LogoFAIL[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
LogoFAIL.exe
Size 216KB
Sample260809-s5fpnabb53
SHA256 a51619f82f4b0a2805cdf55d28176d45c73540dc39c913a75b0267b965aba664
MD5 dbc8228004c591d1fa1cc2b4bf5d6b3d
SHA1 4ff0e69ec635b5ac6b91ab2a8b0bbf605620efbb
SHA512 1d76317abe1220a8fc010226d9db0fe6a4cdbbdc3690937fd062fe1cf68c411de6465d97ab6ecc72020e226e212724b9183a05381aad6e13a5438191629b8df9
SSDEEP 3072:KMobR7ezAjLOZvmX1X5GWp1icKAArDZz4N9GhbkrNEkee3i5asChS4jErjvcv7It:XeR7eammXp0yN90QEVqzjy9
TLSH
T10424AF1A73E421A6E4B6437099F603839A32BCB16B7492FF27C5D57D0E336C0A536B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LogoFAIL.exe

File Explorer

LogoFAIL.exe

.exe 216KB

LogoFAIL.exe

IMPHASH 4cea7ae85c87ddc7295d39ff9cda31d1
SHA256 a51619f82f4b0a2805cdf55d28176d45c73540dc39c913a75b0267b965aba664
MD5 dbc8228004c591d1fa1cc2b4bf5d6b3d
SHA1 4ff0e69ec635b5ac6b91ab2a8b0bbf605620efbb
SHA512 1d76317abe1220a8fc010226d9db0fe6a4cdbbdc3690937fd062fe1cf68c411de6465d97ab6ecc72020e226e212724b9183a05381aad6e13a5438191629b8df9
SSDEEP 3072:KMobR7ezAjLOZvmX1X5GWp1icKAArDZz4N9GhbkrNEkee3i5asChS4jErjvcv7It:XeR7eammXp0yN90QEVqzjy9
TLSH
T10424AF1A73E421A6E4B6437099F603839A32BCB16B7492FF27C5D57D0E336C0A536B16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wextract.pdb

advapi32

GetTokenInformation RegDeleteValueA RegOpenKeyExA RegQueryInfoKeyA FreeSid OpenProcessToken RegSetValueExA RegCreateKeyExA LookupPrivilegeValueA AllocateAndInitializeSid RegQueryValueExA EqualSid RegCloseKey AdjustTokenPrivileges

kernel32

_lopen _llseek CompareStringA GetLastError GetFileAttributesA GetSystemDirectoryA LoadLibraryA DeleteFileA GlobalAlloc GlobalFree CloseHandle WritePrivateProfileStringA IsDBCSLeadByte GetWindowsDirectoryA SetFileAttributesA GetProcAddress GlobalLock LocalFree RemoveDirectoryA FreeLibrary _lclose CreateDirectoryA GetPrivateProfileIntA GetPrivateProfileStringA GlobalUnlock ReadFile SizeofResource WriteFile GetDriveTypeA LoadLibraryExA SetFileTime SetFilePointer FindResourceA CreateMutexA GetVolumeInformationA WaitForSingleObject GetCurrentDirectoryA FreeResource GetVersion SetCurrentDirectoryA GetTempPathA LocalFileTimeToFileTime CreateFileA SetEvent TerminateThread GetVersionExA LockResource GetSystemInfo CreateThread ResetEvent LoadResource ExitProcess GetModuleHandleW CreateProcessA FormatMessageA GetTempFileNameA DosDateTimeToFileTime CreateEventA GetExitCodeProcess ExpandEnvironmentStringsA LocalAlloc lstrcmpA FindNextFileA GetCurrentProcess FindFirstFileA GetModuleFileNameA GetShortPathNameA Sleep GetStartupInfoW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount EnumResourceLanguagesA GetDiskFreeSpaceA MulDiv FindClose

gdi32

GetDeviceCaps

user32

ShowWindow MsgWaitForMultipleObjects SetWindowPos GetDC GetWindowRect DispatchMessageA GetSystemMetrics CallWindowProcA SetWindowTextA MessageBoxA SendDlgItemMessageA SendMessageA GetDlgItem DialogBoxIndirectParamA GetWindowLongPtrA SetWindowLongPtrA SetForegroundWindow ReleaseDC EnableWindow CharNextA LoadStringA CharPrevA EndDialog MessageBeep ExitWindowsEx SetDlgItemTextA CharUpperA GetDesktopWindow PeekMessageA GetDlgItemTextA

msvcrt

?terminate@@YAXXZ _commode _fmode _acmdln __C_specific_handler memset __setusermatherr _ismbblead _cexit _exit exit __set_app_type __getmainargs _amsg_exit _XcptFilter memcpy_s _vsnprintf _initterm memcpy

comctl32

ord17

cabinet

ord20 ord21 ord23 ord22

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA