LogonUI[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

LogonUI.exe
Size

11KB
MD5

8d91f5ef59efa02fbcdc742a7f4309d9
SHA1

619a5c18be20dbc82e33e54f9a0357e2f810631f
SHA256

bd8cdd85b5b4d3af70b57e87f1232bc5d0fdd6bb562da58491dcdd172c2c291c
SHA512

f0d1cda1e814383c261f6af82ed8591b3c9ef7229dd55f5ba79fad12403072c0c1d2029162e2396e433288ae55c2a27dbd7349f09f9a65984f5002df05a7a1df
SSDEEP

192:pQjejdwlh86m9PISZrRZaXxdeT3sCDeXuM2c1vGbLuWnUW:6aQSlmXxG3sZpGbyWnUW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LogonUI.exe

Files

LogonUI.exe
.exe windows:10 windows x86

5f569eb9ed799e00d94f427c13684f4a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__set_app_type
wcstoul
exit
_exit
_amsg_exit
__p__commode
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_wcmdln
_initterm
_XcptFilter
wcsncmp
__setusermatherr
wcschr
__p__fmode
__wgetmainargs
_cexit

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
TerminateProcess
GetStartupInfoW
SetPriorityClass
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-com-l1-1-1

CoCreateInstance
CoInitializeEx
CoUninitialize

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleA

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 884B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 368B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5f569eb9ed799e00d94f427c13684f4a

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-com-l1-1-1

api-ms-win-core-heap-l2-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

Sections

.text Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 884B

.idata Size: 1KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 368B

.text
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 884B

.idata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 368B