keylogger.pdb
Static task
static1
Behavioral task
behavioral1
Sample
keylogger.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
keylogger.exe
Resource
win10v2004-20240508-en
General
-
Target
keylogger.exe
-
Size
301KB
-
MD5
64c7e72c6200b452aaf7f3504bfe3d9a
-
SHA1
1c9406329a6b54631d96386356a68e2d84164a69
-
SHA256
e7eee7c32dd34715b7709658207d6a3b70cf562971000599060d48e04800119f
-
SHA512
5f270f80efa1f386269074f347a0b43049d1c9d0ead7a615ffdefe4593bc35ef27d0b6e5606048490818632420f2fe19e1a05d0af35c065ff16a108e8063ba11
-
SSDEEP
3072:1GracuUxVE4FpnQLxBnl6U6Yly8tEnW+ilZFLB363wIKraJzJ5FOnvtFTmtcz/:1Gpxi4FpnozxhpKAIKQlWnjmtcz/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource keylogger.exe
Files
-
keylogger.exe.exe windows:6 windows x64 arch:x64
df251612b2b8eb575d062ee609e1ee45
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
WaitOnAddress
WakeByAddressAll
kernel32
GetCurrentProcess
SetFileInformationByHandle
GetEnvironmentVariableW
GetCurrentDirectoryW
SetLastError
RtlLookupFunctionEntry
RtlVirtualUnwind
GetStdHandle
GetCurrentProcessId
RtlCaptureContext
QueryPerformanceCounter
GetSystemTimePreciseAsFileTime
HeapFree
CloseHandle
HeapReAlloc
lstrlenW
ReleaseMutex
GetProcessHeap
HeapAlloc
Sleep
WaitForSingleObject
SetWaitableTimer
CreateWaitableTimerExW
GetConsoleMode
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetLastError
GetModuleHandleW
FormatMessageW
ExitProcess
MultiByteToWideChar
WriteConsoleW
GetCurrentThread
GetFullPathNameW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetProcAddress
GetModuleHandleA
GetSystemInfo
GetSystemTimeAsFileTime
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
OpenProcess
SetUnhandledExceptionFilter
GetUserDefaultLocaleName
GetComputerNameExW
CreateFileW
GetNativeSystemInfo
IsProcessorFeaturePresent
user32
GetAsyncKeyState
GetSystemMetrics
GetWindowThreadProcessId
GetForegroundWindow
GetWindowTextW
GetWindowTextLengthW
psapi
GetProcessImageFileNameW
advapi32
RegQueryValueExW
RegOpenKeyExW
ntdll
RtlNtStatusToDosError
NtWriteFile
vcruntime140
__current_exception
__current_exception_context
__CxxFrameHandler3
__C_specific_handler
_CxxThrowException
memcmp
memmove
memcpy
memset
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_set_app_type
_initterm_e
exit
_exit
terminate
__p___argc
__p___argv
_cexit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_initterm
_crt_atexit
_initialize_onexit_table
_register_onexit_function
_c_exit
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
Sections
.text Size: 213KB - Virtual size: 213KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 840B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ