vbc[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

vbc.exe
Size

3.1MB
MD5

563d85f7149927d55445c31fa6d979ed
SHA1

41cbb8bbeef3bc4452e7192ba79ac8f12737aac9
SHA256

3afb73a055b160d122676f31a7a0c444ae20ac1050ef9d3582b895972a41f223
SHA512

3d46e7f82a97aa2db95494de2f6a02d5616fbec062aa4b898429b657e9d3df4f347c67f3d915c7bbad26c94e642424ec57356b8e9f2a5b95b4e21d1e63ccf783
SSDEEP

49152:qadUeBvLRfvTLAblm/13k9oZgxXSdLt/0D33HFQ4rIZt4yU41Cd+5lUjixYvOUmJ:xiOVfumhk9oZgx9335rIZt4yU4UdwyQ

Score

1^/10

Malware Config

Signatures

Files

vbc.exe
.exe windows:6 windows x64 arch:x64

e1c1590fcd68ce17cd46265fc8780de1

Code Sign

33:00:00:02:51:14:76:cc:c5:85:83:6e:0b:00:00:00:00:02:51
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:32

Not After

01/09/2022, 18:32

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e8:39:82:74:b9:17:23:19:b0:29:b8:fd:55:0d:ec:cf:ce:63:a8:7f:02:64:bb:22:3d:37:42:d6:46:99:9b:4b
Signer

Actual PE Digest

e8:39:82:74:b9:17:23:19:b0:29:b8:fd:55:0d:ec:cf:ce:63:a8:7f:02:64:bb:22:3d:37:42:d6:46:99:9b:4b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

TraceEvent
ControlTraceW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
GetUserNameW
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptAcquireContextA

kernel32

FreeLibrary
GetModuleHandleW
lstrcmpiW
RaiseException
GetLastError
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSectionEx
GetFullPathNameW
GetStdHandle
LoadLibraryW
WriteFile
CloseHandle
TerminateProcess
GetCurrentProcess
FormatMessageW
GetSystemDefaultLangID
GetVersionExW
CreateFileW
GetFileType
IsValidCodePage
ExpandEnvironmentStringsW
GetModuleFileNameA
AreFileApisANSI
FindFirstFileW
FindNextFileW
FindClose
GetEnvironmentVariableW
DeleteFileW
GetVersionExA
HeapSetInformation
SetUnhandledExceptionFilter
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetACP
DecodePointer
GetUserDefaultLCID
GetSystemDefaultLCID
ConvertDefaultLocale
GetFileAttributesW
lstrcmpW
GetLocaleInfoW
WaitForSingleObjectEx
ResetEvent
LocalFree
LocalAlloc
HeapFree
HeapAlloc
GetProcAddress
WideCharToMultiByte
GetStringTypeExW
CompareFileTime
GetModuleHandleExW
SetFileInformationByHandle
GetShortPathNameA
GetShortPathNameW
SetLastError
GetFileTime
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
lstrlenW
ReadProcessMemory
GetSystemDirectoryW
OpenThread
HeapReAlloc
SetEvent
ReleaseMutex
WaitForSingleObject
CreateProcessW
DuplicateHandle
CreateMutexW
CreateEventW
CreateFileMappingW
QueryPerformanceFrequency
HeapDestroy
VirtualAlloc
VirtualFree
SwitchToThread
GetSystemInfo
GetCommandLineA
GetCommandLineW
InitializeCriticalSectionAndSpinCount
LockResource
CompareStringW
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetProcessHeap
GetTempPathW
SetFilePointer
ReadFile
GetFileSize
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

vcruntime140_1_clr0400

__CxxFrameHandler4

vcruntime140_clr0400

memcmp
_set_se_translator
_purecall
__std_exception_destroy
__std_terminate
wcschr
memcpy
memmove
memset
__std_exception_copy
wcsrchr
__C_specific_handler
__current_exception
__current_exception_context
wcsstr
_CxxThrowException

ucrtbase_clr0400

_waccess_s
_access_s
_strnicmp
_wcsicmp
_wcsnicmp
wcscmp
_itow_s
iswalpha
wcscpy_s
iswspace
_invalid_parameter_noinfo_noreturn
_ecvt_s
strcat_s
strncat_s
__stdio_common_vsprintf_s
atof
__stdio_common_vswprintf_s
__stdio_common_vfprintf
__stdio_common_vsnwprintf_s
_ultow_s
wcscat_s
qsort
_i64tow_s
_ui64tow_s
wcstol
isdigit
wmemcpy_s
tolower
_mktime64
wcsncmp
wcspbrk
bsearch
_isnan
_wmakepath_s
_wtol
_swab
_wcslwr_s
wcstok_s
__stdio_common_vswprintf
wcsncpy_s
malloc
free
_invalid_parameter_noinfo
_errno
_recalloc
fgetws
__acrt_iob_func
fputws
fwrite
_time64
wcsftime
_localtime64
__stdio_common_vfwprintf
fclose
_fdopen
_open_osfhandle
wcstoul
_wsplitpath_s
_wcstoi64
_waccess
_mbsinc
_mbspbrk
_wtoi
_seh_filter_exe
_set_app_type
__setusermatherr
_configure_wide_argv
_initialize_wide_environment
_get_initial_wide_environment
_initterm
_initterm_e
exit
_exit
_set_fmode
__p___argc
__p___wargv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
fmod
_stricmp
floor
pow

ole32

StringFromGUID2
CoInitializeEx
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoGetClassObject
CoCreateGuid
CoTaskMemFree
IIDFromString
CoUninitialize

oleaut32

SysAllocStringLen
SysAllocString
GetErrorInfo
SysStringLen
VarBstrCat
SysAllocStringByteLen
SysStringByteLen
CreateErrorInfo
SetErrorInfo
VarUI4FromDec
SysFreeString
VarBstrFromDec
VarUI4FromStr
VarDecFromStr
VarR8FromStr
VarR4FromR8
VarR8FromDec
VarDecFromR8
VarDecAdd
VarDecSu
VarDecCmp
VarDecMul
VarDecDiv
VarDecFix
VarDecNeg
VariantInit
VariantClear
VarUI4FromR4
VarUI4FromR8
VarBstrCmp

shlwapi

PathRemoveFileSpecW
PathIsUNCW
PathIsURLW
PathAppendW

user32

CharNextW
LoadStringW

version

GetFileVersionInfoW
GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoSizeExW

msvcp140_clr0400

?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z

mscoree

GetCORSystemDirectory
LoadStringRCEx
LoadLibraryShim
CorBindToCurrentRuntime
GetRealProcAddress

psapi

GetModuleFileNameExW

Exports

Exports

?GetLastHResultError@@YAJXZ

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 366KB - Virtual size: 366KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 66KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 250KB - Virtual size: 250KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e1c1590fcd68ce17cd46265fc8780de1

Code Sign

33:00:00:02:51:14:76:cc:c5:85:83:6e:0b:00:00:00:00:02:51Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

e8:39:82:74:b9:17:23:19:b0:29:b8:fd:55:0d:ec:cf:ce:63:a8:7f:02:64:bb:22:3d:37:42:d6:46:99:9b:4bSigner

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

vcruntime140_1_clr0400

vcruntime140_clr0400

ucrtbase_clr0400

ole32

oleaut32

shlwapi

user32

version

msvcp140_clr0400

mscoree

psapi

Exports

Exports

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rdata Size: 366KB - Virtual size: 366KB

.data Size: 66KB - Virtual size: 75KB

.pdata Size: 78KB - Virtual size: 77KB

.rsrc Size: 250KB - Virtual size: 250KB

.reloc Size: 9KB - Virtual size: 9KB

33:00:00:02:51:14:76:cc:c5:85:83:6e:0b:00:00:00:00:02:51
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

e8:39:82:74:b9:17:23:19:b0:29:b8:fd:55:0d:ec:cf:ce:63:a8:7f:02:64:bb:22:3d:37:42:d6:46:99:9b:4b
Signer

.text
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 366KB - Virtual size: 366KB

.data
Size: 66KB - Virtual size: 75KB

.pdata
Size: 78KB - Virtual size: 77KB

.rsrc
Size: 250KB - Virtual size: 250KB

.reloc
Size: 9KB - Virtual size: 9KB