LogicalLoader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

LogicalLoader.exe
Size

2.1MB
MD5

0d3ab9b24cfb4c5f8873b998005d000a
SHA1

617f3f79c2049e386158b6aa4dafcc562f3cbd46
SHA256

9af8be727860aeb5e1a29de6f047f46648af84f58a8e0cb85c8e226b63cf7418
SHA512

d1d7a1ecb2037fecd2a63e57cfb217c4db25bf4ab974112db0e0d4d1cde7a08bf8f0f6e7521d004f286e99777d0ab3ae3dce724a2db07c94dc07752df7047205
SSDEEP

49152:VoppIJ8y84ZUWdy57DMSIYTEk3RH1T3kQGIvnTyYhVd55FdBRl9JZVdBhVdZZF93:24c3pHFUhhYhVd55FdBRl9JZVdBhVdZR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LogicalLoader.exe

Files

LogicalLoader.exe
.exe windows:6 windows x64 arch:x64

6c37762fac310f2f573995f9838ca1b3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\yvngx\source\repos\LogicalLoader\x64\Release\LogicalLoader.pdb

Imports

ws2_32

WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
getpeername
WSAWaitForMultipleEvents
gethostname
ioctlsocket
getsockopt
sendto
recvfrom
freeaddrinfo
getaddrinfo
recv
listen
htonl
getsockname
connect
bind
accept
select
__WSAFDIsSet
socket
htons
WSAIoctl
setsockopt
WSACleanup
WSAStartup
WSASetLastError
ntohs
WSAGetLastError
closesocket

crypt32

CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CryptStringToBinaryA
CertGetNameStringA
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
PFXImportCertStore

wldap32

ord60
ord46
ord217
ord50
ord41
ord45
ord211
ord79
ord22
ord301
ord200
ord30
ord143
ord35
ord33
ord32
ord27
ord26

normaliz

IdnToAscii

wintrust

WinVerifyTrustEx

d3d9

Direct3DCreate9

kernel32

HeapFree
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
DeleteFileW
WaitForSingleObject
FlushFileBuffers
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
WriteFile
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
ExitProcess
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
UnhandledExceptionFilter
RtlVirtualUnwind
TlsAlloc
InitializeCriticalSectionAndSpinCount
RaiseException
RtlPcToFileHeader
Sleep
GetModuleHandleW
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetModuleHandleA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
VerSetConditionMask
FreeLibrary
QueryPerformanceCounter
GetCurrentProcess
GetModuleFileNameW
K32GetModuleFileNameExW
OpenProcess
CreateToolhelp32Snapshot
GetLastError
CreateProcessW
Process32FirstW
CloseHandle
K32EnumProcessModules
IsWow64Process
WriteProcessMemory
RtlAddFunctionTable
VirtualProtectEx
VirtualAllocEx
ReadProcessMemory
CreateRemoteThread
VirtualFreeEx
GetExitCodeProcess
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetSystemDirectoryA
SetLastError
FormatMessageW
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetCurrentProcessId
SleepEx
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetCPInfo
GetStringTypeW
SleepConditionVariableSRW
WakeAllConditionVariable
LCMapStringEx
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
GetCurrentThreadId
GetLocaleInfoEx
FormatMessageA
LocalFree
HeapReAlloc
SetStdHandle
SetEndOfFile
HeapSize
GetTimeZoneInformation
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetFileInformationByHandleEx
GetProcessHeap
WriteConsoleW
Process32NextW
RtlUnwind
InterlockedPushEntrySList
RtlUnwindEx
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
AreFileApisANSI
SetUnhandledExceptionFilter

user32

ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
GetForegroundWindow
LoadCursorW
SetCapture
SetCursor
IsWindowUnicode
ReleaseCapture
SetCursorPos
GetCursorPos
OpenClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
DefWindowProcW
GetWindowRect
DestroyWindow
SetWindowPos
CreateWindowExW
UnregisterClassW
RegisterClassExW
ShowWindow
DispatchMessageW
PeekMessageW
TranslateMessage
GetClientRect
PostQuitMessage
UpdateWindow
GetMessageExtraInfo
GetKeyState
FindWindowW
CloseClipboard

advapi32

CryptImportKey
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptEncrypt
CryptAcquireContextA
CryptDestroyKey
CryptDestroyHash

shell32

ShellExecuteA

imm32

ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

bcrypt

BCryptGenRandom

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 337KB - Virtual size: 337KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6c37762fac310f2f573995f9838ca1b3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

crypt32

wldap32

normaliz

wintrust

d3d9

kernel32

user32

advapi32

shell32

imm32

bcrypt

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 337KB - Virtual size: 337KB

.data Size: 16KB - Virtual size: 121KB

.pdata Size: 117KB - Virtual size: 116KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 14KB - Virtual size: 13KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 337KB - Virtual size: 337KB

.data
Size: 16KB - Virtual size: 121KB

.pdata
Size: 117KB - Virtual size: 116KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 14KB - Virtual size: 13KB