VacExporterLauncher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
VacExporterLauncher.exe
Size 458KB
Sample260719-wpdrxaay8t
SHA256 ea8c1492a9c5e9d2b28c46c72e3c71b11958bad68009480187529110a8cdc4c9
MD5 73f0f784bbed314c9b52f56d0c33afb6
SHA1 bc6251fabd061b5602d46f2ce5764966d7019541
SHA512 9ca440e8eae638662b8021bbe1bfc8fbbe03032aee85fd3b7e732effbd6ac501c95461588ac58a4c173d90cdcb7ef3e10087ffbb68882d49bc9f1df33d4e6754
SSDEEP 6144:JjG5JbCTfht4i041zCoSLUZBj+w1z6HIbYaXMnaKdJJle/IykqdKYIufQx9:6UTfQdzAZRrAH6KndJlH6d7p
TLSH
T1DAA47D15A6A900F9E077D27CCE538902EBB278560371DACF03A4E6762F276D45E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VacExporterLauncher.exe

File Explorer

VacExporterLauncher.exe

.exe 458KB

VacExporterLauncher.exe

IMPHASH 1ec776d83526ceee3e82f7a632f605e3
SHA256 ea8c1492a9c5e9d2b28c46c72e3c71b11958bad68009480187529110a8cdc4c9
MD5 73f0f784bbed314c9b52f56d0c33afb6
SHA1 bc6251fabd061b5602d46f2ce5764966d7019541
SHA512 9ca440e8eae638662b8021bbe1bfc8fbbe03032aee85fd3b7e732effbd6ac501c95461588ac58a4c173d90cdcb7ef3e10087ffbb68882d49bc9f1df33d4e6754
SSDEEP 6144:JjG5JbCTfht4i041zCoSLUZBj+w1z6HIbYaXMnaKdJJle/IykqdKYIufQx9:6UTfQdzAZRrAH6KndJlH6d7p
TLSH
T1DAA47D15A6A900F9E077D27CCE538902EBB278560371DACF03A4E6762F276D45E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

168688

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders

bcrypt

BCryptOpenAlgorithmProvider BCryptGetProperty BCryptCloseAlgorithmProvider BCryptImportKeyPair BCryptDestroyKey BCryptVerifySignature BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash

crypt32

CryptStringToBinaryA

shell32

ShellExecuteW

dwmapi

DwmSetWindowAttribute

kernel32

GetOEMCP GetACP IsValidCodePage ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GetEnvironmentVariableW CloseHandle GetLastError CreateMutexW OpenProcess GetLocalTime QueryFullProcessImageNameW MoveFileExW MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW GetCommandLineA LCMapStringW LoadLibraryExW VirtualProtect SetFilePointerEx GetFileSizeEx GetFileType HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle GetModuleFileNameW TerminateProcess ExitProcess GetCurrentProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle CreateFileW HeapSize WriteConsoleW SetEndOfFile Process32NextW GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW RtlUnwind GetTempPathW CreateFile2 AreFileApisANSI GetModuleHandleW GetProcAddress GetFileInformationByHandleEx GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter WakeAllConditionVariable EncodePointer DecodePointer LCMapStringEx GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread

user32

LoadImageW DestroyIcon LoadCursorW PtInRect FillRect ScreenToClient GetClientRect InvalidateRect EndPaint BeginPaint UpdateWindow DrawTextW DrawIconEx SetTimer ShowWindow DestroyWindow IsWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PostMessageW DispatchMessageW TranslateMessage GetMessageW SetProcessDpiAwarenessContext GetSystemMetrics

gdi32

SelectObject RoundRect DeleteObject DeleteDC SetBkMode CreatePen CreateFontW CreateCompatibleDC CreateCompatibleBitmap BitBlt CreateSolidBrush SetTextColor

Name

.text

Size

319KB

Virtual Size

318KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

VacExporterLauncher.exe

winhttp

bcrypt

crypt32

shell32

dwmapi

kernel32

user32

gdi32

generic