WirelessKeyView[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

WirelessKeyView.exe
Size

256KB
MD5

f577df72c3104df7158c898b64ca53db
SHA1

108266bda26eaa3c1b7aa06ef9dde376dde88bb5
SHA256

e8c208fb8f488971975c0023256c5a955578a1b5299a45d627a4e2d7f8fb850e
SHA512

5a89ea4d6b7fe05e1ea2cc8b51a25e68fb4dbda48a805a77c01e049ebab70412664fce5d611e3f35e64587e269105dc15afdfe0eed4d7719205ac96d1ec52428
SSDEEP

6144:w1w0T70GyPvckzKUOrk/+YW6mhrZOYzYHajVJ:w1w0T71yPTMgGh/hrX3jL

Score

10^/10

Malware Config

Signatures

Nirsoft 1 IoCs

resource	yara_rule
sample	Nirsoft

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WirelessKeyView.exe

Files

WirelessKeyView.exe
.exe windows x64

001d0612d840fc62d527725b32aa5804

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

comctl32

ord6
ImageList_SetImageCount
ImageList_Create
ImageList_AddMasked
ord17
CreateToolbarEx
ImageList_ReplaceIcon

kernel32

FindResourceA
GlobalLock
LoadLibraryExA
GlobalAlloc
GetTimeFormatA
SetFilePointer
GlobalUnlock
SizeofResource
GetLocaleInfoA
FindFirstFileA
LockResource
GetFileAttributesA
GetVersionExA
LoadResource
FormatMessageA
SystemTimeToTzSpecificLocalTime
FileTimeToLocalFileTime
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
EnumResourceNamesA
GetStdHandle
SetErrorMode
CreateProcessA
ExitProcess
ReadProcessMemory
GetCurrentProcessId
CreateToolhelp32Snapshot
TerminateProcess
Process32First
Process32Next
LocalAlloc
EnumResourceTypesA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetModuleHandleA
RtlLookupFunctionEntry
RtlVirtualUnwind
GetStringTypeW
GetStringTypeA
InitializeCriticalSection
HeapReAlloc
LeaveCriticalSection
EnterCriticalSection
GetConsoleMode
GetConsoleCP
GetSystemTimeAsFileTime
QueryPerformanceCounter
DeleteCriticalSection
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
HeapCreate
HeapSetInformation
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RtlPcToFileHeader
RaiseException
RtlUnwindEx
HeapSize
FlsAlloc
GetCurrentThreadId
SetLastError
FlsFree
TlsFree
FlsSetValue
FlsGetValue
RtlCaptureContext
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoA
GetProcessHeap
HeapAlloc
HeapFree
GetFileSize
FindClose
GetCurrentProcess
CreateFileA
GetTempFileNameA
GetCommandLineA
ReadFile
WriteFile
FindNextFileA
GetDateFormatA
GetModuleFileNameA
GetWindowsDirectoryA
CloseHandle
GetLastError
UnmapViewOfFile
MapViewOfFile
WideCharToMultiByte
OpenProcess
MultiByteToWideChar
GetSystemDirectoryA
GetTickCount
CreateFileMappingA
DeleteFileA
LocalFree
OpenFileMappingA
GetTempPathA
CopyFileA
Sleep
FileTimeToSystemTime
SystemTimeToFileTime
LoadLibraryA
CompareFileTime
FreeLibrary
GetProcAddress
SetStdHandle

user32

DispatchMessageA
GetFocus
DeferWindowPos
BeginDeferWindowPos
EndDeferWindowPos
GetMessageA
PostQuitMessage
RegisterWindowMessageA
TrackPopupMenu
DrawTextExA
IsDialogMessageA
GetSysColorBrush
ShowWindow
ReleaseCapture
SetCursor
LoadCursorA
TranslateMessage
GetKeyState
DestroyWindow
CreateDialogParamA
DestroyMenu
GetDlgCtrlID
DialogBoxParamA
ModifyMenuA
LoadStringA
LoadMenuA
SetCapture
ChildWindowFromPoint
SetDlgItemTextA
GetDlgItemTextA
SendDlgItemMessageA
GetWindowTextA
GetMenuItemInfoA
FillRect
EndPaint
BeginPaint
GetClientRect
GetCursorPos
GetClassNameA
GetSubMenu
MapWindowPoints
GetMenuStringA
EnableWindow
ScreenToClient
GetParent
GetMenuItemCount
EnableMenuItem
GetMenu
CheckMenuItem
GetSysColor
MoveWindow
EmptyClipboard
CloseClipboard
OpenClipboard
SetClipboardData
SetFocus
InvalidateRect
SetWindowLongA
GetWindowLongA
GetDC
LoadIconA
LoadImageA
ReleaseDC
SendMessageA
GetWindowPlacement
MessageBoxA
TranslateAcceleratorA
DefWindowProcA
SetWindowPos
LoadAcceleratorsA
SetMenu
PostMessageA
GetSystemMetrics
GetWindowRect
UpdateWindow
RegisterClassA
SetDlgItemInt
CreateWindowExA
GetDlgItem
EndDialog
GetDlgItemInt
SetWindowTextA
EnumChildWindows

gdi32

GetDeviceCaps
GetPixel
PatBlt
StretchBlt
SetPixel
GetStockObject
GetTextExtentPoint32A
SetBkColor
CreateSolidBrush
GetObjectA
SelectObject
DeleteObject
SetBkMode
CreateFontIndirectA
SetTextColor
SetDIBits
CreateCompatibleBitmap
DeleteDC
SetStretchBltMode
CreateCompatibleDC

comdlg32

GetSaveFileNameA
FindTextA
GetOpenFileNameA

advapi32

RegDeleteValueA
RegEnumValueA
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey

shell32

SHGetMalloc
SHBrowseForFolderA
ShellExecuteA
SHGetPathFromIDListA

ole32

CoInitialize
CoUninitialize

Sections

.text
Size: 183KB - Virtual size: 182KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

001d0612d840fc62d527725b32aa5804

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

Sections

.text Size: 183KB - Virtual size: 182KB

.rdata Size: 31KB - Virtual size: 30KB

.data Size: 9KB - Virtual size: 25KB

.pdata Size: 8KB - Virtual size: 7KB

.rsrc Size: 24KB - Virtual size: 23KB

.text
Size: 183KB - Virtual size: 182KB

.rdata
Size: 31KB - Virtual size: 30KB

.data
Size: 9KB - Virtual size: 25KB

.pdata
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 24KB - Virtual size: 23KB