vgc[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
vgc.exe
Size 18.1MB
Sample261027-2967vav14p
SHA256 6cbf45cb5f8c2764fb542a95750b6ab37582a195d885c8bac030f5d8f209771a
MD5 9a0e13438303e89f9570d42188b9443c
SHA1 971180a9441cddf1c46189dffb1f175b98171612
SHA512 c5df7d7505c5a7c6d87ba285acb402b27a6b13780e8afce7794a4dc6a3b9db88f1cde309c489d7355634261184ec7d54059057907018ac378c389a17699a7576
SSDEEP 393216:tdL5rCHxcABBgFK/C2bJMisIySu7TsHDiX/+wB:t5uxRhZbJMiXySNHD++Y
TLSH
T1AF1723C356D867EDC2924A1C914313CBEEC1A467DDAF9B083AC68C0351D1E9925CBF7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
vgc.exe

File Explorer

vgc.exe

.exe 18.1MB

vgc.exe

IMPHASH 8e629077ebc0a3d5424db96f8569ebec
SHA256 6cbf45cb5f8c2764fb542a95750b6ab37582a195d885c8bac030f5d8f209771a
MD5 9a0e13438303e89f9570d42188b9443c
SHA1 971180a9441cddf1c46189dffb1f175b98171612
SHA512 c5df7d7505c5a7c6d87ba285acb402b27a6b13780e8afce7794a4dc6a3b9db88f1cde309c489d7355634261184ec7d54059057907018ac378c389a17699a7576
SSDEEP 393216:tdL5rCHxcABBgFK/C2bJMisIySu7TsHDiX/+wB:t5uxRhZbJMiXySNHD++Y
TLSH
T1AF1723C356D867EDC2924A1C914313CBEEC1A467DDAF9B083AC68C0351D1E9925CBF7A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20202462

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmEnableBlurBehindWindow

advapi32

CryptImportKey

winhttp

WinHttpReceiveResponse

wininet

InternetOpenUrlA

crypt32

CryptQueryObject

bcrypt

BCryptEncrypt

shell32

ShellExecuteW

shlwapi

PathFindFileNameW

ws2_32

freeaddrinfo

secur32

EncryptMessage

kernel32

UnhandledExceptionFilter GetSystemTimeAsFileTime HeapAlloc HeapFree ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

user32

IsWindowUnicode

gdi32

DeleteObject

ole32

CoUninitialize

oleaut32

VariantClear

msvcp140

?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z

imm32

ImmGetContext

gdiplus

GdipFree

ntdll

RtlLookupFunctionEntry

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception

api-ms-win-crt-stdio-l1-1-0

feof

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-string-l1-1-0

isupper

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-math-l1-1-0

sinf

api-ms-win-crt-runtime-l1-1-0

_beginthreadex

api-ms-win-crt-time-l1-1-0

_localtime64

api-ms-win-crt-filesystem-l1-1-0

_fstat64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-environment-l1-1-0

getenv

psapi

GetModuleInformation

Name

.text

Size

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

366KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.H*g

Size

Virtual Size

10.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.98<

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.`qF

Size

18.1MB

Virtual Size

18.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

296B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

vgc.exe

d3d11

d3dcompiler_47

dwmapi

advapi32

winhttp

wininet

crypt32

bcrypt

shell32

shlwapi

ws2_32

secur32

kernel32

user32

gdi32

ole32

oleaut32

msvcp140

imm32

gdiplus

ntdll

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

psapi

generic