ScreenShot
| Created | 2022.12.07 15:50 | Machine | s1_win7_x6403 |
| Filename | Logic%20Media%20Explorer.exe | ||
| Type | PE32+ executable (GUI) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 5 detected (malicious, moderate confidence, score, HackTool, Knotweed, moderate) | ||
| md5 | fa9b0ac29dc8d6d7d6078c6bb16bf669 | ||
| sha256 | 4c9c31afa8754dac1148f45387ade1b2c0afac3a05a849bc9ef012ffffeb8a56 | ||
| ssdeep | 98304:ZfOBSFD2U4MIauPm+hYQLTxxHRR15upQhg4j30uZvEne7:ZfOBSV2UjuPm+hYQLTr15upQe4j3ZNEG | ||
| imphash | d39206ee3735ee3b2bba27dfb83f5afd | ||
| impfuzzy | 24:mDGYAz7YzXo0qtpcKg3Jnc+pl39/YoEOovbOJKURZHu93vFZRXudTxGMBJMud212:vl7YXYtpcKgxc+ppuc3SFZ1un5LZ | ||
Network IP location
Signature (7cnts)
| Level | Description |
|---|---|
| danger | Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) |
| watch | Communicates with host for which no DNS query was performed |
| notice | File has been identified by 5 AntiVirus engines on VirusTotal as malicious |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (8cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Antivirus | Contains references to security software | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | Win32_Trojan_Gen_2_0904B0_Zero | Win32 Trojan Gen | binaries (upload) |
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x1400d9030 GetProcAddress
0x1400d9038 ReadProcessMemory
0x1400d9040 GetWindowsDirectoryW
0x1400d9048 GetModuleHandleW
0x1400d9050 WriteConsoleW
0x1400d9058 CloseHandle
0x1400d9060 GetLastError
0x1400d9068 Sleep
0x1400d9070 OpenProcess
0x1400d9078 GetCurrentProcessId
0x1400d9080 GetModuleFileNameW
0x1400d9088 CreateFileW
0x1400d9090 ReadConsoleW
0x1400d9098 ReadFile
0x1400d90a0 SetFilePointerEx
0x1400d90a8 QueryPerformanceCounter
0x1400d90b0 GetCurrentThreadId
0x1400d90b8 GetSystemTimeAsFileTime
0x1400d90c0 InitializeSListHead
0x1400d90c8 RtlCaptureContext
0x1400d90d0 RtlLookupFunctionEntry
0x1400d90d8 RtlVirtualUnwind
0x1400d90e0 IsDebuggerPresent
0x1400d90e8 UnhandledExceptionFilter
0x1400d90f0 SetUnhandledExceptionFilter
0x1400d90f8 GetStartupInfoW
0x1400d9100 IsProcessorFeaturePresent
0x1400d9108 GetCurrentProcess
0x1400d9110 TerminateProcess
0x1400d9118 RtlUnwindEx
0x1400d9120 InterlockedPushEntrySList
0x1400d9128 InterlockedFlushSList
0x1400d9130 RtlPcToFileHeader
0x1400d9138 RaiseException
0x1400d9140 SetLastError
0x1400d9148 EnterCriticalSection
0x1400d9150 LeaveCriticalSection
0x1400d9158 DeleteCriticalSection
0x1400d9160 InitializeCriticalSectionAndSpinCount
0x1400d9168 TlsAlloc
0x1400d9170 TlsGetValue
0x1400d9178 TlsSetValue
0x1400d9180 TlsFree
0x1400d9188 FreeLibrary
0x1400d9190 LoadLibraryExW
0x1400d9198 EncodePointer
0x1400d91a0 GetStdHandle
0x1400d91a8 WriteFile
0x1400d91b0 ExitProcess
0x1400d91b8 GetModuleHandleExW
0x1400d91c0 GetCommandLineA
0x1400d91c8 GetCommandLineW
0x1400d91d0 GetCurrentThread
0x1400d91d8 HeapAlloc
0x1400d91e0 OutputDebugStringW
0x1400d91e8 HeapFree
0x1400d91f0 FindClose
0x1400d91f8 FindFirstFileExW
0x1400d9200 FindNextFileW
0x1400d9208 IsValidCodePage
0x1400d9210 GetACP
0x1400d9218 GetOEMCP
0x1400d9220 GetCPInfo
0x1400d9228 MultiByteToWideChar
0x1400d9230 WideCharToMultiByte
0x1400d9238 GetEnvironmentStringsW
0x1400d9240 FreeEnvironmentStringsW
0x1400d9248 SetEnvironmentVariableW
0x1400d9250 SetStdHandle
0x1400d9258 GetFileType
0x1400d9260 GetStringTypeW
0x1400d9268 GetLocaleInfoW
0x1400d9270 IsValidLocale
0x1400d9278 GetUserDefaultLCID
0x1400d9280 EnumSystemLocalesW
0x1400d9288 FlsAlloc
0x1400d9290 FlsGetValue
0x1400d9298 FlsSetValue
0x1400d92a0 FlsFree
0x1400d92a8 GetDateFormatW
0x1400d92b0 GetTimeFormatW
0x1400d92b8 CompareStringW
0x1400d92c0 LCMapStringW
0x1400d92c8 GetProcessHeap
0x1400d92d0 SetConsoleCtrlHandler
0x1400d92d8 HeapSize
0x1400d92e0 HeapReAlloc
0x1400d92e8 FlushFileBuffers
0x1400d92f0 GetConsoleOutputCP
0x1400d92f8 GetConsoleMode
0x1400d9300 GetFileSizeEx
0x1400d9308 RtlUnwind
ADVAPI32.dll
0x1400d9000 RegCloseKey
0x1400d9008 RegSetValueExA
0x1400d9010 RegOpenKeyExA
0x1400d9018 RegDeleteValueA
0x1400d9020 RegCreateKeyA
ole32.dll
0x1400d9318 CoUninitialize
0x1400d9320 CoInitializeEx
0x1400d9328 CoGetObject
EAT(Export Address Table) is none
KERNEL32.dll
0x1400d9030 GetProcAddress
0x1400d9038 ReadProcessMemory
0x1400d9040 GetWindowsDirectoryW
0x1400d9048 GetModuleHandleW
0x1400d9050 WriteConsoleW
0x1400d9058 CloseHandle
0x1400d9060 GetLastError
0x1400d9068 Sleep
0x1400d9070 OpenProcess
0x1400d9078 GetCurrentProcessId
0x1400d9080 GetModuleFileNameW
0x1400d9088 CreateFileW
0x1400d9090 ReadConsoleW
0x1400d9098 ReadFile
0x1400d90a0 SetFilePointerEx
0x1400d90a8 QueryPerformanceCounter
0x1400d90b0 GetCurrentThreadId
0x1400d90b8 GetSystemTimeAsFileTime
0x1400d90c0 InitializeSListHead
0x1400d90c8 RtlCaptureContext
0x1400d90d0 RtlLookupFunctionEntry
0x1400d90d8 RtlVirtualUnwind
0x1400d90e0 IsDebuggerPresent
0x1400d90e8 UnhandledExceptionFilter
0x1400d90f0 SetUnhandledExceptionFilter
0x1400d90f8 GetStartupInfoW
0x1400d9100 IsProcessorFeaturePresent
0x1400d9108 GetCurrentProcess
0x1400d9110 TerminateProcess
0x1400d9118 RtlUnwindEx
0x1400d9120 InterlockedPushEntrySList
0x1400d9128 InterlockedFlushSList
0x1400d9130 RtlPcToFileHeader
0x1400d9138 RaiseException
0x1400d9140 SetLastError
0x1400d9148 EnterCriticalSection
0x1400d9150 LeaveCriticalSection
0x1400d9158 DeleteCriticalSection
0x1400d9160 InitializeCriticalSectionAndSpinCount
0x1400d9168 TlsAlloc
0x1400d9170 TlsGetValue
0x1400d9178 TlsSetValue
0x1400d9180 TlsFree
0x1400d9188 FreeLibrary
0x1400d9190 LoadLibraryExW
0x1400d9198 EncodePointer
0x1400d91a0 GetStdHandle
0x1400d91a8 WriteFile
0x1400d91b0 ExitProcess
0x1400d91b8 GetModuleHandleExW
0x1400d91c0 GetCommandLineA
0x1400d91c8 GetCommandLineW
0x1400d91d0 GetCurrentThread
0x1400d91d8 HeapAlloc
0x1400d91e0 OutputDebugStringW
0x1400d91e8 HeapFree
0x1400d91f0 FindClose
0x1400d91f8 FindFirstFileExW
0x1400d9200 FindNextFileW
0x1400d9208 IsValidCodePage
0x1400d9210 GetACP
0x1400d9218 GetOEMCP
0x1400d9220 GetCPInfo
0x1400d9228 MultiByteToWideChar
0x1400d9230 WideCharToMultiByte
0x1400d9238 GetEnvironmentStringsW
0x1400d9240 FreeEnvironmentStringsW
0x1400d9248 SetEnvironmentVariableW
0x1400d9250 SetStdHandle
0x1400d9258 GetFileType
0x1400d9260 GetStringTypeW
0x1400d9268 GetLocaleInfoW
0x1400d9270 IsValidLocale
0x1400d9278 GetUserDefaultLCID
0x1400d9280 EnumSystemLocalesW
0x1400d9288 FlsAlloc
0x1400d9290 FlsGetValue
0x1400d9298 FlsSetValue
0x1400d92a0 FlsFree
0x1400d92a8 GetDateFormatW
0x1400d92b0 GetTimeFormatW
0x1400d92b8 CompareStringW
0x1400d92c0 LCMapStringW
0x1400d92c8 GetProcessHeap
0x1400d92d0 SetConsoleCtrlHandler
0x1400d92d8 HeapSize
0x1400d92e0 HeapReAlloc
0x1400d92e8 FlushFileBuffers
0x1400d92f0 GetConsoleOutputCP
0x1400d92f8 GetConsoleMode
0x1400d9300 GetFileSizeEx
0x1400d9308 RtlUnwind
ADVAPI32.dll
0x1400d9000 RegCloseKey
0x1400d9008 RegSetValueExA
0x1400d9010 RegOpenKeyExA
0x1400d9018 RegDeleteValueA
0x1400d9020 RegCreateKeyA
ole32.dll
0x1400d9318 CoUninitialize
0x1400d9320 CoInitializeEx
0x1400d9328 CoGetObject
EAT(Export Address Table) is none