popup

Report - vbc.exe

Generic Malware UPX Malicious Library OS Processor Check PE File PE32
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.05.10 18:02 Machine s1_win7_x6401
Filename vbc.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
5
 Behavior Score
3.8
ZERO API file : malware
VT API (file) 30 detected (AIDetectMalware, malicious, high confidence, Stop, unsafe, Save, Kryptik, Eldorado, GenKryptik, GJRD, score, Androm, PWSX, Generic@AI, RDML, CJzKdr5QCPruKi, K0ypeAQ, Krypt, moderate, Static AI, Suspicious PE, Sabsik, Amadey, Detected, Genetic, SmokeLoader, GJQU, confidence, 100%)
md5 906095752970580abc9cabb800275187
sha256 21e0ec96d06a0b1e71712fd34ce50e1e4c5a937e8fe8c21f89c5eade948affd5
ssdeep 6144:75eMULO4RRcb7XHmmGnFdvDUQGkNIsPUNvGG4:7DUq4RRC7XGmudvDiuIjvG
imphash f638bba0028bbeebea7ddd6400ec7cc1
impfuzzy 48:kUwIyeURmy1FdK1N+fcIGBtoeoK2cWI+GAEuQx1NuP:kUjyBnK1N+fcIGBtNo7cWI2FP
  Network IP location

Signature (7cnts)

Level Description
danger Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually)
danger File has been identified by 30 AntiVirus engines on VirusTotal as malicious
watch Communicates with host for which no DNS query was performed
notice Allocates read-write-execute memory (usually to unpack itself)
notice The binary likely contains encrypted or compressed data indicative of a packer
info The file contains an unknown PE resource name possibly indicative of a packer
info This executable has a PDB path

Rules (6cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x401010 ReadConsoleA
 0x401014 GetSystemWindowsDirectoryW
 0x401018 GetProfileStringW
 0x40101c WaitForSingleObject
 0x401020 CancelWaitableTimer
 0x401024 AddConsoleAliasW
 0x401028 GetModuleHandleW
 0x40102c EnumCalendarInfoExW
 0x401030 IsBadReadPtr
 0x401034 GetConsoleAliasesLengthA
 0x401038 GetNumberFormatA
 0x40103c GetWindowsDirectoryA
 0x401040 EnumTimeFormatsA
 0x401044 EnumTimeFormatsW
 0x401048 CreateActCtxW
 0x40104c EnumResourceTypesA
 0x401050 SetProcessPriorityBoost
 0x401054 GetCalendarInfoA
 0x401058 SetSystemTimeAdjustment
 0x40105c HeapCreate
 0x401060 WritePrivateProfileStructW
 0x401064 FindNextVolumeW
 0x401068 GetConsoleAliasW
 0x40106c Beep
 0x401070 SetConsoleCursorPosition
 0x401074 WriteConsoleW
 0x401078 GetModuleFileNameW
 0x40107c lstrlenW
 0x401080 ReplaceFileA
 0x401084 GlobalUnlock
 0x401088 GetConsoleAliasesW
 0x40108c GetLastError
 0x401090 GetDefaultCommConfigW
 0x401094 GetProcAddress
 0x401098 VirtualAlloc
 0x40109c CreateConsoleScreenBuffer
 0x4010a0 BeginUpdateResourceW
 0x4010a4 RemoveDirectoryA
 0x4010a8 SetComputerNameA
 0x4010ac LoadLibraryA
 0x4010b0 InterlockedExchangeAdd
 0x4010b4 LocalAlloc
 0x4010b8 FindFirstVolumeMountPointW
 0x4010bc IsSystemResumeAutomatic
 0x4010c0 QueryDosDeviceW
 0x4010c4 WriteProfileSectionW
 0x4010c8 AddAtomA
 0x4010cc GetModuleHandleA
 0x4010d0 GetConsoleTitleW
 0x4010d4 EnumDateFormatsW
 0x4010d8 GetConsoleCursorInfo
 0x4010dc GetShortPathNameW
 0x4010e0 GetDiskFreeSpaceExA
 0x4010e4 FindAtomW
 0x4010e8 GetWindowsDirectoryW
 0x4010ec DeleteTimerQueueTimer
 0x4010f0 GetConsoleSelectionInfo
 0x4010f4 EnumSystemLocalesW
 0x4010f8 CreateFileA
 0x4010fc CloseHandle
 0x401100 GetConsoleOutputCP
 0x401104 WriteConsoleA
 0x401108 SetStdHandle
 0x40110c SetProcessAffinityMask
 0x401110 GetTempFileNameW
 0x401114 GetComputerNameA
 0x401118 GetLongPathNameW
 0x40111c FlushFileBuffers
 0x401120 InterlockedIncrement
 0x401124 InterlockedDecrement
 0x401128 Sleep
 0x40112c InitializeCriticalSection
 0x401130 DeleteCriticalSection
 0x401134 EnterCriticalSection
 0x401138 LeaveCriticalSection
 0x40113c HeapAlloc
 0x401140 MultiByteToWideChar
 0x401144 GetStartupInfoW
 0x401148 RaiseException
 0x40114c RtlUnwind
 0x401150 UnhandledExceptionFilter
 0x401154 SetUnhandledExceptionFilter
 0x401158 HeapFree
 0x40115c TerminateProcess
 0x401160 GetCurrentProcess
 0x401164 IsDebuggerPresent
 0x401168 SetHandleCount
 0x40116c GetStdHandle
 0x401170 GetFileType
 0x401174 GetStartupInfoA
 0x401178 VirtualFree
 0x40117c HeapReAlloc
 0x401180 ExitProcess
 0x401184 WriteFile
 0x401188 GetModuleFileNameA
 0x40118c GetCPInfo
 0x401190 GetACP
 0x401194 GetOEMCP
 0x401198 IsValidCodePage
 0x40119c TlsGetValue
 0x4011a0 TlsAlloc
 0x4011a4 TlsSetValue
 0x4011a8 TlsFree
 0x4011ac SetLastError
 0x4011b0 GetCurrentThreadId
 0x4011b4 FreeEnvironmentStringsW
 0x4011b8 GetEnvironmentStringsW
 0x4011bc GetCommandLineW
 0x4011c0 QueryPerformanceCounter
 0x4011c4 GetTickCount
 0x4011c8 GetCurrentProcessId
 0x4011cc GetSystemTimeAsFileTime
 0x4011d0 HeapSize
 0x4011d4 GetLocaleInfoA
 0x4011d8 GetStringTypeA
 0x4011dc GetStringTypeW
 0x4011e0 SetFilePointer
 0x4011e4 WideCharToMultiByte
 0x4011e8 GetConsoleCP
 0x4011ec GetConsoleMode
 0x4011f0 InitializeCriticalSectionAndSpinCount
 0x4011f4 LCMapStringA
 0x4011f8 LCMapStringW
USER32.dll
 0x401200 GetSysColorBrush
 0x401204 ToAsciiEx
 0x401208 ChangeMenuW
 0x40120c GetClassInfoExA
 0x401210 SetParent
 0x401214 CreateAcceleratorTableA
 0x401218 GetWindowLongA
GDI32.dll
 0x401000 GetCharABCWidthsFloatW
 0x401004 GetCharWidthA
 0x401008 SetColorAdjustment
WINHTTP.dll
 0x401220 WinHttpOpen

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure