Static task
static1
Behavioral task
behavioral1
Sample
LogitechLed.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
LogitechLed.dll
Resource
win10v2004-20230220-en
General
-
Target
LogitechLed.dll
-
Size
474KB
-
MD5
3dcfdb60ecd50bfc78829c423dfd7eb1
-
SHA1
db31317f53482e5925551fa7dcb025b08cf13300
-
SHA256
376e6c999eac77074746b11327f07f9327e53394613c424602036fdb40cb44d6
-
SHA512
3467d12c74b780abc9d2cc959bbf6b7df8192506be1011ef9f3579a2a672c0c5f8ad38edcfde9e5206c2c8eb8108fec60c8337d48ad54d6897e175ea7165074d
-
SSDEEP
12288:az1b8/cGX5sxi4TGLNP5bseQ6DY/qnKappKC6/:Ob+5sxKLDnQ60/qnKappKB/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource LogitechLed.dll
Files
-
LogitechLed.dll.dll windows x64
af359ec1c5544757b12555b9221e4f5c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
QueryPerformanceCounter
Sleep
DisableThreadLibraryCalls
GetCurrentThread
CloseHandle
GetModuleHandleW
HeapCreate
VirtualProtect
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
GetLastError
HeapReAlloc
HeapAlloc
GetThreadContext
GetCurrentProcessId
FlushInstructionCache
SetThreadContext
OpenThread
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
FormatMessageA
InitializeSListHead
GetSystemTimeAsFileTime
IsDebuggerPresent
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
GetProcAddress
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitOnceBeginInitialize
InitOnceComplete
GetFileInformationByHandleEx
AreFileApisANSI
QueryPerformanceFrequency
LoadLibraryA
GlobalUnlock
GetFileAttributesExW
GetLocaleInfoEx
LocalFree
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
DeleteCriticalSection
MultiByteToWideChar
user32
DefWindowProcW
DestroyWindow
SetWindowLongPtrW
CreateWindowExW
UnregisterClassW
RegisterClassExW
GetSystemMetrics
GetKeyState
CallWindowProcW
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
GetMessageExtraInfo
ReleaseCapture
IsWindowUnicode
GetClientRect
SetCursor
SetCapture
ScreenToClient
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetCapture
LoadCursorW
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
msvcp140
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
_Mtx_init_in_situ
_Mtx_destroy_in_situ
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Random_device@std@@YAIXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?uncaught_exceptions@std@@YAHXZ
imm32
ImmReleaseContext
ImmSetCandidateWindow
ImmGetContext
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_copy
memchr
memcmp
memcpy
memmove
__std_exception_destroy
strstr
__std_type_info_destroy_list
memset
_CxxThrowException
__current_exception_context
__current_exception
__std_terminate
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
_wfopen
fgetc
fflush
__stdio_common_vfprintf
fseek
__acrt_iob_func
ftell
_get_stream_buffer_pointers
fclose
_fseeki64
fread
fsetpos
ungetc
setvbuf
fgetpos
__stdio_common_vsprintf
fputc
fwrite
__stdio_common_vsprintf_s
__stdio_common_vsscanf
api-ms-win-crt-heap-l1-1-0
calloc
_callnewh
free
malloc
api-ms-win-crt-math-l1-1-0
sinf
_dsign
ceilf
_dclass
cosf
sqrtf
acosf
api-ms-win-crt-convert-l1-1-0
strtod
strtoul
strtoll
strtoull
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-locale-l1-1-0
setlocale
___lc_codepage_func
localeconv
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_initterm
_register_onexit_function
_seh_filter_dll
_errno
_initialize_narrow_environment
terminate
_execute_onexit_table
abort
_invalid_parameter_noinfo_noreturn
_beginthreadex
_crt_atexit
_cexit
_configure_narrow_argv
_initterm_e
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strcmp
Sections
.text Size: 367KB - Virtual size: 367KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 928B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ