keylog[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

keylog.exe
Size

15KB
MD5

9145744fc7b18e2d2e251019b316d9b7
SHA1

bbd1302e9013bb6a50cddb9f9e361e6878f51a21
SHA256

204f5b61ffc2257a104637059c774f0d06fb5dc871000d2d57cb757a9e9985f9
SHA512

a3e687398076be3073be4bac61b87301954cdd461ac8fe3f1e6ef5f73eee9ea3497d20da5fd0b5e3f2a92acd7edff4cb9d2aa223b79c9d74230a2d348e00b1c8
SSDEEP

384:l7dIn8BqVX2hhtK4d1ij5bzR2LrLdSpo+8dmlNV:l7Sz9WhcrbzR2L1Uo+84V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
keylog.exe

Files

keylog.exe
.exe windows:4 windows x86

a8a254011495b0f1253f19e3f6a7df92

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
HeapFree
LoadLibraryA
LoadResource
LocalAlloc
LocalFree
LockResource
MapViewOfFile
MultiByteToWideChar
OpenProcess
ReadFile
RtlMoveMemory
RtlZeroMemory
FindNextFileA
GlobalUnlock
SetFilePointer
SizeofResource
Sleep
UnmapViewOfFile
VirtualAlloc
VirtualFree
WriteFile
lstrcatA
lstrcmpW
lstrcmpiA
lstrcpyA
lstrlenA
FindFirstFileA
GlobalLock
GetVersionExA
GetProcessHeap
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLastError
GetLocalTime
GetFileSize
GetFileAttributesA
GetEnvironmentVariableA
GetCommandLineA
FindClose
FreeResource
FreeLibrary
SetFileAttributesA
FindResourceA
ExitProcess
DeleteFileA
CreateThread
CreateProcessA
CreateMutexA
CreateFileMappingA
CreateFileA
CreateDirectoryA
CopyFileA
SetEndOfFile
CloseHandle

user32

UpdateWindow
TranslateMessage
ToAsciiEx
ShowWindow
SetTimer
SetClipboardViewer
SendMessageA
RegisterRawInputDevices
RegisterClassExA
OpenClipboard
MapVirtualKeyExA
LoadIconA
LoadCursorA
IsClipboardFormatAvailable
GetWindowThreadProcessId
wsprintfA
ChangeClipboardChain
CloseClipboard
CreateWindowExA
DefWindowProcA
GetMessageA
DispatchMessageA
GetClassNameA
GetClipboardData
GetDC
GetForegroundWindow
GetKeyNameTextA
GetKeyboardLayout
GetWindowTextA
GetWindowLongA
GetSystemMetrics
GetRawInputData
GetKeyboardState

shlwapi

PathRenameExtensionA
PathMatchSpecA
PathAddBackslashA
PathFindFileNameA

advapi32

AllocateAndInitializeSid
CryptEncrypt
CryptExportKey
CryptGenKey
CryptReleaseContext
FreeSid
RegCreateKeyExA
RegNotifyChangeKeyValue
RegSetValueExA
CryptAcquireContextA
CheckTokenMembership
CryptDestroyKey

ws2_32

socket
recv
gethostbyname
connect
closesocket
WSAStartup
send

wininet

InternetOpenA
InternetConnectA
InternetCloseHandle
FtpPutFileA

gdi32

CreateCompatibleDC
DeleteDC
DeleteObject
GetDIBits
SelectObject
StretchBlt
CreateDIBSection

gdiplus

GdipDisposeImage
GdipGetImageEncodersSize
GdipLoadImageFromFile
GdipSaveImageToFile
GdiplusShutdown
GdiplusStartup
GdipGetImageEncoders

psapi

GetProcessImageFileNameA

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a8a254011495b0f1253f19e3f6a7df92

Headers

File Characteristics

Imports

kernel32

user32

shlwapi

advapi32

ws2_32

wininet

gdi32

gdiplus

psapi

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 59KB

.rsrc Size: 512B - Virtual size: 312B

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 59KB

.rsrc
Size: 512B - Virtual size: 312B