D:\program z visuala\keylogger\Release\keylogger.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Cyclops mistrock/cyclo scripts.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Cyclops mistrock/cyclo scripts.exe
Resource
win10v2004-20240802-en
General
-
Target
a390bf07d6c7edaa684edfee42bb066a_JaffaCakes118
-
Size
75KB
-
MD5
a390bf07d6c7edaa684edfee42bb066a
-
SHA1
bc43bd614a19fb6cc927a19204661eb20e01efe5
-
SHA256
ca512401a4485494fc4f7d9e44857bf882ec8ebd7bc90acdd7e3b58681464928
-
SHA512
4c0d38af4c84c12531ca5ab536e2d80e9911af0cba090fd39b2e8f6160b7d7c745546eba468f61aa9f904d037cfd9544790b11d5546539378542ec4c97889ff3
-
SSDEEP
1536:LMVjJwaPKoWQi7cc0gPOUyn65Z4/RZPP0P4IMh6Weuygnw6u6n6A:LMHFigU06zmhqZgnpu6n6A
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Cyclops mistrock/cyclo scripts.exe
Files
-
a390bf07d6c7edaa684edfee42bb066a_JaffaCakes118.rar
-
Cyclops mistrock/cyclo scripts.exe.exe windows:5 windows x86 arch:x86
c0e76e26d8a8eca5fe31704a152af75f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetLastError
SetLastError
GetProcAddress
LoadLibraryA
Process32Next
GetModuleFileNameA
CreateToolhelp32Snapshot
CloseHandle
GetCurrentProcessId
DebugBreak
ExitProcess
CreateFileA
GetFileSize
FindResourceA
FreeResource
LoadResource
GetWindowsDirectoryA
GlobalAlloc
SizeofResource
ReadFile
SetFileAttributesA
GlobalFree
Sleep
GetModuleHandleA
VirtualProtect
GetSystemTime
DeleteFileA
CreateThread
SetEndOfFile
CreateFileW
InitializeCriticalSection
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
LCMapStringW
GetCurrentThread
GetTickCount
OutputDebugStringW
LockResource
Process32First
LCMapStringA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
HeapAlloc
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
HeapSize
SetFilePointer
RaiseException
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
WriteConsoleA
GetProcessHeap
user32
LoadCursorA
OpenClipboard
DispatchMessageA
ShowWindow
SetWindowsHookExA
DefWindowProcA
GetMessageA
RegisterClassExA
GetKeyState
IsClipboardFormatAvailable
CallNextHookEx
TranslateMessage
GetForegroundWindow
GetWindowTextA
GetClipboardData
CreateWindowExA
advapi32
RegOpenKeyExA
RegSetValueExA
GetUserNameA
RegCloseKey
ws2_32
gethostbyname
wininet
InternetCloseHandle
InternetConnectA
FtpPutFileA
InternetOpenA
Sections
.text Size: 117KB - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Magicians yalahar/magiciany.elfc
-
Magicians yalahar/magiciany.elft
-
Mintwalin thais 40 knight/mintwalin.elfc
-
Mintwalin thais 40 knight/mintwalin.elft
-
Wyrms for mage 130+/wyrms/wyrmy.elfc
-
Wyrms for mage 130+/wyrms/wyrmy.elft