Report - logon.exe

Generic Malware Malicious Library PE File PE32
ScreenShot
Created 2024.08.08 14:07 Machine s1_win7_x6403
Filename logon.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
6
Behavior Score
1.0
ZERO API file : malware
VT API (file) 20 detected (AIDetectMalware, Unsafe, Malicious, Artemis, CLOUD, Wacatac, BScope, Lcnw, susgen, confidence, 100%)
md5 ceccc726e628b9592af475cc27d0a7ae
sha256 ccb40eb0137e156af89b0e0dbdac4192152dd19540efecdb56eeaa0384e5d55f
ssdeep 3072:WgGMUZwVAMYiEkbIuQSrYfgJ7b7mZdVpvF5QjgJ9r5O:NHt4kc0/Sj1gEi
imphash f4f7f76aa0a06aa9cec19206195b4f24
impfuzzy 24:US2RiwusOuQepB+ZfaloNl/t0fErAeOovpDc/J3IS2cfWyvZjMZ9SvLFQHOT45Kj:USOsepIZfaUpt0sr2Jkcfv2SncUb9xn
  Network IP location

Signature (2cnts)

Level Description
warning File has been identified by 20 AntiVirus engines on VirusTotal as malicious
info Command line console output was observed

Rules (4cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

IPHLPAPI.DLL
 0x421010 GetAdaptersInfo
 0x421014 GetNumberOfInterfaces
 0x421018 GetNetworkParams
KERNEL32.dll
 0x421020 AllocConsole
 0x421024 GetStdHandle
 0x421028 CloseHandle
 0x42102c WideCharToMultiByte
 0x421030 lstrlenW
 0x421034 GetCurrentProcess
 0x421038 WriteConsoleA
 0x42103c GetModuleFileNameA
 0x421040 GetLastError
 0x421044 Sleep
 0x421048 GetTempPathA
 0x42104c GetEnvironmentVariableA
 0x421050 FreeConsole
 0x421054 InitializeCriticalSection
 0x421058 SetEnvironmentVariableA
 0x42105c CompareStringW
 0x421060 CompareStringA
 0x421064 GetLocaleInfoW
 0x421068 CreateFileA
 0x42106c IsValidLocale
 0x421070 EnumSystemLocalesA
 0x421074 GetLocaleInfoA
 0x421078 GetUserDefaultLCID
 0x42107c GetStringTypeW
 0x421080 GetStringTypeA
 0x421084 LCMapStringW
 0x421088 LCMapStringA
 0x42108c GetTimeZoneInformation
 0x421090 LoadLibraryA
 0x421094 WriteConsoleW
 0x421098 GetConsoleOutputCP
 0x42109c MultiByteToWideChar
 0x4210a0 InitializeCriticalSectionAndSpinCount
 0x4210a4 TerminateProcess
 0x4210a8 UnhandledExceptionFilter
 0x4210ac SetUnhandledExceptionFilter
 0x4210b0 IsDebuggerPresent
 0x4210b4 RaiseException
 0x4210b8 HeapFree
 0x4210bc RtlUnwind
 0x4210c0 HeapAlloc
 0x4210c4 HeapReAlloc
 0x4210c8 FindClose
 0x4210cc FileTimeToSystemTime
 0x4210d0 FileTimeToLocalFileTime
 0x4210d4 GetDriveTypeA
 0x4210d8 FindFirstFileA
 0x4210dc SetEndOfFile
 0x4210e0 GetProcessHeap
 0x4210e4 GetCommandLineA
 0x4210e8 GetModuleHandleW
 0x4210ec GetProcAddress
 0x4210f0 TlsGetValue
 0x4210f4 TlsAlloc
 0x4210f8 TlsSetValue
 0x4210fc TlsFree
 0x421100 InterlockedIncrement
 0x421104 SetLastError
 0x421108 GetCurrentThreadId
 0x42110c InterlockedDecrement
 0x421110 HeapCreate
 0x421114 VirtualFree
 0x421118 DeleteCriticalSection
 0x42111c LeaveCriticalSection
 0x421120 EnterCriticalSection
 0x421124 VirtualAlloc
 0x421128 SetHandleCount
 0x42112c GetFileType
 0x421130 GetStartupInfoA
 0x421134 WriteFile
 0x421138 GetConsoleCP
 0x42113c GetConsoleMode
 0x421140 FlushFileBuffers
 0x421144 ReadFile
 0x421148 SetFilePointer
 0x42114c ExitProcess
 0x421150 HeapSize
 0x421154 GetFullPathNameA
 0x421158 GetCurrentDirectoryA
 0x42115c GetCPInfo
 0x421160 GetACP
 0x421164 GetOEMCP
 0x421168 IsValidCodePage
 0x42116c SetStdHandle
 0x421170 FreeEnvironmentStringsA
 0x421174 GetEnvironmentStrings
 0x421178 FreeEnvironmentStringsW
 0x42117c GetEnvironmentStringsW
 0x421180 QueryPerformanceCounter
 0x421184 GetTickCount
 0x421188 GetCurrentProcessId
 0x42118c GetSystemTimeAsFileTime
 0x421190 CreateFileW
ADVAPI32.dll
 0x421000 GetTokenInformation
 0x421004 OpenProcessToken
 0x421008 LookupAccountSidA
WS2_32.dll
 0x4211a4 inet_ntoa
 0x4211a8 WSAStartup
 0x4211ac gethostname
 0x4211b0 inet_addr
 0x4211b4 getsockname
 0x4211b8 closesocket
 0x4211bc recvfrom
 0x4211c0 socket
 0x4211c4 sendto
 0x4211c8 htonl
 0x4211cc htons
 0x4211d0 connect
 0x4211d4 WSACleanup
 0x4211d8 select
 0x4211dc WSAGetLastError
NETAPI32.dll
 0x421198 NetWkstaUserGetInfo
 0x42119c NetApiBufferFree

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure