoA
 0x4a0890 mixerGetLineControlsA
 0x4a0894 mixerGetID
 0x4a0898 mixerGetDevCapsA
 0x4a089c mixerGetControlDetailsA
 0x4a08a0 mixerClose
 0x4a08a4 mciSendCommandA
 0x4a08a8 mciGetErrorStringA
advapi32.dll
 0x4a08b0 QueryServiceStatus
 0x4a08b4 OpenServiceA
 0x4a08b8 OpenSCManagerA
 0x4a08bc CloseServiceHandle
advapi32
 0x4a08c4 AuditFree
advapi32
 0x4a08cc AuditFree

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure