LogonFuck[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

LogonFuck.exe
Size

9.4MB
MD5

90a964fb43881a2f0a5f0051ac74fc3a
SHA1

7343f1f31347f263c505af1cbff1dab6b60b08bb
SHA256

d50704ad9301dc6a077940bb5d76645850fa6689f45bfceb219e019c313b345e
SHA512

2f6c32f371fcde66359b6b75285d17d521b95570fab881beebd2709f50ac9ec77129041d020934a45848880d79fc3dac441a404afdea116d9ec1b65713320df1
SSDEEP

196608:igxp6Kt8RxG2lMKeCA0AtnpV90HwvV1llI+5Y4bXyUNbARdbvSyT4/Lb4N5O8YsW:0RxG2l2CArzLvV15YCCaARZvv4/LbYOP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LogonFuck.exe

Files

LogonFuck.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 9.4MB - Virtual size: 9.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ