Logger[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Logger.exe
Size

7.4MB
MD5

777f193d2516566d78bff1e1adc0da89
SHA1

4bfe55bac772b1010e7790dada20372688a4631b
SHA256

17f2e95a69a3c69c469c255f17c6536419e22227d7aa818ad40c81220970f9ed
SHA512

7f8d68abb95473aed44118f91f213eb7cce28172b9dd99e4def21b0a70868c2148237617376a1bf1882043062d20f177477ff692d3db88bc6cf51d0f3e05e65a
SSDEEP

196608:VA+CBuK2WH7t/NR5hahQn985VkI9yHKRLr3Ns:MuYLhaDvyH0O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Logger.exe

Files

Logger.exe
.exe windows:6 windows x86

70335bde03d6413f86a8bfc3cb40d65a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSACleanup
setsockopt
socket
getservbyname
gethostbyname
htonl
shutdown
WSAGetLastError
sendto
recvfrom
closesocket
__WSAFDIsSet
select
WSASetLastError
recv
send
bind
connect
getpeername
getsockname
getsockopt
ntohs
WSAIoctl
getaddrinfo
freeaddrinfo
accept
listen
ioctlsocket
gethostname
WSAStartup
htons

wldap32

ord41
ord60
ord301
ord211
ord46
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord217
ord50
ord143

normaliz

IdnToAscii

kernel32

GetCurrentDirectoryA
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
VirtualProtect
GetOEMCP
GetCPInfo
FileTimeToLocalFileTime
GetFileAttributesExA
GetFileTime
SetFileTime
GetFileSize
GetFullPathNameA
SetFilePointer
GetVolumeInformationA
DuplicateHandle
GetTempPathA
GetWindowsDirectoryA
SearchPathA
GetProfileIntA
FindResourceExW
SetErrorMode
GetTempFileNameA
GetUserDefaultLCID
ResetEvent
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
TlsGetValue
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
VirtualAlloc
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
GetDriveTypeW
CreateFileW
GlobalFlags
RtlUnwind
CompareStringEx
GetStringTypeW
GetLocaleInfoEx
QueryPerformanceFrequency
LCMapStringEx
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
OutputDebugStringW
TlsAlloc
InitializeCriticalSection
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
lstrcmpA
GetVersionExA
ResumeThread
SystemTimeToFileTime
LocalReAlloc
GlobalHandle
GetACP
GlobalReAlloc
TlsFree
TzSpecificLocalTimeToSystemTime
SetEvent
GetThreadLocale
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
InitializeCriticalSectionAndSpinCount
CompareStringA
GlobalGetAtomNameA
GlobalFindAtomA
GlobalAddAtomA
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
GetSystemDirectoryW
EncodePointer
GetCurrentThreadId
LoadLibraryW
GetModuleHandleW
TlsSetValue
GetModuleFileNameW
OutputDebugStringA
MulDiv
GlobalSize
VerifyVersionInfoA
GetModuleHandleA
GetSystemDirectoryA
VerSetConditionMask
PeekNamedPipe
GetFileType
ExpandEnvironmentStringsA
WaitForSingleObjectEx
SleepEx
SetLastError
lstrcatA
lstrcpyA
QueryDosDeviceA
GetLogicalDriveStringsA
K32GetProcessImageFileNameA
GetTickCount64
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
HeapFree
SetConsoleTextAttribute
GetStdHandle
GetCurrentProcessId
CopyFileA
GetCommandLineA
lstrcpynW
lstrcpynA
Sleep
LocalSize
lstrlenA
LocalAlloc
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
FindResourceA
MultiByteToWideChar
FlushFileBuffers
WriteFile
ReadFile
GetFileInformationByHandle
SetEndOfFile
SetFilePointerEx
UnlockFile
LockFile
WaitForSingleObject
CreateProcessA
GetExitCodeThread
WaitForMultipleObjects
GetTickCount
ExitProcess
GetCurrentThread
SetThreadPriority
GetCurrentProcess
Process32Next
TerminateProcess
OpenProcess
Process32First
CreateToolhelp32Snapshot
LocalFree
FormatMessageA
GetLastError
CreateDirectoryA
lstrcmpiA
RemoveDirectoryA
GetFileAttributesA
DeleteFileA
GetFileSizeEx
CreateFileA
FindClose
FindNextFileA
FindFirstFileA
CloseHandle
GetSystemInfo
GetModuleFileNameA
FreeLibrary
FindResourceW
WideCharToMultiByte
GetProcAddress
LoadLibraryA
LockResource
LoadResource
SizeofResource
VirtualQuery
GetCommandLineW
HeapQueryInformation
SetStdHandle
GetFullPathNameW
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
IsValidLocale
EnumSystemLocalesW
GetCurrentDirectoryW
GetTimeZoneInformation
GetFileAttributesExW
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetConsoleCtrlHandler
CreateDirectoryW
WriteConsoleW
FlushConsoleInputBuffer
GlobalMemoryStatus
GetSystemTime
GetConsoleCP
SetConsoleMode
ReadConsoleInputW
GetStartupInfoW

user32

SetCursor
ShowOwnedPopups
EnumDisplayMonitors
LoadCursorW
LoadCursorA
SetLayeredWindowAttributes
DrawIconEx
IsRectEmpty
DrawFocusRect
GetSysColorBrush
SetWindowRgn
DrawFrameControl
DrawEdge
MapDialogRect
SetWindowContextHelpId
PostQuitMessage
TranslateMessage
GetMessageA
CharNextA
IntersectRect
WindowFromPoint
SetMenuItemInfoA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetMonitorInfoA
MonitorFromWindow
WinHelpA
GetScrollInfo
SetScrollInfo
LoadIconA
GetTopWindow
GetClassLongA
MapWindowPoints
AdjustWindowRectEx
RemovePropA
SetPropA
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
ValidateRect
GetForegroundWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
GetKeyState
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
IsChild
IsMenu
RealChildWindowFromPoint
GetClassInfoExA
GetClassInfoA
RegisterClassA
CallWindowProcA
DefWindowProcA
GetMessageTime
PeekMessageA
DispatchMessageA
RegisterWindowMessageA
OffsetRect
SetRectEmpty
CopyRect
MapVirtualKeyA
GetKeyNameTextA
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
CloseClipboard
SetClipboardData
EmptyClipboard
LoadImageA
SetParent
SetCursorPos
BringWindowToTop
CheckDlgButton
GetDesktopWindow
SetActiveWindow
GetActiveWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamA
DestroyWindow
LoadBitmapW
GetClassNameA
DrawStateA
IsDialogMessageA
GetWindow
SetWindowLongA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
GetMenuDefaultItem
SetMenuDefaultItem
UpdateLayeredWindow
DestroyMenu
EnableScrollBar
UnionRect
MonitorFromPoint
DestroyIcon
LoadImageW
CopyImage
IsClipboardFormatAvailable
SetRect
CopyAcceleratorTableA
InvalidateRgn
WaitMessage
SetFocus
GetDlgCtrlID
TrackMouseEvent
IsZoomed
CharUpperA
GetAsyncKeyState
SetCapture
ReleaseCapture
SetTimer
KillTimer
LoadMenuW
GetSystemMenu
DeleteMenu
MessageBeep
NotifyWinEvent
CreatePopupMenu
CreateWindowExA
GetMenuItemInfoA
LockWindowUpdate
GetDoubleClickTime
GetIconInfo
CopyIcon
ModifyMenuA
DestroyAcceleratorTable
SetClassLongA
GetUpdateRect
GetKeyboardLayout
GetKeyboardState
ToAsciiEx
LoadAcceleratorsW
SendDlgItemMessageA
GetDlgItem
ShowWindow
FillRect
GetSysColor
ClientToScreen
EndPaint
BeginPaint
GetWindowDC
GetWindowThreadProcessId
IsWindowEnabled
RemoveMenu
AppendMenuA
InsertMenuA
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringA
UnregisterClassA
GetUserObjectInformationW
GetProcessWindowStation
DrawIcon
LoadIconW
GetMessagePos
RedrawWindow
GetFocus
GetWindowLongA
GetSystemMetrics
InflateRect
SystemParametersInfoA
GrayStringA
DrawTextExA
TabbedTextOutA
InvalidateRect
DrawTextA
EqualRect
PtInRect
UpdateWindow
GetNextDlgGroupItem
CreateAcceleratorTableA
RegisterClipboardFormatA
CharUpperBuffA
LoadAcceleratorsA
TranslateAcceleratorA
LoadMenuA
InsertMenuItemA
UnpackDDElParam
ReuseDDElParam
FrameRect
PostThreadMessageA
MessageBoxA
GetWindowRect
PostMessageA
IsWindowVisible
SendMessageA
GetParent
GetClientRect
GetCursorPos
ScreenToClient
EnableWindow
SetWindowPos
GetPropA
EnumWindows
GetLastActivePopup
SetForegroundWindow
IsWindow
IsIconic
MoveWindow
GetDC
ReleaseDC
GetWindowRgn
DestroyCursor
CreateMenu
GetComboBoxInfo
TranslateMDISysAccel
DefMDIChildProcA
DefFrameProcA
DrawMenuBar
MapVirtualKeyExA
IsCharLowerA
SubtractRect
InvertRect
OpenClipboard
HideCaret

gdi32

GetObjectType
GetPixel
GetStockObject
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectObject
SelectPalette
SetBkColor
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextColor
SetTextAlign
ExtCreatePen
GetObjectA
MoveToEx
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
GetClipBox
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateRectRgnIndirect
PatBlt
CombineRgn
GetMapMode
SetRectRgn
DPtoLP
GetBkColor
GetTextColor
CreateEllipticRgn
Ellipse
CreatePolygonRgn
Polygon
GetTextMetricsA
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesA
GetTextCharsetInfo
CreateRoundRectRgn
GetRgnBox
RealizePalette
SetPixel
StretchBlt
SetDIBColorTable
OffsetRgn
RoundRect
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
LPtoDP
EnumFontFamiliesExA
ExtFloodFill
SetPaletteEntries
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
GetViewportOrgEx
GetWindowOrgEx
SetPixelV
GetTextFaceA
ExcludeClipRect
DeleteObject
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateBitmap
CreateDCA
CopyMetaFileA
DeleteDC
Rectangle
Polyline
CreateFontIndirectA
GetTextExtentPoint32A
GetDeviceCaps
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetBkMode
BitBlt
CreateCompatibleDC
CreateDIBSection
OffsetViewportOrgEx
CreateSolidBrush

msimg32

AlphaBlend
TransparentBlt

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

DeregisterEventSource
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegDeleteKeyA
CryptEnumProvidersA
CryptSignHashA
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextA
ReportEventA
RegisterEventSourceA
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegEnumKeyA
RegQueryValueA
RegEnumKeyExA
RegEnumValueA

shell32

DragFinish
DragQueryFileA
SHAppBarMessage
SHGetFileInfoA
SHGetDesktopFolder
SHBrowseForFolderA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc
Shell_NotifyIconA
ShellExecuteA

comctl32

InitCommonControlsEx
_TrackMouseEvent

shlwapi

StrFormatKBSizeA
PathStripToRootA
PathIsUNCA
PathFindFileNameA
PathFindExtensionA
UrlUnescapeA
PathGetArgsA
PathCompactPathA
PathCanonicalizeA
PathGetDriveNumberA
PathFileExistsA
PathRemoveFileSpecA
PathRemoveFileSpecW

uxtheme

GetThemePartSize
GetWindowTheme
DrawThemeText
DrawThemeParentBackground
IsThemeBackgroundPartiallyTransparent
GetThemeColor
DrawThemeBackground
CloseThemeData
OpenThemeData
IsAppThemed
GetCurrentThemeName
GetThemeSysColor

ole32

CoTaskMemAlloc
CreateStreamOnHGlobal
CoRegisterMessageFilter
CoRevokeClassObject
CoInitializeEx
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoDisconnectObject
CoInitialize
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
CoCreateGuid
CoUninitialize
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree

oleaut32

OleCreateFontIndirect
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen
SysAllocStringByteLen
SysFreeString
SysStringLen
LoadTypeLi
VariantCopy
VarBstrFromDate
SysAllocString
SafeArrayDestroy
SystemTimeToVariantTime
VariantTimeToSystemTime

oledlg

ord8

gdiplus

GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageGraphicsContext
GdiplusStartup
GdiplusShutdown
GdipFillRectangleI
GdipDrawString
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipCreateTexture
GdipFillRectangle
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipDrawImageRectRect
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipReleaseDC
GdipDrawImageRect
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

wininet

HttpQueryInfoA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetOpenA
InternetCloseHandle
InternetOpenUrlA
InternetReadFile
InternetSetStatusCallback
InternetGetLastResponseInfoA
InternetSetOptionA
InternetQueryOptionA
InternetQueryDataAvailable
InternetWriteFile
InternetSetFilePointer

imm32

ImmGetOpenStatus
ImmGetContext
ImmReleaseContext

winmm

PlaySoundA

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 722KB - Virtual size: 722KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 223KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

70335bde03d6413f86a8bfc3cb40d65a

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wldap32

normaliz

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

oleacc

wininet

imm32

winmm

crypt32

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.rdata Size: 722KB - Virtual size: 722KB

.data Size: 76KB - Virtual size: 105KB

.rsrc Size: 3.4MB - Virtual size: 3.4MB

.reloc Size: 223KB - Virtual size: 222KB

.text
Size: 3.1MB - Virtual size: 3.1MB

.rdata
Size: 722KB - Virtual size: 722KB

.data
Size: 76KB - Virtual size: 105KB

.rsrc
Size: 3.4MB - Virtual size: 3.4MB

.reloc
Size: 223KB - Virtual size: 222KB