popup

Report - vbc.exe

Generic Malware UPX Malicious Library OS Processor Check PE File PE32
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.05.10 18:09 Machine s1_win7_x6401
Filename vbc.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
5
 Behavior Score
3.8
ZERO API file : malware
VT API (file) 32 detected (AIDetectMalware, lXlr, malicious, high confidence, Stop, Artemis, unsafe, Save, Kryptik, Eldorado, score, TrojanX, moderate, Krypt, SmokeLoader, Sabsik, MP58GV, Detected, Genetic, R002H0CEA23, Generic@AI, RDML, oOZfnKJm48U0jDdbtQqhWw, susgen)
md5 6ade942d85d1738a7d52360ca1d34080
sha256 d48a2b8410a53d0f6475fa8f93ef357ab2fbfe21a9b56af60ac3aa73cd4c1078
ssdeep 6144:7AlTLATq+/lVkvYIfTWVKAag6K5vIV6DvGG4+:7q0Tq+xWaVK7OIVQvG
imphash e48ce786839b8555216670df4b01894b
impfuzzy 48:kUwJyeURmy1FdK1h+fcIGBtoeoK2cWI+GAEuQx1NQ:kUuyBnK1h+fcIGBtNo7cWI2B
  Network IP location

Signature (7cnts)

Level Description
danger Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually)
danger File has been identified by 32 AntiVirus engines on VirusTotal as malicious
watch Communicates with host for which no DNS query was performed
notice Allocates read-write-execute memory (usually to unpack itself)
notice The binary likely contains encrypted or compressed data indicative of a packer
info The file contains an unknown PE resource name possibly indicative of a packer
info This executable has a PDB path

Rules (6cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x401010 ReadConsoleA
 0x401014 GetSystemWindowsDirectoryW
 0x401018 GetProfileStringW
 0x40101c WaitForSingleObject
 0x401020 CancelWaitableTimer
 0x401024 AddConsoleAliasW
 0x401028 GetModuleHandleW
 0x40102c EnumCalendarInfoExW
 0x401030 IsBadReadPtr
 0x401034 GetConsoleAliasesLengthA
 0x401038 GetNumberFormatA
 0x40103c EnumTimeFormatsA
 0x401040 EnumTimeFormatsW
 0x401044 CreateActCtxW
 0x401048 EnumResourceTypesA
 0x40104c SetProcessPriorityBoost
 0x401050 GetCalendarInfoA
 0x401054 SetSystemTimeAdjustment
 0x401058 HeapCreate
 0x40105c WritePrivateProfileStructW
 0x401060 FindNextVolumeW
 0x401064 GetConsoleAliasW
 0x401068 Beep
 0x40106c SetConsoleCursorPosition
 0x401070 WriteConsoleW
 0x401074 GetModuleFileNameW
 0x401078 lstrlenW
 0x40107c ReplaceFileA
 0x401080 GlobalUnlock
 0x401084 GetConsoleAliasesW
 0x401088 GetLastError
 0x40108c GetDefaultCommConfigW
 0x401090 GetProcAddress
 0x401094 VirtualAlloc
 0x401098 CreateConsoleScreenBuffer
 0x40109c BeginUpdateResourceW
 0x4010a0 RemoveDirectoryA
 0x4010a4 SetComputerNameA
 0x4010a8 LoadLibraryA
 0x4010ac InterlockedExchangeAdd
 0x4010b0 LocalAlloc
 0x4010b4 FindFirstVolumeMountPointW
 0x4010b8 IsSystemResumeAutomatic
 0x4010bc QueryDosDeviceW
 0x4010c0 WriteProfileSectionW
 0x4010c4 AddAtomA
 0x4010c8 GetModuleHandleA
 0x4010cc GetConsoleTitleW
 0x4010d0 EnumDateFormatsW
 0x4010d4 GetConsoleCursorInfo
 0x4010d8 GetShortPathNameW
 0x4010dc GetDiskFreeSpaceExA
 0x4010e0 FindAtomW
 0x4010e4 GetWindowsDirectoryW
 0x4010e8 DeleteTimerQueueTimer
 0x4010ec GetConsoleSelectionInfo
 0x4010f0 EnumSystemLocalesW
 0x4010f4 CreateFileA
 0x4010f8 CloseHandle
 0x4010fc GetConsoleOutputCP
 0x401100 WriteConsoleA
 0x401104 SetStdHandle
 0x401108 SetProcessAffinityMask
 0x40110c GetTempFileNameW
 0x401110 GetLongPathNameW
 0x401114 GetComputerNameA
 0x401118 FlushFileBuffers
 0x40111c InterlockedIncrement
 0x401120 InterlockedDecrement
 0x401124 Sleep
 0x401128 InitializeCriticalSection
 0x40112c DeleteCriticalSection
 0x401130 EnterCriticalSection
 0x401134 LeaveCriticalSection
 0x401138 HeapAlloc
 0x40113c MultiByteToWideChar
 0x401140 GetStartupInfoW
 0x401144 RaiseException
 0x401148 RtlUnwind
 0x40114c UnhandledExceptionFilter
 0x401150 SetUnhandledExceptionFilter
 0x401154 HeapFree
 0x401158 TerminateProcess
 0x40115c GetCurrentProcess
 0x401160 IsDebuggerPresent
 0x401164 SetHandleCount
 0x401168 GetStdHandle
 0x40116c GetFileType
 0x401170 GetStartupInfoA
 0x401174 VirtualFree
 0x401178 HeapReAlloc
 0x40117c ExitProcess
 0x401180 WriteFile
 0x401184 GetModuleFileNameA
 0x401188 GetCPInfo
 0x40118c GetACP
 0x401190 GetOEMCP
 0x401194 IsValidCodePage
 0x401198 TlsGetValue
 0x40119c TlsAlloc
 0x4011a0 TlsSetValue
 0x4011a4 TlsFree
 0x4011a8 SetLastError
 0x4011ac GetCurrentThreadId
 0x4011b0 FreeEnvironmentStringsW
 0x4011b4 GetEnvironmentStringsW
 0x4011b8 GetCommandLineW
 0x4011bc QueryPerformanceCounter
 0x4011c0 GetTickCount
 0x4011c4 GetCurrentProcessId
 0x4011c8 GetSystemTimeAsFileTime
 0x4011cc HeapSize
 0x4011d0 GetLocaleInfoA
 0x4011d4 GetStringTypeA
 0x4011d8 GetStringTypeW
 0x4011dc SetFilePointer
 0x4011e0 WideCharToMultiByte
 0x4011e4 GetConsoleCP
 0x4011e8 GetConsoleMode
 0x4011ec InitializeCriticalSectionAndSpinCount
 0x4011f0 LCMapStringA
 0x4011f4 LCMapStringW
USER32.dll
 0x4011fc GetSysColorBrush
 0x401200 ToAsciiEx
 0x401204 ChangeMenuW
 0x401208 GetClassInfoExA
 0x40120c SetParent
 0x401210 CreateAcceleratorTableA
 0x401214 GetWindowLongA
GDI32.dll
 0x401000 GetCharWidthA
 0x401004 SetColorAdjustment
 0x401008 GetCharABCWidthsFloatW
WINHTTP.dll
 0x40121c WinHttpOpen

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure