b7adcba73fb36665f1527c8911f5ca48

Sharing

Copy URL Twitter E-mail

General

Target

b7adcba73fb36665f1527c8911f5ca48
Size

56KB
MD5

b7adcba73fb36665f1527c8911f5ca48
SHA1

47ac418317233e99787f096e0ac56eeaec42c352
SHA256

020dee9706213477f365c57e46b8d8378d60a045a135766bf7acb4b52eb54f1f
SHA512

43f22f569d0e5162785d845f0dd0288102e8382ce093a9e673c7372a10373acc22c4634e928f67989c25c8065f57183fe80f52e68580ab662c383e511f3a1f70
SSDEEP

1536:msI7PYOhN8IqA7X2+HpaJOXuG6JneHVk5d0/Y:msI7OTI2Fg6JOVkP0/Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b7adcba73fb36665f1527c8911f5ca48

Files

b7adcba73fb36665f1527c8911f5ca48
.exe windows:4 windows x86 arch:x86

d5ea578581c634a93329ec000ca9e77e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Vc\KeyLog\KeyLog\Release\KeyLog.pdb

Imports

kernel32

Sleep
lstrcpyA
SetFileAttributesA
CopyFileA
lstrcmpiA
GetSystemDirectoryA
GetModuleFileNameA
FreeLibrary
GetVersion
GetProcAddress
LoadLibraryA
lstrcatA
SetFilePointer
LCMapStringW
LCMapStringA
VirtualQuery
GetSystemInfo
VirtualProtect
HeapSize
FlushFileBuffers
SetStdHandle
InitializeCriticalSection
GetOEMCP
GetACP
RtlUnwind
GetFileSize
CreateFileA
ReadFile
CloseHandle
SetEndOfFile
lstrlenA
GetLocaleInfoA
GetCPInfo
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
ExitProcess
HeapFree
HeapReAlloc
HeapAlloc
ExitThread
TlsSetValue
TlsGetValue
GetLastError
ResumeThread
CreateThread
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetStartupInfoA
GetCommandLineA
GetVersionExA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TlsFree
SetLastError
TlsAlloc
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
UnhandledExceptionFilter
WriteFile
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings

user32

GetParent
EnumWindows
DefWindowProcA
SetTimer
SendMessageA
KillTimer
MessageBoxA
DispatchMessageA
TranslateMessage
GetMessageA
wsprintfA
PostQuitMessage
FindWindowA
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
ShowWindow

gdi32

GetStockObject

advapi32

RegSetValueExA
RegCloseKey
RegCreateKeyA

shell32

ShellExecuteA

ws2_32

WSACleanup
closesocket
recv
setsockopt
send
connect
htons
gethostbyname
socket
WSAStartup
inet_ntoa
gethostname

Sections

.text
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d5ea578581c634a93329ec000ca9e77e

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ws2_32

Sections

.text Size: 32KB - Virtual size: 29KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 9KB

.text
Size: 32KB - Virtual size: 29KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 9KB