D:\Dev\KLKeylogger\KRyLack Keylogger Free\Release\ulklfemon.pdb
Static task
static1
Behavioral task
behavioral1
Sample
189e99187a2dd225be416a517883f312_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
189e99187a2dd225be416a517883f312_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
189e99187a2dd225be416a517883f312_JaffaCakes118
-
Size
241KB
-
MD5
189e99187a2dd225be416a517883f312
-
SHA1
a39d289a37ec61deff2fd5b453f3c2d13e0949e2
-
SHA256
c8010574218ae61e0e9290257fad899af9891e72d99db10b55f01871cc0831ef
-
SHA512
743781b728b5a2673767c9ff6f4f23256bc57615b46ecd3b17dafeb4ba67a6df78c812f6eef2675991e13b4f3d0b4d786afdd2d573ebca42d8bb2d27cdb64aca
-
SSDEEP
3072:GtBW/ngOsVlCasfuAcjZiZtbrHYzNdiYKwWAFrVqGGffcpPFX5zuoD5LP:G3Kng+fuAc9iZRrHgRKwZrVqGGuuS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 189e99187a2dd225be416a517883f312_JaffaCakes118
Files
-
189e99187a2dd225be416a517883f312_JaffaCakes118.dll windows:5 windows x86 arch:x86
1ecb8885c7b3f3a53076abfbe9762cc3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetCommandLineA
HeapAlloc
HeapFree
RtlUnwind
Sleep
ExitProcess
RaiseException
HeapSize
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
VirtualAlloc
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
lstrlenA
GetCurrentProcess
FlushFileBuffers
SetFilePointer
WriteFile
GlobalFindAtomW
LoadLibraryA
GetVersionExA
InterlockedIncrement
FormatMessageW
GlobalFlags
GetModuleHandleA
WritePrivateProfileStringW
SetErrorMode
lstrlenW
TlsFree
GlobalFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalUnlock
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalFree
LocalAlloc
GetLastError
GlobalAddAtomW
InterlockedDecrement
SetLastError
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesW
GetModuleFileNameW
lstrcmpA
GetLocaleInfoW
LoadLibraryW
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
InterlockedExchange
GlobalLock
lstrcmpW
GlobalAlloc
FreeLibrary
GetModuleHandleW
GetProcAddress
GetCurrentProcessId
ReleaseMutex
WaitForSingleObject
CloseHandle
GetTickCount
CreateMutexA
user32
DestroyMenu
LoadCursorW
GetSysColorBrush
ShowWindow
RegisterWindowMessageW
LoadIconW
WinHelpW
GetCapture
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetClientRect
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
DefWindowProcW
CallWindowProcW
CopyRect
GetMenu
SetWindowLongW
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
GetMenuItemID
GetSubMenu
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameW
PtInRect
GetWindowTextW
SetWindowTextW
GetSysColor
SetWindowsHookExW
UnhookWindowsHookEx
PostMessageW
CallNextHookEx
ReleaseDC
GetDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetMenuItemCount
SetMenu
GetForegroundWindow
ToAscii
GetKeyNameTextA
ToUnicodeEx
GetKeyboardLayout
GetWindowThreadProcessId
GetKeyNameTextW
IsWindow
GetKeyState
PostQuitMessage
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuW
SendMessageW
GetParent
GetFocus
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
UnregisterClassW
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxW
SetCursor
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
IsWindowVisible
PeekMessageW
GetCursorPos
ValidateRect
gdi32
DeleteDC
GetStockObject
GetDeviceCaps
ScaleWindowExtEx
SelectObject
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
CreateBitmap
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
DeleteObject
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
SetViewportOrgEx
winspool.drv
DocumentPropertiesW
OpenPrinterW
ClosePrinter
advapi32
RegSetValueExW
RegCreateKeyExW
RegQueryValueW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
shlwapi
PathFindFileNameW
PathFindExtensionW
oleaut32
VariantClear
VariantChangeType
VariantInit
Exports
Exports
?AddKeyEntry@@YAJQAUtagKeyEntry@@@Z
?FormatKeyHookError@@YAHJPADH@Z
?FormatKeyHookError@@YAHJPA_WH@Z
?GetKeyEntryCount@@YAHPAJ@Z
?GetKeyEntryList@@YAHPAUtagKeyEntry@@HPAJ@Z
?GetKeyEventResult@@YAJIJPAUtagKeyResultA@@I@Z
?GetKeyEventResult@@YAJIJPAUtagKeyResultW@@I@Z
?InstallKeyHook@@YAJXZ
?IsKeyHookInstalled@@YAHXZ
?KeyEntryExists@@YAHQAUtagKeyEntry@@PAJ@Z
?RemoveAllKeyEntries@@YAJXZ
?RemoveKeyEntry@@YAJQAUtagKeyEntry@@@Z
?UninstallKeyHook@@YAJXZ
Sections
.text Size: 127KB - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SHARED Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ