logioptionsplus_installer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

logioptionsplus_installer.exe
Size

28.7MB
MD5

56f33c972a991297af34ea1415ab8783
SHA1

ec1af289736baa5364c3fc69e52737f67a9d1665
SHA256

ddb1ca6b7042ce4ba86ca61c4a6bae159fa9233562d797d06b9d56e3f60b1981
SHA512

da6e831f08803d1cff9f86940ac8afbe277a51b930d0ebea408fb843b02dfdf3bb5250792b594e06046b6f7f500ea3be2012f21fee45f28cfd5b57cf6e696e54
SSDEEP

393216:b0nsqS5Gwb6+lptVYmfr7yBG/4oyFN/YuuccKU9oxcS2IQzHfC6qa9fmpa3h5zjl:b0n+5GU6upttD7yBG/PcXU9g5FMkvE

Score

1^/10

Malware Config

Signatures

Files

logioptionsplus_installer.exe
.exe windows:6 windows x64 arch:x64

705bb6db2b9629157c26706af792d667

Code Sign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

28/07/2022, 08:56

Not After

27/07/2033, 08:56

Subject

CN=Certum Timestamp 2022,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:60:c5:35:4d:86:1d:ed:2f:31:76:45:dc:3f:ab:ca
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

21/09/2021, 00:00

Not After

12/09/2024, 23:59

Subject

CN=Logitech Inc,O=Logitech Inc,L=Newark,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

48:09:2f:41:c6:49:cb:a8:18:cd:ca:92:00:ff:5b:11:90:ac:84:b4:b9:74:59:5a:2f:9d:68:2b:00:e6:08:c6
Signer

Actual PE Digest

48:09:2f:41:c6:49:cb:a8:18:cd:ca:92:00:ff:5b:11:90:ac:84:b4:b9:74:59:5a:2f:9d:68:2b:00:e6:08:c6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

comctl32

InitCommonControlsEx

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
CreateEventW
WaitForSingleObject
DeleteCriticalSection
WaitForSingleObjectEx
ResetEvent
SetEvent
EnterCriticalSection

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-core-file-l1-1-0

DeleteFileW
WriteFile
GetFileAttributesExW
SetEndOfFile
FindFirstFileW
CreateDirectoryW
CreateFileW
GetFileType
SetFileInformationByHandle
ReadFile
FindNextFileW
FindFirstFileExW
FindClose
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-processthreads-l1-1-0

CreateProcessW
GetCurrentProcessId
TlsFree
GetStartupInfoW
ExitProcess
TerminateProcess
GetCurrentProcess
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentThreadId
GetExitCodeProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
LoadResource
GetModuleHandleExW
FreeResource
GetModuleHandleW
FreeLibrary
SizeofResource
LockResource
GetProcAddress
LoadLibraryExW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-localization-l1-2-0

EnumSystemLocalesW
GetCPInfo
GetOEMCP
LCMapStringEx
GetACP
IsValidCodePage
GetUserPreferredUILanguages
GetLocaleInfoEx
GetLocaleInfoW
GetUserDefaultLCID
FormatMessageA
LCMapStringW
IsValidLocale

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx
RtlPcToFileHeader
RtlUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-console-l1-1-0

ReadConsoleW
GetConsoleMode
WriteConsoleW
GetConsoleOutputCP

api-ms-win-core-heap-l1-1-0

HeapFree
HeapSize
HeapAlloc
GetProcessHeap
HeapReAlloc

api-ms-win-core-fibers-l1-1-0

FlsAlloc
FlsGetValue
FlsFree
FlsSetValue

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
CompareStringEx

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

user32

GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
IsDialogMessageW
PostQuitMessage
IsWindow
DestroyWindow
ShowWindow
CreateDialogParamW
SetDlgItemTextW
SetWindowLongPtrW
GetDlgCtrlID
SetWindowTextW
GetWindowLongPtrW

gdi32

SetBkColor
GetStockObject

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

Sections

.text
Size: 317KB - Virtual size: 316KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

SHARED
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 28.3MB - Virtual size: 28.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

705bb6db2b9629157c26706af792d667

Code Sign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

01:60:c5:35:4d:86:1d:ed:2f:31:76:45:dc:3f:ab:caCertificate

Extended Key Usages

Key Usages

48:09:2f:41:c6:49:cb:a8:18:cd:ca:92:00:ff:5b:11:90:ac:84:b4:b9:74:59:5a:2f:9d:68:2b:00:e6:08:c6Signer

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-localization-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-console-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-profile-l1-1-0

user32

gdi32

api-ms-win-core-file-l1-2-2

api-ms-win-core-file-l2-1-0

Sections

.text Size: 317KB - Virtual size: 316KB

.rdata Size: 113KB - Virtual size: 112KB

.data Size: 9KB - Virtual size: 15KB

.pdata Size: 17KB - Virtual size: 17KB

SHARED Size: 512B - Virtual size: 4B

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 28.3MB - Virtual size: 28.3MB

.reloc Size: 3KB - Virtual size: 3KB

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

01:60:c5:35:4d:86:1d:ed:2f:31:76:45:dc:3f:ab:ca
Certificate

48:09:2f:41:c6:49:cb:a8:18:cd:ca:92:00:ff:5b:11:90:ac:84:b4:b9:74:59:5a:2f:9d:68:2b:00:e6:08:c6
Signer

.text
Size: 317KB - Virtual size: 316KB

.rdata
Size: 113KB - Virtual size: 112KB

.data
Size: 9KB - Virtual size: 15KB

.pdata
Size: 17KB - Virtual size: 17KB

SHARED
Size: 512B - Virtual size: 4B

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 28.3MB - Virtual size: 28.3MB

.reloc
Size: 3KB - Virtual size: 3KB