keylogger[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
keylogger.exe
Size 142KB
Sample260627-bxn8dsf19v
SHA256 d4ae3023e9659e145c533f61a724b08ef6ed56b3fa02865c8a80fccce3129d9d
MD5 8a7dc9310ee7df5a163cf03d73408186
SHA1 ca3dc9b5e1e819ad2aa621808c0a20e753eaee04
SHA512 f0c322c07ac0f19e0751da825046cd88517d51643c5c24c871b26619f09a4052687d6fe251d91e0963fb3af84fb520545133646e409d6f2678e7078b906968e7
SSDEEP 1536:WezLlkkbwLwU2kLMVglgTEAHzPJOZWhLNM5zQ6/tSJJQBxR6guzN20jzYybbOeiy:WezL2ObUHLM7xMDSaburj0yvSVf4
TLSH
T161E32AC5BAC59DD7EA14423C85AB832A263CF6C587838B135834B6310F13AD17DDB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
keylogger.exe

File Explorer

keylogger.exe

.exe 142KB

keylogger.exe

IMPHASH fb251d914c0dacf2d58bd482e5b0754b
SHA256 d4ae3023e9659e145c533f61a724b08ef6ed56b3fa02865c8a80fccce3129d9d
MD5 8a7dc9310ee7df5a163cf03d73408186
SHA1 ca3dc9b5e1e819ad2aa621808c0a20e753eaee04
SHA512 f0c322c07ac0f19e0751da825046cd88517d51643c5c24c871b26619f09a4052687d6fe251d91e0963fb3af84fb520545133646e409d6f2678e7078b906968e7
SSDEEP 1536:WezLlkkbwLwU2kLMVglgTEAHzPJOZWhLNM5zQ6/tSJJQBxR6guzN20jzYybbOeiy:WezL2ObUHLM7xMDSaburj0yvSVf4
TLSH
T161E32AC5BAC59DD7EA14423C85AB832A263CF6C587838B135834B6310F13AD17DDB66B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegOpenKeyExW RegSetValueExW

kernel32

CloseHandle CreateDirectoryW CreateFileW CreateMutexW CreateThread DeleteCriticalSection DeleteFileW EnterCriticalSection FlushFileBuffers GetFileSize GetFileSizeEx GetLastError GetLocalTime GetModuleFileNameW GetProcessHeap GetStartupInfoW GlobalLock GlobalUnlock HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection MoveFileW MultiByteToWideChar ReadFile SetFileAttributesW SetFilePointer SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery WideCharToMultiByte WriteFile lstrlenA

msvcrt

__C_specific_handler __iob_func __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _commode _fmode _initterm _onexit _vsnwprintf_s _wcmdln abort calloc exit fprintf free fwrite malloc memcpy signal strlen strncmp swprintf_s vfprintf wcscmp wcscpy_s wcslen

user32

CallNextHookEx CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW GetClipboardData GetForegroundWindow GetKeyState GetKeyboardState GetMessageW GetWindowTextW IsClipboardFormatAvailable KillTimer OpenClipboard PostQuitMessage RegisterClassExW SetTimer SetWinEventHook SetWindowsHookExW ToUnicode TranslateMessage UnhookWinEvent UnhookWindowsHookEx

wininet

HttpAddRequestHeadersW HttpOpenRequestW HttpQueryInfoA HttpSendRequestA InternetCloseHandle InternetConnectW InternetCrackUrlW InternetOpenW InternetSetOptionW

Name

.text

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

160B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

660B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

564B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

116B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

707B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

keylogger.exe

advapi32

kernel32

msvcrt

user32

wininet

generic