kl[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
kl.exe
Size 1.7MB
Sample260801-pkrdwaveka
SHA256 8322a536e62f5119229243293fa41d06c420a911d21214ec78c1289b796957a6
MD5 13f377dd0e67abcdb266bc2433bccaca
SHA1 ffeb81b2270cabd47a30719c2c6b6a824878925f
SHA512 6aacb1365a1812f6ee402598c5bf5969e25091c5502e4ea07d407776b09ed58fb32f9efabbc07ca0b50035c98636b8bee5b96f01afa4b5f4a89541c4480d4594
SSDEEP 49152:Pc/OpzSXnBOxfAnyv3TnYZVKVC6mE8vN41AboWe:U/iinBOxGIcVjv0AbW
TLSH
T14185339657E09879D2611E3148FFF9343A37CD414827F7EBBB784F3120A2597AE2A814
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
kl.exe
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/ShellExecAsUser.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/silentkeyloggerfree.exe
unpack001/ulklfemon.dll
unpack001/unukfree.exe
unpack002/$PLUGINSDIR/InstallOptions.dll

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/unukfree.exe	nsis_installer_1
static1/unpack001/unukfree.exe	nsis_installer_2

File Explorer

kl.exe

.exe 1.7MB
$PLUGINSDIR/InstallOptions.dll

.dll 14KB
$PLUGINSDIR/ShellExecAsUser.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 10KB
$PLUGINSDIR/ioSpecial.ini

211B
$PLUGINSDIR/modern-header.bmp

25KB
$PLUGINSDIR/modern-wizard.bmp

150KB
silentkeyloggerfree.chm

.chm 65KB
silentkeyloggerfree.exe

.exe 3.7MB
ulklfemon.dll

.dll 2.0MB
unukfree.exe

.exe 121KB
$PLUGINSDIR/InstallOptions.dll

.dll 14KB
$PLUGINSDIR/ioSpecial.ini

211B
$PLUGINSDIR/modern-header.bmp

25KB
$PLUGINSDIR/modern-wizard.bmp

150KB

kl.exe

IMPHASH b1a57b635b23ffd553b3fd1e0960b2bd
SHA256 8322a536e62f5119229243293fa41d06c420a911d21214ec78c1289b796957a6
MD5 13f377dd0e67abcdb266bc2433bccaca
SHA1 ffeb81b2270cabd47a30719c2c6b6a824878925f
SHA512 6aacb1365a1812f6ee402598c5bf5969e25091c5502e4ea07d407776b09ed58fb32f9efabbc07ca0b50035c98636b8bee5b96f01afa4b5f4a89541c4480d4594
SSDEEP 49152:Pc/OpzSXnBOxfAnyv3TnYZVKVC6mE8vN41AboWe:U/iinBOxGIcVjv0AbW
TLSH
T14185339657E09879D2611E3148FFF9343A37CD414827F7EBBB784F3120A2597AE2A814
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12908

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA SetFileAttributesA CompareFileTime SearchPathA CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA Sleep lstrcmpiA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA lstrcatA GetSystemDirectoryA WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc GetCommandLineA GetTempPathA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv MultiByteToWideChar LoadLibraryExA GetModuleHandleA FreeLibrary

user32

SetCursor GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor EndDialog ScreenToClient LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow GetWindowLongA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx SetTimer PostQuitMessage SetWindowLongA SendMessageTimeoutA LoadImageA wsprintfA GetDlgItem FindWindowExA IsWindow SetClipboardData EmptyClipboard OpenClipboard EndPaint CreateDialogParamA DestroyWindow ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ImageList_Destroy ImageList_Create ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/InstallOptions.dll

IMPHASH 738dc9bb91549f627cf1953c2000e1d6
SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
MD5 d753362649aecd60ff434adf171a4e7f
SHA1 3b752ad064e06e21822c8958ae22e9a6bb8cf3d0
SHA512 41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d
SSDEEP 192:3Gs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijnK72dwF7dBEnbok:3GvdH4qMebzPY2Vijn+BEnbo
TLSH
T1F0623B51638888F3DBD6013EB4523707AB595126B4925DE2CB271FCA6D3B18E3EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentDirectoryA MultiByteToWideChar SetCurrentDirectoryA GetPrivateProfileStringA GetPrivateProfileIntA GetModuleHandleA lstrcmpiA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalAlloc GlobalUnlock GlobalLock

user32

GetDlgCtrlID CloseClipboard GetClipboardData MapWindowPoints LoadCursorA GetClientRect SetWindowRgn LoadIconA GetWindowLongA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow SetCursor PtInRect EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA EnableMenuItem DrawTextA GetSystemMenu OpenClipboard LoadImageA

gdi32

SetTextColor DeleteObject CombineRgn CreateRectRgn GetDIBits SelectObject CreateCompatibleDC GetObjectA

shell32

SHGetPathFromIDListA ShellExecuteA SHBrowseForFolderA SHGetDesktopFolder

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/ShellExecAsUser.dll

IMPHASH fb89301642ac2a39aefdd3cc2610ed81
SHA256 27d61cacd2995f498ba971b3b2c53330bc0e9900c9d23e57b2927aadfdee8115
MD5 86a81b9ab7de83aa01024593a03d1872
SHA1 8fd7c645e6e2cb1f1bcb97b3b5f85ce1660b66be
SHA512 cc37bd5d74d185077bdf6c4a974fb29922e3177e2c5971c664f46c057aad1236e6f3f856c5d82f1d677c29896f0e3e71283ef04f886db58abae151cb27c827ac
SSDEEP 96:GFZf6PnleKYcBVGKLyhkrw0qyz/sRXQVgKXohw8FFtkqCp:Gnf6IKTAKLyGOCqQomItQ
TLSH
T167E1097A56D288A1E11E07746A975E7B13AD6A1203B00431CB471FCE2DF5456F42FA4E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

6561

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH f2ac1ab587d5531d5f1bf76c094aef4c
SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
MD5 56a321bd011112ec5d8a32b2f6fd3231
SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
TLSH
T127225C5893E0C1F3D6A0853C18A73A772729712445A18FE3CFA35841AE196D7BC7E336
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

silentkeyloggerfree.exe

IMPHASH 7e3860ab67c070e4a6a48f76fa0e42cd
SHA256 66bc2781bed323d8f68be09c04427f79a2bd80ecc855a782bf398d06c99131f9
MD5 5fa4133b4d07cc5aecf6afe85f045835
SHA1 59202554877fb4bfbb8b01b0da855aabab27fa19
SHA512 fccbf9fd1675ea7d974f71837fb73862ab7a8057a2c2426c4376278691ab0d7457532d78d2bcc55be0a22683d929aad86d41085e9fd491be182fcef07acb8474
SSDEEP 49152:u3Lq+Q4wTAu+BWY2a14MsepwcjeF2QLhY6dKChtmmj+qV4hc84wyCAIjPzBwTW6M:o24I+kYt14MsepwkRUAt
TLSH
T160069DF1BEC059A7C3D30730690EF17832BCAEE45BF9919F63943B086DB529311159AA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

3957056

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Dev\KLKeylogger\keylogger2\SilentKeyloggerFreeVS2015-v199\Release\silentkeyloggerfree.pdb

ulklfemon

?UninstallKeyHook@@YAJXZ ?GetKeyEventResult@@YAJIJPAUtagKeyResultA@@I@Z ?AddKeyEntry@@YAJQAUtagKeyEntry@@@Z ?InstallKeyHook@@YAJXZ

kernel32

FindFirstFileExA SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleCP GetDriveTypeW GetTimeZoneInformation GetStringTypeW LCMapStringW GetTimeFormatW GetDateFormatW GetStdHandle QueryPerformanceFrequency SetEnvironmentVariableA SetStdHandle FreeLibraryAndExitThread ExitThread CreateThread GetCommandLineW GetCommandLineA VirtualQuery VirtualAlloc GetSystemInfo GetModuleHandleExW ExitProcess RtlUnwind OutputDebugStringW IsValidCodePage GetEnvironmentStringsW HeapQueryInformation FreeEnvironmentStringsW InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx ResetEvent SearchPathA GetProfileIntA GetTempFileNameA GetTempPathA GetTickCount VerifyVersionInfoA VerSetConditionMask FindResourceExW GetWindowsDirectoryA GetCurrentDirectoryA SetErrorMode GetFileTime GetFileSizeEx GetFileAttributesExA GetFileAttributesA GetCPInfo GetOEMCP VirtualProtect GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW CompareStringW LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection GlobalFlags GetACP FileTimeToSystemTime SystemTimeToTzSpecificLocalTime FindNextFileA ResumeThread SuspendThread SetThreadPriority CreateEventA SetEvent GetPrivateProfileIntA lstrcmpA GetCurrentThread GetThreadLocale GetVolumeInformationA lstrcmpiA DuplicateHandle UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetFullPathNameA GetFileSize FlushFileBuffers FindFirstFileA FindClose GetCurrentProcessId CompareStringA GlobalGetAtomNameA GlobalFindAtomA GlobalAddAtomA lstrcmpW GlobalDeleteAtom LoadLibraryExW GetSystemDirectoryW GetCurrentThreadId EncodePointer FormatMessageA MulDiv LocalFree GlobalSize FindResourceA LoadLibraryW GetModuleHandleW GetModuleFileNameW FreeResource SetLastError OutputDebugStringA GetVersion DecodePointer RaiseException HeapReAlloc HeapSize GlobalUnlock GlobalLock CopyFileA DeleteFileA MultiByteToWideChar InterlockedExchange InitializeCriticalSectionAndSpinCount EnterCriticalSection LeaveCriticalSection DeleteCriticalSection HeapFree GlobalFree WriteFile CreateFileA GlobalAlloc GetProcessHeap HeapAlloc WritePrivateProfileStringA GetPrivateProfileStringA FreeLibrary LoadLibraryA CreateDirectoryA GetComputerNameA GetCurrentProcess GetModuleHandleA GetVersionExA GetExitCodeProcess WaitForSingleObject Sleep CloseHandle GetLastError CreateMutexA lstrlenA lstrcpyA GetModuleFileNameA GetProcAddress FileTimeToDosDateTime FileTimeToLocalFileTime GetSystemTimeAsFileTime FindResourceW LoadResource LockResource SizeofResource WideCharToMultiByte CreateFileW GetCurrentDirectoryW WriteConsoleW GetFileType

user32

TrackMouseEvent GetAsyncKeyState CopyImage LoadCursorA GetSysColorBrush RealChildWindowFromPoint InflateRect GetMenuItemInfoA DestroyMenu ShowOwnedPopups TranslateMessage GetMessageA MapVirtualKeyA GetKeyNameTextA MapDialogRect SetWindowContextHelpId PostQuitMessage CharUpperA GetWindowThreadProcessId FillRect ClientToScreen TabbedTextOutA GrayStringA DrawTextExA DrawTextA OffsetRect SetRectEmpty IsDialogMessageA SetWindowTextA SendDlgItemMessageA CheckDlgButton SetDlgItemTextA MoveWindow ShowWindow SetMenuItemInfoA GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem GetMonitorInfoA MonitorFromWindow WinHelpA GetScrollInfo SetScrollInfo CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA GetLastActivePopup GetTopWindow GetClassLongA SetWindowLongA EqualRect CopyRect GetSysColor MapWindowPoints AdjustWindowRectEx RemovePropA GetPropA SetPropA ShowScrollBar GetScrollRange InvalidateRect ScrollWindow ValidateRect EndPaint BeginPaint UpdateWindow SetMenu GetMenu GetCapture GetKeyState GetFocus GetDlgCtrlID IsWindowVisible EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement SetWindowRgn SetWindowPos IsChild IsMenu CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA CallWindowProcA DefWindowProcA GetMessageTime GetMessagePos PeekMessageA DispatchMessageA GetWindow GetWindowTextLengthA GetScrollPos SetScrollPos SetFocus RemoveMenu InsertMenuA SetClipboardData EmptyClipboard DrawStateA PostMessageA EnableWindow MessageBoxA LoadBitmapW RegisterWindowMessageA GetMenuItemCount GetMenuState GetMenuStringA GetWindowLongA IsWindowEnabled GetActiveWindow GetNextDlgTabItem GetDlgItem EndDialog CreateDialogIndirectParamA DestroyWindow PostThreadMessageA SendNotifyMessageA GetParent SetActiveWindow RedrawWindow SetParent FindWindowA GetMenuItemID TrackPopupMenu LoadImageW IntersectRect WaitMessage SetCapture ReleaseCapture WindowFromPoint DeleteMenu CharNextA CopyAcceleratorTableA InvalidateRgn SetRect IsRectEmpty GetNextDlgGroupItem MessageBeep CreatePopupMenu GetMenuDefaultItem DrawFocusRect SetForegroundWindow GetCursorPos DrawIconEx GetIconInfo EnableScrollBar HideCaret InvertRect NotifyWinEvent SetLayeredWindowAttributes EnumDisplayMonitors SetScrollRange SetClassLongA SendMessageTimeoutA GetClassNameA EnumChildWindows GetForegroundWindow PtInRect LoadCursorW SetCursor DestroyCursor GetWindowDC GetClientRect LoadIconW GetSystemMenu AppendMenuA SendMessageA SetTimer LoadIconA IsIconic GetSystemMetrics DrawIcon GetWindowTextA KillTimer GetDC ReleaseDC GetWindowRect ScreenToClient SystemParametersInfoA GetDesktopWindow IsClipboardFormatAvailable OpenClipboard GetClipboardData CloseClipboard LoadStringA UnregisterClassA LoadImageA DestroyIcon IsWindow LoadMenuW GetSubMenu SetMenuDefaultItem DrawEdge DrawFrameControl IsZoomed BringWindowToTop SetCursorPos GetWindowRgn CreateMenu SubtractRect TranslateMDISysAccel DefMDIChildProcA DefFrameProcA DrawMenuBar GetUpdateRect CharUpperBuffA ModifyMenuA GetDoubleClickTime LockWindowUpdate DestroyAcceleratorTable CreateAcceleratorTableA LoadAcceleratorsW ToAsciiEx GetKeyboardState MapVirtualKeyExA IsCharLowerA GetKeyboardLayout GetComboBoxInfo MonitorFromPoint UpdateLayeredWindow UnionRect RegisterClipboardFormatA ReuseDDElParam UnpackDDElParam InsertMenuItemA LoadMenuA TranslateAcceleratorA LoadAcceleratorsA FrameRect GetWindowPlacement CopyIcon

gdi32

CreateRectRgn CreateSolidBrush Escape ExcludeClipRect GetClipBox GetObjectType GetPixel GetViewportExtEx GetWindowExtEx IntersectClipRect LineTo PtVisible RectVisible RestoreDC SaveDC SelectClipRgn ExtSelectClipRgn SelectPalette SetBkMode SetMapMode SetLayout GetLayout SetPolyFillMode SetROP2 SetTextAlign MoveToEx ExtTextOutA SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CreateRectRgnIndirect PatBlt CreatePatternBrush GetTextMetricsA CombineRgn GetMapMode SetRectRgn DPtoLP GetBkColor GetTextColor GetRgnBox EnumFontFamiliesExA CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries RealizePalette CreateDIBitmap EnumFontFamiliesA GetTextCharsetInfo SetPixel StretchBlt CreateEllipticRgn Ellipse CreatePolygonRgn Polygon Polyline CreateRoundRectRgn LPtoDP Rectangle OffsetRgn RoundRect FillRgn FrameRgn GetBoundsRect PtInRegion ExtFloodFill SetPaletteEntries SetPixelV GetWindowOrgEx GetViewportOrgEx GetTextFaceA CreateHatchBrush CreateBitmap SetTextColor SetBkColor GetDeviceCaps CopyMetaFileA TextOutA CreateFontIndirectA CreateDIBSection SetDIBColorTable CreateDCA DeleteObject DeleteDC CreateCompatibleBitmap GetDIBits GetObjectA GetStockObject CreatePen BitBlt GetTextExtentPoint32A SelectObject CreateCompatibleDC

msimg32

AlphaBlend TransparentBlt

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

GetUserNameA RegEnumKeyExA RegEnumValueA RegQueryValueA RegEnumKeyA RegDeleteKeyA RegCreateKeyExA RegDeleteValueA RegQueryValueExW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegQueryValueExA RegOpenKeyExA RegCloseKey RegSetValueExA

shell32

DragQueryFileA ShellExecuteExA SHGetFolderPathA SHFileOperationA Shell_NotifyIconA SHAppBarMessage SHGetFileInfoA SHBrowseForFolderA DragFinish ShellExecuteA SHGetDesktopFolder SHGetSpecialFolderLocation SHGetPathFromIDListA

comctl32

InitCommonControlsEx

shlwapi

StrToIntA PathFindExtensionA PathFindExtensionW PathIsUNCA PathStripToRootA PathFindFileNameA StrFormatKBSizeA PathRemoveFileSpecW

uxtheme

GetCurrentThemeName GetThemeSysColor DrawThemeText DrawThemeParentBackground OpenThemeData CloseThemeData DrawThemeBackground GetThemeColor IsAppThemed IsThemeBackgroundPartiallyTransparent GetWindowTheme GetThemePartSize

ole32

OleFlushClipboard OleIsCurrentClipboard DoDragDrop OleGetClipboard CoLockObjectExternal RegisterDragDrop RevokeDragDrop CoRevokeClassObject CoRegisterMessageFilter OleLockRunning OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator OleUninitialize OleInitialize CoFreeUnusedLibraries CreateStreamOnHGlobal CreateILockBytesOnHGlobal StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CoGetClassObject CoDisconnectObject CoCreateInstance CLSIDFromProgID CLSIDFromString CoCreateGuid CoUninitialize ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc CoInitialize CoInitializeEx

oleaut32

VariantChangeType LoadTypeLi SysStringLen SafeArrayDestroy VariantClear VariantCopy VarBstrFromDate OleCreateFontIndirect SysAllocString VariantInit SysAllocStringLen SysAllocStringByteLen SystemTimeToVariantTime SysFreeString VariantTimeToSystemTime

oledlg

ord8

gdiplus

GdipSetInterpolationMode GdipCreateFromHDC GdipCreateBitmapFromStream GdipDrawImageRectI GdipGetImageEncoders GdipCreateBitmapFromHBITMAP GdipSaveImageToFile GdiplusStartup GdipCreateBitmapFromFile GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImagePaletteSize GdipGetImagePalette GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateBitmapFromScan0 GdipCloneImage GdipAlloc GdipFree GdipDisposeImage GdipGetImageGraphicsContext GdipDeleteGraphics GdipDrawImageI GdiplusShutdown GdipGetImageEncodersSize

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

imm32

ImmGetContext ImmGetOpenStatus ImmReleaseContext

winmm

PlaySoundA

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

wccrm46b

Size

328KB

Virtual Size

332KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

23KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

106KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.giats

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

fo6qof8v

Size

102KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

qezmes52

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=25, id=241, version=40116,

count=198, id=243, version=40116,

count=29, id=242, version=40116,

count=2, id=261, version=23013,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=16, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=34, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=24, id=259, version=24123,

count=19, id=260, version=24123,

count=358, id=261, version=24123,

count=3, id=257, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=815, id=1, productName=Unmarked objects,

count=12, id=265, version=24210,

count=1, id=256, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

ulklfemon.dll

IMPHASH bc64a71b6dabd00d0ad71c89c7b24139
SHA256 9768fd324a5bbab21ae793ddacf398e2593578e1a8e46894e8fefba3b676e62b
MD5 bfff87d4246b9a68e04e7d3779b9544b
SHA1 49b717eb2a177c899748848b48534733356d70ee
SHA512 aaf139b631c36f315f1f79776b0a8783c7ce9c966c8b7f9494836b93548fdf473ed9ad4914ff33e860459efafebe74f9a8f483569688e150084b199200ab3a58
SSDEEP 49152:OpjOA3kxS8YwOvVL1LNP6j85Gr18Mrxq:OdOA3N8YTV1LNP6j8Mp8M
TLSH
T184A58D22BEE0857BC16F03314D1EF23C31FDA5230B7981CB67D85B2869306A2665976F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

1289622

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Dev\KLKeylogger\keylogger2\SilentKeyloggerFreeVS2015-v199\Release\ulklfemon.pdb

kernel32

LCMapStringW GetStdHandle GetACP GetModuleFileNameA ExitProcess GetFileType SetStdHandle QueryPerformanceFrequency GetStringTypeW GetSystemInfo HeapQueryInformation GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread GetCommandLineW GetCommandLineA InterlockedFlushSList RtlUnwind OutputDebugStringW GetTimeZoneInformation GetConsoleCP VirtualQuery GetConsoleMode SetFilePointerEx FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent Sleep SearchPathW GetProfileIntW GetTickCount GetTempPathW GetTempFileNameW VerifyVersionInfoW VerSetConditionMask GetWindowsDirectoryW FindResourceExW lstrcpyW VirtualProtect SystemTimeToTzSpecificLocalTime GetFileTime GetFileSizeEx GetFileAttributesExW GetFileAttributesW FileTimeToLocalFileTime FileTimeToSystemTime GlobalGetAtomNameW lstrcmpiW GetCurrentProcess DuplicateHandle WriteFile UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetVolumeInformationW GetFullPathNameW GetFileSize FlushFileBuffers FindFirstFileW FindClose CreateFileW GlobalFindAtomW LoadLibraryA FreeResource DeleteFileW GlobalFlags GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW CompareStringW GetCurrentDirectoryW GetSystemDirectoryW EncodePointer CopyFileW FormatMessageW MulDiv GlobalSize SetErrorMode LocalFree LocalReAlloc LocalAlloc GlobalFree GlobalUnlock GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc LeaveCriticalSection EnterCriticalSection InitializeCriticalSection LoadLibraryW GetModuleHandleA SetLastError OutputDebugStringA GlobalAddAtomW WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GetProcAddress GetModuleHandleW ResumeThread SetThreadPriority CreateEventW SetEvent WideCharToMultiByte MultiByteToWideChar FindResourceW lstrcmpW lstrcmpA GlobalDeleteAtom GlobalLock GlobalAlloc SizeofResource LockResource LoadResource LoadLibraryExW GetModuleFileNameW FreeLibrary GetVersionExW GetCurrentThreadId GetCurrentThread GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc RaiseException CreateMutexA HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount HeapFree GetCurrentProcessId ReleaseMutex WaitForSingleObject CloseHandle VirtualAlloc WriteConsoleW

user32

DrawIconEx IsRectEmpty DrawFocusRect WindowFromPoint ReleaseCapture SetCapture GetNextDlgGroupItem LoadImageW TrackMouseEvent MapDialogRect GetAsyncKeyState GetNextDlgTabItem EndDialog CreateDialogIndirectParamW OffsetRect SetRectEmpty SendDlgItemMessageA IntersectRect InflateRect GetMenuItemInfoW DestroyMenu CharUpperW DestroyIcon LoadCursorW GetSysColorBrush GetSystemMetrics IsDialogMessageW CheckDlgButton MoveWindow ShowWindow GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo LoadIconW GetTopWindow GetClassLongW SetWindowLongW EqualRect CopyRect MapWindowPoints AdjustWindowRectEx GetWindowTextLengthW RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow RedrawWindow SetForegroundWindow SetActiveWindow TrackPopupMenu SetMenu GetMenu GetCapture SetFocus GetDlgItem IsIconic EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement SetWindowPos DestroyWindow IsChild IsMenu CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW GetMessageTime GetMessagePos RegisterWindowMessageW FillRect GetSysColor ScreenToClient EndPaint BeginPaint ReleaseDC GetWindowDC GetDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW InvalidateRect UpdateWindow GetIconInfo MessageBeep EnableScrollBar SetWindowsHookExW UnhookWindowsHookEx PostMessageW CallNextHookEx GetForegroundWindow KillTimer SetTimer RealChildWindowFromPoint GetWindow GetClassNameW GetDesktopWindow PtInRect ClientToScreen GetWindowRect GetWindowTextW SetWindowTextW GetDlgCtrlID DeleteMenu SystemParametersInfoW CopyImage HideCaret InvertRect NotifyWinEvent CreatePopupMenu GetMenuDefaultItem MapVirtualKeyW LoadMenuW SetLayeredWindowAttributes EnumDisplayMonitors SetClassLongW SetWindowRgn SetParent OpenClipboard CloseClipboard SetClipboardData EmptyClipboard DrawStateW DrawEdge DrawFrameControl IsZoomed GetSystemMenu BringWindowToTop ToAscii GetKeyNameTextA ToUnicodeEx GetKeyboardLayout GetWindowThreadProcessId GetKeyNameTextW IsWindow GetKeyState UnregisterClassW PostQuitMessage SendMessageW GetFocus CheckMenuItem EnableMenuItem SetMenuItemBitmaps GetMenuCheckMarkDimensions SetMenuItemInfoW GetParent LoadBitmapW GetMessageW TranslateMessage DispatchMessageW PeekMessageW IsWindowVisible GetActiveWindow ValidateRect GetCursorPos ShowOwnedPopups SetCursor EnableWindow IsWindowEnabled MessageBoxW GetWindowLongW UnpackDDElParam GetLastActivePopup GetMenuStringW GetMenuState GetSubMenu GetMenuItemID GetMenuItemCount InsertMenuW AppendMenuW RemoveMenu GetClientRect ReuseDDElParam GetComboBoxInfo PostThreadMessageW WaitMessage IsCharLowerW MapVirtualKeyExW GetKeyboardState CreateAcceleratorTableW DestroyAcceleratorTable CopyAcceleratorTableW SetRect LockWindowUpdate SetMenuDefaultItem GetDoubleClickTime ModifyMenuW RegisterClipboardFormatW CharUpperBuffW IsClipboardFormatAvailable GetUpdateRect DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel SubtractRect CreateMenu GetWindowRgn DestroyCursor InsertMenuItemW TranslateAcceleratorW LoadAcceleratorsW MonitorFromPoint UpdateLayeredWindow UnionRect DrawIcon FrameRect CopyIcon SetCursorPos

gdi32

GetClipBox GetObjectType GetPixel GetStockObject GetViewportExtEx GetWindowExtEx IntersectClipRect LineTo PtVisible RectVisible RestoreDC SaveDC SelectClipRgn ExtSelectClipRgn SelectObject SelectPalette SetBkColor SetBkMode SetMapMode SetLayout GetLayout SetPolyFillMode SetROP2 SetTextColor SetTextAlign GetObjectW MoveToEx TextOutW ExtTextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CreateFontIndirectW GetTextExtentPoint32W CombineRgn ExcludeClipRect PatBlt SetRectRgn DPtoLP GetTextMetricsW EnumFontFamiliesExW CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries RealizePalette GetBkColor CreateCompatibleBitmap CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo SetPixel StretchBlt CreateDIBSection SetDIBColorTable CreateEllipticRgn Ellipse GetTextColor CreatePolygonRgn Polygon Polyline CreateRoundRectRgn LPtoDP Rectangle GetRgnBox OffsetRgn RoundRect FillRgn FrameRgn GetBoundsRect PtInRegion ExtFloodFill SetPaletteEntries SetPixelV GetWindowOrgEx GetViewportOrgEx GetTextFaceW Escape DeleteDC CreateSolidBrush CreateRectRgn CreatePen CreateHatchBrush CreateCompatibleDC BitBlt DeleteObject GetDeviceCaps CreateDCW CopyMetaFileW CreateRectRgnIndirect CreatePatternBrush CreateBitmap

msimg32

TransparentBlt AlphaBlend

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

advapi32

RegEnumKeyExW RegEnumValueW RegQueryValueW RegEnumKeyW RegSetValueExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

SHGetFileInfoW ShellExecuteW SHGetPathFromIDListW SHAppBarMessage SHBrowseForFolderW DragFinish DragQueryFileW SHGetDesktopFolder SHGetSpecialFolderLocation

shlwapi

PathFindFileNameW PathIsUNCW PathStripToRootW StrFormatKBSizeW PathRemoveFileSpecW PathFindExtensionW

uxtheme

GetCurrentThemeName GetThemeSysColor DrawThemeText DrawThemeParentBackground OpenThemeData CloseThemeData DrawThemeBackground GetThemeColor IsThemeBackgroundPartiallyTransparent GetWindowTheme IsAppThemed GetThemePartSize

ole32

OleLockRunning OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator RevokeDragDrop RegisterDragDrop CoLockObjectExternal OleGetClipboard DoDragDrop CreateStreamOnHGlobal CoDisconnectObject ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc CoInitialize CoCreateInstance CoCreateGuid CoUninitialize CoInitializeEx

oleaut32

VarBstrFromDate VariantCopy VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen LoadTypeLi VariantChangeType VariantClear VariantInit SysAllocStringLen SysFreeString SysAllocString

oleacc

LresultFromObject AccessibleObjectFromWindow CreateStdAccessibleObject

gdiplus

GdipSetInterpolationMode GdipCreateFromHDC GdipDrawImageRectI GdipDrawImageI GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdiplusStartup GdipFree GdipAlloc GdiplusShutdown GdipCreateBitmapFromHBITMAP

imm32

ImmGetContext ImmGetOpenStatus ImmReleaseContext

winmm

PlaySoundW

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

313KB

Virtual Size

313KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.giats

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

SHARED

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

117KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

unukfree.exe

IMPHASH b1a57b635b23ffd553b3fd1e0960b2bd
SHA256 bad07ed1f054dbc26f4216264f90e99bedbef92fd0ddf46f2db02c5e3272babc
MD5 548e555e793773eb8f28b1e884c73105
SHA1 742d4727e4949fdaa5111ad4e2ddc0f30d4bcca3
SHA512 05326ad4df74aaddfb4c4fd8f846188f9a2a0bc29ee54233575b645346c98f6625514c4e94a501720d62962e2a90f72a665d1cc1d485a1139f11e52edc537a9d
SSDEEP 3072:iPA6jXFN2McHqHH75KLs47XsZevYtwwU+FVh0:ihjmSHb5KRX0wuh0
TLSH
T1BAC3E012B3D0CCBBE56D167298BB97A443B1DC15121222972361BF7FEC76392891BB43
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12908

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ImageList_Destroy ImageList_Create ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/InstallOptions.dll

IMPHASH 738dc9bb91549f627cf1953c2000e1d6
SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
MD5 d753362649aecd60ff434adf171a4e7f
SHA1 3b752ad064e06e21822c8958ae22e9a6bb8cf3d0
SHA512 41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d
SSDEEP 192:3Gs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijnK72dwF7dBEnbok:3GvdH4qMebzPY2Vijn+BEnbo
TLSH
T1F0623B51638888F3DBD6013EB4523707AB595126B4925DE2CB271FCA6D3B18E3EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

user32

gdi32

SetTextColor DeleteObject CombineRgn CreateRectRgn GetDIBits SelectObject CreateCompatibleDC GetObjectA

shell32

SHGetPathFromIDListA ShellExecuteA SHBrowseForFolderA SHGetDesktopFolder

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

Sharing

General

Malware Config

Signatures

File Explorer

kl.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/ShellExecAsUser.dll

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

msvcrt

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

silentkeyloggerfree.chm

silentkeyloggerfree.exe

ulklfemon

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

oleacc

imm32

winmm

generic

ulklfemon.dll

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

oleacc

gdiplus

imm32

winmm

generic

unukfree.exe

kernel32