General

  • Target

    totally_not_a_keylogger.exe

  • Size

    6.4MB

  • MD5

    7d877cc6172e8f6e3c9139b601e62428

  • SHA1

    fcd4ac0337e2fea952a33c5043890585262ca96e

  • SHA256

    0c9901c7fe7a1b8bd08ccf943794cfadda11e90fdde25964a5e9c09e95200443

  • SHA512

    3ba64bd8f4acf221215323b4f32c849a6c0c6a04798f5946e1ea58cc3cb13a97aa5ab0e112df0fc804399060d7be888879086684a6529de295988835b3794a90

  • SSDEEP

    196608:V3m+68BKOLzLyh6GWGadFdzTuNar45/OjCAT:VltrXHUatCE

Score
3/10

Malware Config

Signatures

  • Unsigned PE 22 IoCs

    Checks for missing Authenticode signature.

Files

  • totally_not_a_keylogger.exe
    .exe windows:6 windows x64 arch:x64

    14ab321ef07fa16b0e509b28abe4ec68


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:5 windows x64 arch:x64

    5701993c113b5b4a8df7d62ad71dffca


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UAC.dll
    .dll windows:6 windows x64 arch:x64

    1d9dcf131a0c1a2ed99cd33cbafd155f


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:6 windows x64 arch:x64

    be212422bea078d0b2f4529b6ce1a0e2


    Headers

    Imports

    Exports

    Sections

  • $R0
    .dll regsvr32 windows:6 windows x64 arch:x64

    2bab0054c3b453dc2c189dff4fa27ff7


    Headers

    Imports

    Exports

    Sections

  • PP-UWP-Interop.dll
    .dll windows:6 windows x64 arch:x64

    b63e46bf73652a5068b140ffa67c619d


    Headers

    Imports

    Exports

    Sections

  • avcodec-fb2k-60.dll
    .dll windows:6 windows x64 arch:x64

    74f6bd155605d7e085d47aa053f4160a


    Headers

    Imports

    Exports

    Sections

  • avformat-fb2k-60.dll
    .dll windows:6 windows x64 arch:x64

    450d74ed8ed6a81f855fd79a91dc7e8f


    Headers

    Imports

    Exports

    Sections

  • avutil-fb2k-58.dll
    .dll windows:6 windows x64 arch:x64

    52710d7baf4e7ba75bdbb00258d05a08


    Headers

    Imports

    Exports

    Sections

  • components/foo_converter.dll
    .dll windows:6 windows x64 arch:x64

    935be8735ae8d3d6bc3a1f1205e55955


    Headers

    Imports

    Exports

    Sections

  • components/foo_dsp_eq.dll
    .dll windows:6 windows x64 arch:x64

    d7582ea976568cf13add40601fb6e78c


    Headers

    Imports

    Exports

    Sections

  • components/foo_dsp_std.dll
    .dll windows:6 windows x64 arch:x64

    e2a6d3740746dd8e34aa1876648f6850


    Headers

    Imports

    Exports

    Sections

  • components/foo_fileops.dll
    .dll windows:6 windows x64 arch:x64

    67a1b4ca5bc67c56d7aaeae1fc078317


    Headers

    Imports

    Exports

    Sections

  • components/foo_freedb2.dll
    .dll windows:6 windows x64 arch:x64

    8b1e390e863c501308f940b0d8b63b6b


    Headers

    Imports

    Exports

    Sections

  • components/foo_input_std.dll
    .dll windows:6 windows x64 arch:x64

    87a55a30fe2a72806a6978f12e5ae61f


    Headers

    Imports

    Exports

    Sections

  • components/foo_ui_std.dll
    .dll windows:6 windows x64 arch:x64

    da718e7d6467c43411093e686818e513


    Headers

    Imports

    Exports

    Sections

  • components/foo_unpack.dll
    .dll windows:6 windows x64 arch:x64

    0ccab25df4128327bfb476a7dd4a1b62


    Headers

    Imports

    Exports

    Sections

  • concrt140.dll
    .dll windows:6 windows x64 arch:x64

    a9a0a05dfeb346f520c897893cc76aa1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • doc/Query Syntax Help.html
    .html
  • doc/license.html
  • doc/titleformat_help.css
  • doc/titleformat_help.html
  • foobar2000 Shell Associations Updater.exe
    .exe windows:6 windows x64 arch:x64

    c5492fa710dc1f3248fb549a0294332e


    Headers

    Imports

    Sections

  • foobar2000.exe
    .exe windows:6 windows x64 arch:x64

    a2b9970c68a976f284a711dcbbb8de3c


    Headers

    Imports

    Sections

  • icons/aac.ico
  • icons/ape.ico
  • icons/apl.ico
  • icons/asx.ico
  • icons/cda.ico
  • icons/cue.ico
  • icons/dll.ico
  • icons/flac.ico
  • icons/fpl.ico
  • icons/fth.ico
  • icons/generic.ico
  • icons/m3u.ico
  • icons/m3u8.ico
  • icons/m4a.ico
  • icons/mka.ico
  • icons/mp2.ico
  • icons/mp3.ico
  • icons/mp4.ico
  • icons/mpc.ico
  • icons/ofr.ico
  • icons/ogg.ico
  • icons/opus.ico
  • icons/pls.ico
  • icons/shn.ico
  • icons/spx.ico
  • icons/tak.ico
  • icons/tta.ico
  • icons/wav.ico
  • icons/wma.ico
  • icons/wv.ico
  • msvcp140.dll
    .dll windows:6 windows x64 arch:x64

    9433fb5ddec7b65c9b51bd9dc5813de2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcp140_1.dll
    .dll windows:6 windows x64 arch:x64

    20717227ccb65afbaea7feeb74196ea2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcp140_2.dll
    .dll windows:6 windows x64 arch:x64

    d68bff3ea8e1baa2a925794feb31fdc5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcp140_atomic_wait.dll
    .dll windows:6 windows x64 arch:x64

    bced65fa8a1a54f039081b1993833c8f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcp140_codecvt_ids.dll
    .dll windows:6 windows x64 arch:x64

    8e3190ca5b1dfe3662e83fefed12f437


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtime/api-ms-win-core-console-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-console-l1-2-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-datetime-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-debug-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-errorhandling-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-file-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-file-l1-2-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-file-l2-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-handle-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-heap-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-interlocked-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-libraryloader-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-localization-l1-2-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-memory-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-namedpipe-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-processenvironment-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-processthreads-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-processthreads-l1-1-1.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-profile-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-rtlsupport-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-string-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-synch-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-synch-l1-2-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-sysinfo-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-timezone-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-core-util-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-crt-conio-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-crt-convert-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-crt-environment-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-crt-filesystem-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-crt-heap-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-crt-locale-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-crt-math-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-crt-multibyte-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-crt-private-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-crt-process-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-crt-runtime-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-crt-stdio-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-crt-string-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-crt-time-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/api-ms-win-crt-utility-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • runtime/runtime.manifest
    .xml
  • runtime/ucrtbase.dll
    .dll windows:10 windows x64 arch:x64

    405cde0fc80c30dcc3d783173dbd4143


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • shared.dll
    .dll windows:6 windows x64 arch:x64

    7e485aa68e158f090d2853ba691aca17


    Headers

    Imports

    Exports

    Sections

  • sqlite3.dll
    .dll windows:6 windows x64 arch:x64

    cb5ff0eb905e0adc3517df427ef65d46


    Headers

    Imports

    Exports

    Sections

  • themes/Album List + Properties (tabbed) + Visualisations.fth
  • themes/Album List + Properties (tabbed).fth
  • themes/Album List + Properties + Visualisations.fth
  • themes/Album List + Properties.fth
  • themes/Album List + Visualisation (alternate).fth
  • themes/Album List + Visualisation.fth
  • themes/Album art in playlist.fth
  • themes/Black.fth
  • themes/Blue.fth
  • themes/Dark Blue.fth
  • themes/Dark Grey Magenta.fth
  • themes/Dark Grey Orange.fth
  • themes/Dark Orange.fth
  • themes/Default Playlist.fth
  • themes/Faded.fth
  • themes/Forum.fth
  • themes/Gray Orange.fth
  • themes/Gray.fth
  • themes/Group by Albums.fth
  • themes/Hello Kitty.fth
  • themes/Olive.fth
  • themes/Orange.fth
  • themes/Pastel Green.fth
  • themes/Separate Album & Artist Columns.fth
  • themes/Shades of Grey.fth
  • themes/Simple Playlist + Tabs.fth
  • themes/Slim View + Tabs.fth
  • themes/System Default.fth
  • themes/Vintage.fth
  • themes/Visualisation + Cover Art + Tabs.fth
  • themes/White.fth
  • themes/Yellow.fth
  • vccorlib140.dll
    .dll windows:6 windows x64 arch:x64

    d5ec94ca50152cc1e7188b825074fef2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • vcruntime140.dll
    .dll windows:6 windows x64 arch:x64

    7f91c705cf579114968b3edc12e1175e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • vcruntime140_1.dll
    .dll windows:6 windows x64 arch:x64

    72707e942878aac770fcc118ce3ec1c9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • vcruntime140_threads.dll
    .dll windows:6 windows x64 arch:x64

    5ec0377a6cf6fab1a21b56f09428ef6a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zlib1.dll
    .dll windows:6 windows x64 arch:x64

    469cefa9bbd088726b7f185c87e7397f


    Headers

    Imports

    Exports

    Sections