3fa258507f8d951562c2860e4cb758d0[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

3fa258507f8d951562c2860e4cb758d0.bin
Size

40.7MB
MD5

a824ff27a75507b07b9117384a07b44b
SHA1

a377bcf771f4266ed4d63b72916671e877ac1b39
SHA256

5557f5796993a3975090f25e20d5f779b76b64e90d50f733aacb644aff11d43f
SHA512

97d17c23342a6cc29365c340f8c9741545297bb0aacbef1b0ecd78815c6641e92921c992fbead7b7f6e69924570b0375793038a3aba9904fcdcb9245b5418475
SSDEEP

786432:aRL19MWr5nKhCrh0bVfDsYtLffADJujZr+HgyWvsKoVZaL54cUvDx:+h9M4nKhG0ZgWAIjZroAgZ+kv9

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack002/MacroRecorder/Keygen.exe
unpack002/Mouse and Keyboard Recorder v3.1.9.2 x86-x64/Crack/KeyPresser.exe
unpack002/Mouse and Keyboard Recorder v3.1.9.2 x86-x64/Crack/MouseClicker.exe
unpack002/Mouse and Keyboard Recorder v3.1.9.2 x86-x64/Crack/MouseKeyboardRecorder.exe
unpack002/Mouse and Keyboard Recorder v3.1.9.2 x86-x64/Crack/MouseRecorder.exe
unpack002/Mouse and Keyboard Recorder v3.1.9.2 x86-x64/Crack/ScheduledTasks.exe
unpack002/Mouse and Keyboard Recorder v3.1.9.2 x86-x64/MouseKeyboardRecorder.exe

Files

3fa258507f8d951562c2860e4cb758d0.bin
.zip

Password: infected
f6995e391af1e544389ca2867341243a220038218b81ff8f365394b2a0bcd671.7z
.7z

Password: infected
MacroRecorder/Keygen.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 345KB - Virtual size: 344KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 226KB - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MacroRecorder/MacroRecorder.exe
.exe windows:6 windows x86 arch:x86

Password: infected

e569e6f445d32ba23766ad67d1e3787f

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

24:62:75:05:2e:51:a7:61:bd:da:da:4c
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2021, 11:50

Not After

24/08/2024, 11:50

Subject

SERIALNUMBER=HRB 40726,CN=Bartels Media GmbH,O=Bartels Media GmbH,STREET=Fleischstr. 17,L=Trier,ST=Rheinland-Pfalz,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1308576974746c696368,1.3.6.1.4.1.311.60.2.1.2=#130f526865696e6c616e642d5066616c7a,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:45

Not After

08/05/2033, 07:45

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b9:5e:20:cd:aa:e1:70:52:4f:84:f2:1f:40:3a:f3:c0:8a:5f:72:a4:36:30:f1:04:01:8e:a1:12:cf:42:04:14
Signer

Actual PE Digest

b9:5e:20:cd:aa:e1:70:52:4f:84:f2:1f:40:3a:f3:c0:8a:5f:72:a4:36:30:f1:04:01:8e:a1:12:cf:42:04:14

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetACP
GetExitCodeProcess
LocalFree
CloseHandle
SizeofResource
VirtualProtect
VirtualFree
GetFullPathNameW
ExitProcess
HeapAlloc
GetCPInfoExW
RtlUnwind
GetCPInfo
GetStdHandle
GetModuleHandleW
FreeLibrary
HeapDestroy
ReadFile
CreateProcessW
GetLastError
GetModuleFileNameW
SetLastError
FindResourceW
CreateThread
CompareStringW
LoadLibraryA
ResetEvent
GetVersion
RaiseException
FormatMessageW
SwitchToThread
GetExitCodeThread
GetCurrentThread
LoadLibraryExW
LockResource
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
VirtualQueryEx
Sleep
EnterCriticalSection
SetFilePointer
LoadResource
SuspendThread
GetTickCount
GetFileSize
GetStartupInfoW
GetFileAttributesW
InitializeCriticalSection
GetSystemWindowsDirectoryW
GetThreadPriority
SetThreadPriority
GetCurrentProcess
VirtualAlloc
GetSystemInfo
GetCommandLineW
LeaveCriticalSection
GetProcAddress
ResumeThread
GetVersionExW
VerifyVersionInfoW
HeapCreate
GetWindowsDirectoryW
VerSetConditionMask
GetDiskFreeSpaceW
FindFirstFileW
GetUserDefaultUILanguage
lstrlenW
QueryPerformanceCounter
SetEndOfFile
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
CreateFileW
GetLocaleInfoW
GetSystemDirectoryW
DeleteFileW
GetLocalTime
GetEnvironmentVariableW
WaitForSingleObject
WriteFile
ExitThread
DeleteCriticalSection
TlsGetValue
GetDateFormatW
SetErrorMode
IsValidLocale
TlsSetValue
CreateDirectoryW
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
GetUserDefaultLangID
RemoveDirectoryW
CreateEventW
SetThreadLocale
GetThreadLocale

comctl32

InitCommonControls

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

user32

CreateWindowExW
TranslateMessage
CharLowerBuffW
CallWindowProcW
CharUpperW
PeekMessageW
GetSystemMetrics
SetWindowLongW
MessageBoxW
DestroyWindow
CharUpperBuffW
CharNextW
MsgWaitForMultipleObjects
LoadStringW
ExitWindowsEx
DispatchMessageW

oleaut32

SysAllocStringLen
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
VariantClear
SysFreeString
SysReAllocStringLen
VariantChangeType
SafeArrayCreate

netapi32

NetWkstaGetInfo
NetApiBufferFree

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
AdjustTokenPrivileges
GetTokenInformation
ConvertSidToStringSidW
LookupPrivilegeValueW
RegCloseKey
OpenProcessToken
RegOpenKeyExW

Exports

Exports

TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

.text
Size: 718KB - Virtual size: 718KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 27KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 154B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 93B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Mouse and Keyboard Recorder v3.1.9.2 x86-x64/Crack/KeyPresser.exe
.exe windows:5 windows x86 arch:x86

Password: infected

f555b9ae32ad83ca0cc14a94806b7a37

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\SVN\biggod.dev\Release\MouseKeyboardRecorder\KeyPresser.pdb

Imports

kernel32

GetFileAttributesW
GetFileSizeEx
SetErrorMode
GetTickCount
GetStartupInfoW
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
RtlUnwind
RaiseException
HeapReAlloc
ExitProcess
HeapSize
SetStdHandle
GetFileType
VirtualAlloc
GetSystemInfo
VirtualQuery
SetUnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapCreate
VirtualFree
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetTimeZoneInformation
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
GetFullPathNameW
GetVolumeInformationW
FindFirstFileW
FindClose
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetThreadLocale
InterlockedIncrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GlobalFlags
LocalAlloc
lstrlenA
InterlockedDecrement
WaitForSingleObject
WritePrivateProfileStringW
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
FormatMessageW
LocalFree
GetCurrentProcessId
GetModuleHandleA
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetVersionExW
CompareStringW
LoadLibraryA
lstrcmpW
GetVersionExA
MulDiv
FreeResource
VirtualProtect
FreeLibrary
GetWindowsDirectoryW
CreateThread
TerminateThread
WritePrivateProfileStringA
GetPrivateProfileStringA
GetProcAddress
LoadLibraryW
InitializeCriticalSection
FindResourceW
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FileTimeToLocalFileTime
FileTimeToSystemTime
GetModuleHandleW
MultiByteToWideChar
GetLastError
CreateMutexW
SetLastError
CloseHandle
GetFileTime
GetFileSize
CreateFileW
WinExec
lstrcatW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcpyW
GetModuleFileNameW
Sleep
lstrlenW
GetModuleFileNameA
QueryPerformanceCounter
CreateDirectoryA

user32

SetRect
InvalidateRgn
GetNextDlgGroupItem
CharUpperW
UnregisterClassW
RegisterClipboardFormatW
PostThreadMessageW
MapDialogRect
PostQuitMessage
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
EnableMenuItem
CheckMenuItem
GetMenuStringW
GetWindowThreadProcessId
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetFocus
GetForegroundWindow
GetLastActivePopup
IsRectEmpty
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
IsWindowVisible
UpdateWindow
MessageBoxW
CreateWindowExW
RegisterClassW
AdjustWindowRectEx
EqualRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
SetWindowPos
OffsetRect
SystemParametersInfoA
GetWindowPlacement
IntersectRect
GetWindowTextLengthW
GetWindowTextW
GetWindow
SetFocus
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetWindowLongW
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
DrawStateW
FillRect
CopyRect
ModifyMenuW
InsertMenuW
GetMenuState
CreateMenu
CreatePopupMenu
LoadMenuW
CopyIcon
LoadCursorW
InflateRect
ReleaseDC
GetDC
GetParent
InvalidateRect
CopyAcceleratorTableW
CharNextW
GetSysColorBrush
WindowFromPoint
SetWindowLongW
SetCursor
DestroyMenu
GetMessageW
ValidateRect
SetWindowContextHelpId
RedrawWindow
ReleaseCapture
PtInRect
MessageBeep
GetSysColor
IsWindow
GetMenuItemID
GetSubMenu
GetMenuItemCount
PostMessageW
UnregisterHotKey
SetTimer
SetCapture
GetCursorPos
DrawIcon
GetSystemMetrics
IsIconic
RegisterHotKey
MapVirtualKeyW
keybd_event
DeleteMenu
LoadBitmapW
AppendMenuW
GetSystemMenu
LoadIconW
GetClassInfoW
SetForegroundWindow
FindWindowW
GetKeyState
DispatchMessageW
TranslateMessage
PeekMessageW
SendMessageW
ScreenToClient
GetWindowRect
EnableWindow
GetClientRect
GetClassInfoExW

gdi32

SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
ScaleViewportExtEx
CreateSolidBrush
GetBkColor
GetTextColor
GetRgnBox
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutW
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
CreatePen
GetStockObject
SetMapMode
SetBkMode
RestoreDC
SaveDC
SetTextColor
GetClipBox
CreateBitmap
DeleteObject
GetMapMode
GetDeviceCaps
CreateRectRgnIndirect
SetBkColor
ExtTextOutW
Rectangle
GetTextExtentPoint32W
CreateFontIndirectW
GetObjectW

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegCloseKey
RegQueryValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW

shell32

SHGetSpecialFolderPathA
ShellExecuteW

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameW
UrlUnescapeW
PathStripToRootW
PathIsUNCW
PathFindExtensionW

oledlg

OleUIBusyW

ole32

CoRegisterMessageFilter
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard

oleaut32

SysAllocString
OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
SysFreeString
SysStringLen
VariantInit
VariantChangeType
VariantClear
SysAllocStringLen

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetOpenW
InternetGetLastResponseInfoW
InternetCloseHandle
HttpQueryInfoW
InternetQueryDataAvailable
InternetQueryOptionW
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetOpenUrlW

Sections

.text
Size: 273KB - Virtual size: 272KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Mouse and Keyboard Recorder v3.1.9.2 x86-x64/Crack/MouseClicker.exe
.exe windows:5 windows x86 arch:x86

Password: infected

ecfa378bdf0e0cb94583131f81615205

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\SVN\biggod.dev\Release\MouseKeyboardRecorder\MouseClicker.pdb

Imports

kernel32

GetFileAttributesW
GetFileSizeEx
SetErrorMode
GetTickCount
GetStartupInfoW
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
RtlUnwind
RaiseException
HeapReAlloc
ExitProcess
HeapSize
SetStdHandle
GetFileType
VirtualAlloc
GetSystemInfo
VirtualQuery
SetUnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapCreate
VirtualFree
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetTimeZoneInformation
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
GetFullPathNameW
GetVolumeInformationW
FindFirstFileW
FindClose
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetThreadLocale
InterlockedIncrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GlobalFlags
LocalAlloc
lstrlenA
InterlockedDecrement
WaitForSingleObject
WritePrivateProfileStringW
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
FormatMessageW
LocalFree
GetCurrentProcessId
GetModuleHandleA
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetVersionExW
CompareStringW
LoadLibraryA
lstrcmpW
GetVersionExA
MulDiv
FreeResource
VirtualProtect
FreeLibrary
GetWindowsDirectoryW
CreateThread
TerminateThread
WritePrivateProfileStringA
GetPrivateProfileStringA
GetProcAddress
LoadLibraryW
InitializeCriticalSection
FindResourceW
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FileTimeToLocalFileTime
FileTimeToSystemTime
GetModuleHandleW
MultiByteToWideChar
GetLastError
CreateMutexW
SetLastError
CloseHandle
GetFileTime
GetFileSize
CreateFileW
WinExec
lstrcatW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcpyW
GetModuleFileNameW
Sleep
lstrlenW
CreateDirectoryA
QueryPerformanceCounter
GetModuleFileNameA

user32

IsRectEmpty
SetRect
InvalidateRgn
GetNextDlgGroupItem
CharUpperW
UnregisterClassW
RegisterClipboardFormatW
PostThreadMessageW
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
EnableMenuItem
CheckMenuItem
GetMenuStringW
GetWindowThreadProcessId
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetFocus
GetForegroundWindow
GetLastActivePopup
CopyAcceleratorTableW
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
GetKeyState
SetMenu
IsWindowVisible
UpdateWindow
CreateWindowExW
GetClassInfoExW
RegisterClassW
AdjustWindowRectEx
EqualRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
SetWindowPos
OffsetRect
SystemParametersInfoA
GetWindowPlacement
IntersectRect
GetWindowTextLengthW
GetWindowTextW
GetWindow
SetFocus
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetWindowLongW
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
DrawStateW
FillRect
CopyRect
ModifyMenuW
InsertMenuW
GetMenuState
CreateMenu
CreatePopupMenu
LoadMenuW
CopyIcon
LoadCursorW
InflateRect
ReleaseDC
GetDC
CharNextW
GetSysColorBrush
WindowFromPoint
GetParent
InvalidateRect
DestroyMenu
GetMessageW
ValidateRect
SetWindowLongW
SetCursor
RedrawWindow
MessageBeep
GetSysColor
IsWindow
GetMenuItemID
GetSubMenu
GetMenuItemCount
PostMessageW
UnregisterHotKey
ReleaseCapture
KillTimer
SetTimer
SetCapture
SetCursorPos
PtInRect
GetCursorPos
DrawIcon
GetSystemMetrics
IsIconic
RegisterHotKey
LoadBitmapW
SendMessageW
AppendMenuW
GetSystemMenu
LoadIconW
GetClassInfoW
SetForegroundWindow
FindWindowW
mouse_event
DispatchMessageW
TranslateMessage
PeekMessageW
ScreenToClient
GetWindowRect
EnableWindow
GetClientRect
MessageBoxW

gdi32

SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
ScaleViewportExtEx
CreateSolidBrush
GetBkColor
GetTextColor
GetRgnBox
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutW
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
CreatePen
GetStockObject
SetMapMode
SetBkMode
RestoreDC
SaveDC
SetTextColor
GetClipBox
CreateBitmap
DeleteObject
GetMapMode
GetDeviceCaps
CreateRectRgnIndirect
SetBkColor
ExtTextOutW
Rectangle
GetTextExtentPoint32W
CreateFontIndirectW
GetObjectW

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegCloseKey
RegQueryValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW

shell32

SHGetSpecialFolderPathA
ShellExecuteW

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameW
UrlUnescapeW
PathStripToRootW
PathIsUNCW
PathFindExtensionW

oledlg

OleUIBusyW

ole32

CoRegisterMessageFilter
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard

oleaut32

SysAllocString
OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
SysFreeString
SysStringLen
VariantInit
VariantChangeType
VariantClear
SysAllocStringLen

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetOpenW
InternetGetLastResponseInfoW
InternetCloseHandle
HttpQueryInfoW
InternetQueryDataAvailable
InternetQueryOptionW
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetOpenUrlW

Sections

.text
Size: 275KB - Virtual size: 274KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Mouse and Keyboard Recorder v3.1.9.2 x86-x64/Crack/MouseKeyboardRecorder.exe
.exe windows:5 windows x86 arch:x86

Password: infected

71d5adc84790fcc0c44614667e23a471

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\SVN\biggod.dev\Release\MouseKeyboardRecorder\MouseKeyboardRecorder.pdb

Imports

kernel32

GetFileAttributesW
GetFileSizeEx
SetErrorMode
GetStartupInfoW
GetSystemTimeAsFileTime
HeapAlloc
HeapReAlloc
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
RaiseException
HeapSize
SetStdHandle
GetFileType
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapCreate
VirtualFree
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetCurrentDirectoryA
GetDriveTypeA
CreateFileA
GetProcessHeap
SetEnvironmentVariableA
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
InterlockedIncrement
GetThreadLocale
GlobalFlags
LocalAlloc
lstrlenA
FindFirstFileW
FindNextFileW
FindClose
WaitForSingleObject
InterlockedDecrement
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
GetCurrentProcessId
GetModuleHandleA
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LoadLibraryA
lstrcmpW
GetVersionExA
FormatMessageW
LocalFree
MulDiv
FreeResource
VirtualProtect
FreeLibrary
GetWindowsDirectoryW
CreateThread
TerminateThread
ExitProcess
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetTickCount
GetLongPathNameW
SetCurrentDirectoryA
GetProcAddress
LoadLibraryW
WideCharToMultiByte
FileTimeToLocalFileTime
FileTimeToSystemTime
GetModuleHandleW
DeleteFileW
MultiByteToWideChar
CreateMutexW
SetLastError
IsBadReadPtr
GetFileTime
GetFileSize
CreateFileW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetVersionExW
GetLastError
CloseHandle
GetCurrentProcess
WinExec
lstrcatW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcpyW
GetModuleFileNameW
Sleep
lstrlenW
CreateDirectoryW
FindResourceW
LoadResource
LockResource
SizeofResource
QueryPerformanceCounter
GetModuleFileNameA

user32

RegisterClipboardFormatW
PostThreadMessageW
MapDialogRect
PostQuitMessage
GetWindowThreadProcessId
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
EnableMenuItem
CheckMenuItem
SetWindowTextW
IsDialogMessageW
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextLengthW
GetLastActivePopup
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
GetKeyState
SetMenu
CharUpperW
IsWindowVisible
UpdateWindow
CreateWindowExW
GetClassInfoExW
RegisterClassW
AdjustWindowRectEx
EqualRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindow
GetMenuStringW
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetWindowLongW
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
SetWindowRgn
DrawFocusRect
SetRect
GetWindowTextW
DrawStateW
FillRect
CopyRect
ModifyMenuW
InsertMenuW
GetMenuState
CreateMenu
CreatePopupMenu
LoadMenuW
CopyIcon
LoadCursorW
ReleaseDC
GetDC
GetParent
SetCursor
SetCapture
RedrawWindow
ReleaseCapture
MessageBeep
GetSysColor
OffsetRect
InflateRect
IsWindow
PtInRect
GetMenuItemID
GetSubMenu
GetMenuItemCount
InvalidateRect
keybd_event
GetNextDlgGroupItem
InvalidateRgn
IsRectEmpty
CopyAcceleratorTableW
CharNextW
UnregisterClassW
GetSysColorBrush
mouse_event
SetCursorPos
GetCursorPos
WindowFromPoint
DestroyMenu
ValidateRect
SetWindowContextHelpId
GetMessageW
SetWindowPos
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
DrawIcon
IsIconic
RegisterHotKey
UnregisterHotKey
PostMessageW
MoveWindow
SetWindowLongW
LoadBitmapW
AppendMenuW
GetSystemMenu
LoadIconW
GetClassInfoW
SetForegroundWindow
ShowWindow
FindWindowW
GetKeyNameTextW
MapVirtualKeyW
ScreenToClient
GetForegroundWindow
MessageBoxW
ExitWindowsEx
GetWindowRect
SystemParametersInfoW
GetSystemMetrics
DispatchMessageW
TranslateMessage
PeekMessageW
SendMessageW
LoadImageA
KillTimer
SetTimer
GetClientRect
EnableWindow

gdi32

SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
ScaleViewportExtEx
SetViewportOrgEx
GetBkColor
GetTextColor
GetRgnBox
SetViewportExtEx
OffsetViewportOrgEx
SetMapMode
Escape
LineTo
TextOutW
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
SelectObject
SetBkMode
RestoreDC
SaveDC
DeleteObject
GetMapMode
CreateRectRgnIndirect
ExtTextOutW
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
RoundRect
CreateSolidBrush
CreatePen
GetTextExtentPoint32W
CreateFontIndirectW
GetObjectW
GetStockObject
GetTextMetricsW
CreateFontW
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
Rectangle
MoveToEx

msimg32

TransparentBlt

comdlg32

GetOpenFileNameW
GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

LookupPrivilegeValueA
RegOpenKeyExW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegCloseKey
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegQueryValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW

shell32

SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW

comctl32

InitCommonControlsEx
_TrackMouseEvent

shlwapi

PathFindExtensionW
PathFindFileNameW
UrlUnescapeW
PathStripToRootW
PathIsUNCW
PathFileExistsW

oledlg

OleUIBusyW

ole32

CoRegisterMessageFilter
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard

oleaut32

SysAllocString
OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
VariantInit
VariantChangeType
VariantClear
SysAllocStringLen
SysFreeString
SysStringLen

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetOpenW
InternetGetLastResponseInfoW
InternetCloseHandle
HttpQueryInfoW
InternetQueryDataAvailable
InternetQueryOptionW
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetOpenUrlW

Sections

.text
Size: 326KB - Virtual size: 326KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Mouse and Keyboard Recorder v3.1.9.2 x86-x64/Crack/MouseRecorder.exe
.exe windows:5 windows x86 arch:x86

Password: infected

f0c07da3d3ca1518fd03eb0a9e825b8b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\SVN\biggod.dev\Release\MouseKeyboardRecorder\MouseRecorder.pdb

Imports

kernel32

GetFileAttributesW
GetFileSizeEx
SetErrorMode
GetStartupInfoW
GetSystemTimeAsFileTime
HeapAlloc
HeapReAlloc
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
RaiseException
ExitProcess
HeapSize
SetStdHandle
GetFileType
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapCreate
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetCurrentDirectoryA
GetDriveTypeA
GetProcessHeap
SetEnvironmentVariableA
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetThreadLocale
InterlockedIncrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GlobalFlags
LocalAlloc
lstrlenA
FindFirstFileW
FindNextFileW
FindClose
WaitForSingleObject
WritePrivateProfileStringW
InterlockedDecrement
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
FormatMessageW
LocalFree
GetCurrentProcessId
GetModuleHandleA
MulDiv
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LoadLibraryA
lstrcmpW
GetVersionExA
FreeResource
VirtualProtect
FreeLibrary
GetWindowsDirectoryW
CreateThread
TerminateThread
DeleteFileW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetTickCount
WritePrivateProfileStringA
SetCurrentDirectoryA
GetProcAddress
LoadLibraryW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetModuleHandleW
GetPrivateProfileStringA
CreateMutexW
SetLastError
MultiByteToWideChar
GetFileTime
GetFileSize
CreateFileW
GetVersionExW
GetLastError
CloseHandle
GetCurrentProcess
WinExec
WideCharToMultiByte
lstrcatW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcpyW
GetModuleFileNameW
CreateDirectoryW
FindResourceW
LoadResource
LockResource
SizeofResource
Sleep
lstrlenW
CreateDirectoryA
VirtualFree
GetModuleFileNameA

user32

RegisterClipboardFormatW
PostThreadMessageW
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
GetMenuStringW
GetWindowThreadProcessId
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
EnableMenuItem
CheckMenuItem
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextLengthW
GetLastActivePopup
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
UpdateWindow
CreateWindowExW
GetClassInfoExW
RegisterClassW
AdjustWindowRectEx
EqualRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
SetWindowPos
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindow
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetWindowLongW
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
SetWindowRgn
DrawFocusRect
SetRect
GetWindowTextW
DrawStateW
FillRect
CopyRect
ModifyMenuW
InsertMenuW
GetMenuState
CreateMenu
CreatePopupMenu
LoadMenuW
CopyIcon
LoadCursorW
ReleaseDC
GetDC
GetParent
SetWindowLongW
SetCursor
SetCapture
RedrawWindow
ReleaseCapture
MessageBeep
GetSysColor
OffsetRect
InflateRect
CharUpperW
GetNextDlgGroupItem
InvalidateRgn
IsRectEmpty
CopyAcceleratorTableW
CharNextW
UnregisterClassW
IsWindow
PtInRect
GetMenuItemID
GetSysColorBrush
WindowFromPoint
DestroyMenu
GetKeyState
ValidateRect
GetSubMenu
GetMenuItemCount
InvalidateRect
UnregisterHotKey
mouse_event
SetCursorPos
GetCursorPos
UnhookWindowsHookEx
GetMessageW
SetWindowsHookExW
CallNextHookEx
DrawIcon
IsIconic
RegisterHotKey
PostMessageW
LoadBitmapW
AppendMenuW
GetSystemMenu
LoadIconW
GetClassInfoW
SetForegroundWindow
FindWindowW
LoadImageA
ScreenToClient
GetForegroundWindow
MessageBoxW
ExitWindowsEx
GetWindowRect
SystemParametersInfoW
GetSystemMetrics
DispatchMessageW
TranslateMessage
PeekMessageW
SendMessageW
KillTimer
SetTimer
GetClientRect
EnableWindow
IsWindowVisible

gdi32

SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
SetViewportExtEx
GetBkColor
GetTextColor
GetRgnBox
MoveToEx
LineTo
ScaleViewportExtEx
SetMapMode
OffsetViewportOrgEx
SetViewportOrgEx
Escape
TextOutW
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
SelectObject
SetBkMode
RestoreDC
SaveDC
DeleteObject
GetMapMode
GetDeviceCaps
CreateRectRgnIndirect
ExtTextOutW
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
RoundRect
CreateSolidBrush
CreatePen
GetTextExtentPoint32W
CreateFontIndirectW
GetObjectW
GetStockObject
GetTextMetricsW
CreateFontW
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
Rectangle

msimg32

TransparentBlt

comdlg32

GetOpenFileNameW
GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

LookupPrivilegeValueA
RegOpenKeyExW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegCloseKey
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegQueryValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW

shell32

SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
ShellExecuteA
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW

comctl32

InitCommonControlsEx
_TrackMouseEvent

shlwapi

PathFileExistsA
PathFileExistsW
PathFindExtensionW
PathFindFileNameW
UrlUnescapeW
PathStripToRootW
PathIsUNCW

oledlg

OleUIBusyW

ole32

CoRegisterMessageFilter
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard

oleaut32

SysAllocString
OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
SysFreeString
SysStringLen
VariantInit
VariantChangeType
VariantClear
SysAllocStringLen

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetOpenW
InternetGetLastResponseInfoW
InternetCloseHandle
HttpQueryInfoW
InternetQueryDataAvailable
InternetQueryOptionW
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetOpenUrlW

Sections

.text
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Mouse and Keyboard Recorder v3.1.9.2 x86-x64/Crack/ScheduledTasks.exe
.exe windows:5 windows x86 arch:x86

Password: infected

24ca4ab30a9a111f54691313887068f9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\SVN\biggod.dev\Release\MouseKeyboardRecorder\ScheduledTasks.pdb

Imports

kernel32

SetErrorMode
GetFileAttributesW
GetFileSizeEx
GetStartupInfoW
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
RtlUnwind
HeapReAlloc
RaiseException
ExitProcess
HeapSize
VirtualAlloc
GetSystemInfo
VirtualQuery
SetUnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
GetFullPathNameW
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetTimeZoneInformation
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetProcessHeap
SetEnvironmentVariableA
GetVolumeInformationW
FindFirstFileW
FindClose
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
InterlockedIncrement
GetThreadLocale
GlobalFlags
lstrlenA
WritePrivateProfileStringW
InterlockedDecrement
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
GetModuleHandleA
GetCurrentProcessId
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LoadLibraryA
lstrcmpW
GetVersionExA
GlobalAlloc
FormatMessageW
LocalFree
MulDiv
GlobalLock
GlobalUnlock
GlobalFree
FreeResource
GetVersion
VirtualProtect
FreeLibrary
GetWindowsDirectoryW
WritePrivateProfileStringA
DeleteFileW
CreateThread
GetExitCodeProcess
WaitForSingleObject
GetTickCount
GetProcAddress
GetModuleHandleW
LoadLibraryW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetPrivateProfileStringA
GetVersionExW
GetLastError
CreateMutexW
SetLastError
GetModuleFileNameW
CloseHandle
GetFileTime
GetFileSize
CreateFileW
WinExec
lstrcatW
lstrcpyW
WideCharToMultiByte
Sleep
lstrlenW
CreateDirectoryA
MultiByteToWideChar
GetModuleFileNameA
FindResourceW
LoadResource
LockResource
QueryPerformanceCounter
SizeofResource

user32

SetRect
InvalidateRgn
GetNextDlgGroupItem
CharUpperW
RegisterClipboardFormatW
PostThreadMessageW
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetWindowThreadProcessId
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
EnableMenuItem
CheckMenuItem
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextW
GetLastActivePopup
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
GetKeyState
IsRectEmpty
UpdateWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
SetWindowPos
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindow
GetMenuStringW
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetWindowLongW
GetDlgItem
GetNextDlgTabItem
EndDialog
SetActiveWindow
DrawAnimatedRects
SetParent
SystemParametersInfoW
EnumChildWindows
GetClassNameW
TrackPopupMenu
GetCursorPos
RegisterWindowMessageW
EnableWindow
SendMessageW
InvalidateRect
GetClientRect
DrawStateW
FillRect
CopyRect
ModifyMenuW
InsertMenuW
GetMenuState
CreateMenu
CreatePopupMenu
LoadMenuW
CopyIcon
LoadCursorW
InflateRect
CopyAcceleratorTableW
CharNextW
UnregisterClassW
GetSysColorBrush
WindowFromPoint
DestroyMenu
ReleaseDC
GetDC
ValidateRect
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
EndPaint
SetMenu
BeginPaint
SetTimer
KillTimer
IsWindow
LoadImageA
GetWindowRect
ScreenToClient
PeekMessageW
TranslateMessage
DispatchMessageW
FindWindowW
SetForegroundWindow
GetMessageW
LoadIconW
GetSystemMenu
AppendMenuW
LoadBitmapW
PostMessageW
GetSystemMetrics
IsIconic
DrawIcon
GetLastInputInfo
IsWindowVisible
GetMenuItemCount
GetSubMenu
GetMenuItemID
MessageBoxW
GetForegroundWindow
IsWindowEnabled
OffsetRect
GetSysColor
MessageBeep
PtInRect
ReleaseCapture
RedrawWindow
SetCapture
SetCursor
SetWindowLongW
GetParent
GetWindowTextLengthW

gdi32

SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
Escape
CreatePen
CreateSolidBrush
GetBkColor
GetTextColor
GetRgnBox
TextOutW
PtVisible
RectVisible
GetWindowExtEx
GetViewportExtEx
CreateCompatibleDC
ExcludeClipRect
SetMapMode
SetBkMode
RestoreDC
SaveDC
DeleteObject
GetMapMode
CreateRectRgnIndirect
ExtTextOutW
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
Rectangle
GetTextExtentPoint32W
CreateFontIndirectW
GetObjectW
GetStockObject
GetTextMetricsW
CreateFontW
BitBlt
SelectObject
CreateCompatibleBitmap

comdlg32

GetOpenFileNameW
GetFileTitleW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW

shell32

SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
ShellExecuteExW
Shell_NotifyIconW
SHAppBarMessage
ShellExecuteW

comctl32

InitCommonControlsEx

shlwapi

PathFileExistsW
PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathIsUNCW
PathFileExistsA

oledlg

OleUIBusyW

ole32

CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
OleIsCurrentClipboard
CLSIDFromProgID
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize
OleFlushClipboard
CoRegisterMessageFilter
CLSIDFromString

oleaut32

SystemTimeToVariantTime
SysStringLen
SysFreeString
SysAllocStringLen
VariantClear
VariantChangeType
VariantInit
VariantCopy
SafeArrayDestroy
OleCreateFontIndirect
SysAllocString
VariantTimeToSystemTime

Sections

.text
Size: 305KB - Virtual size: 305KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Mouse and Keyboard Recorder v3.1.9.2 x86-x64/F_jl.txt
Mouse and Keyboard Recorder v3.1.9.2 x86-x64/MouseKeyboardRecorder.exe
.exe windows:1 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Mouse and Keyboard Recorder v3.1.9.2 x86-x64/install.txt

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 345KB - Virtual size: 344KB

.rsrc Size: 226KB - Virtual size: 226KB

.reloc Size: 512B - Virtual size: 12B

Password: infected

e569e6f445d32ba23766ad67d1e3787f

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

24:62:75:05:2e:51:a7:61:bd:da:da:4cCertificate

Extended Key Usages

Key Usages

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6aCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

b9:5e:20:cd:aa:e1:70:52:4f:84:f2:1f:40:3a:f3:c0:8a:5f:72:a4:36:30:f1:04:01:8e:a1:12:cf:42:04:14Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

comctl32

version

user32

oleaut32

netapi32

advapi32

Exports

Exports

Sections

.text Size: 718KB - Virtual size: 718KB

.itext Size: 6KB - Virtual size: 5KB

.data Size: 14KB - Virtual size: 13KB

.bss Size: - Virtual size: 27KB

.idata Size: 4KB - Virtual size: 3KB

.didata Size: 512B - Virtual size: 420B

.edata Size: 512B - Virtual size: 154B

.tls Size: - Virtual size: 24B

.rdata Size: 512B - Virtual size: 93B

.rsrc Size: 81KB - Virtual size: 80KB

Password: infected

f555b9ae32ad83ca0cc14a94806b7a37

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

version

wininet

.text
Size: 345KB - Virtual size: 344KB

.rsrc
Size: 226KB - Virtual size: 226KB

.reloc
Size: 512B - Virtual size: 12B

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

24:62:75:05:2e:51:a7:61:bd:da:da:4c
Certificate

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

b9:5e:20:cd:aa:e1:70:52:4f:84:f2:1f:40:3a:f3:c0:8a:5f:72:a4:36:30:f1:04:01:8e:a1:12:cf:42:04:14
Signer

.text
Size: 718KB - Virtual size: 718KB

.itext
Size: 6KB - Virtual size: 5KB

.data
Size: 14KB - Virtual size: 13KB

.bss
Size: - Virtual size: 27KB

.idata
Size: 4KB - Virtual size: 3KB

.didata
Size: 512B - Virtual size: 420B

.edata
Size: 512B - Virtual size: 154B

.tls
Size: - Virtual size: 24B

.rdata
Size: 512B - Virtual size: 93B

.rsrc
Size: 81KB - Virtual size: 80KB

.text
Size: 273KB - Virtual size: 272KB

.rdata
Size: 70KB - Virtual size: 69KB

.data
Size: 16KB - Virtual size: 32KB

.rsrc
Size: 45KB - Virtual size: 45KB

.reloc
Size: 38KB - Virtual size: 38KB

.text
Size: 275KB - Virtual size: 274KB

.rdata
Size: 70KB - Virtual size: 69KB

.data
Size: 16KB - Virtual size: 32KB

.rsrc
Size: 46KB - Virtual size: 46KB

.reloc
Size: 39KB - Virtual size: 38KB

.text
Size: 326KB - Virtual size: 326KB

.rdata
Size: 88KB - Virtual size: 88KB

.data
Size: 17KB - Virtual size: 34KB

.rsrc
Size: 51KB - Virtual size: 51KB

.reloc
Size: 46KB - Virtual size: 45KB