keylogger[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
keylogger.exe
Size 317KB
Sample260831-bwdehatakd
SHA256 a890c00cb78ff60c0d77dffe30ab14061fd07b45ecdab28465729fb9c64598c7
MD5 fb594b36b01f44860c5fe631692150fa
SHA1 f7f1c81344fa08c5c660e4fe70163a76e4f4da8b
SHA512 6d7db5472512cfe705df03c9317f3d9a208a0fd574a77b60d95ff84b6b4378827343cb59192c5c40571c23556839b9f9a6c1ff7f4c4f2cb45be30228214a19bf
SSDEEP 6144:Rl0gzF/kHPh9IWX6MaQIZfq3OS5fX2Kem+qoojN:fKbI+1ofQR5vVj
TLSH
T1F8648D25F3A810FAE667917CC9424506EA72BC5247A1EBCF13904A973F237E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
keylogger.exe

File Explorer

keylogger.exe

.exe 317KB

keylogger.exe

IMPHASH 55b437528e17daea570dfd6973057f32
SHA256 a890c00cb78ff60c0d77dffe30ab14061fd07b45ecdab28465729fb9c64598c7
MD5 fb594b36b01f44860c5fe631692150fa
SHA1 f7f1c81344fa08c5c660e4fe70163a76e4f4da8b
SHA512 6d7db5472512cfe705df03c9317f3d9a208a0fd574a77b60d95ff84b6b4378827343cb59192c5c40571c23556839b9f9a6c1ff7f4c4f2cb45be30228214a19bf
SSDEEP 6144:Rl0gzF/kHPh9IWX6MaQIZfq3OS5fX2Kem+qoojN:fKbI+1ofQR5vVj
TLSH
T1F8648D25F3A810FAE667917CC9424506EA72BC5247A1EBCF13904A973F237E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

58320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\jay28\Downloads\New folder\bin\x64\Release\keylogger.pdb

user32

GetMessageW TranslateMessage DispatchMessageW ShowWindow GetKeyboardState ToAsciiEx SetWindowsHookExW GetKeyboardLayout CallNextHookEx UnhookWindowsHookEx

winhttp

WinHttpConnect WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpCloseHandle WinHttpOpen

kernel32

CreateFileW ReadConsoleW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindNextFileW FindFirstFileExW FindClose HeapSize HeapReAlloc GetOEMCP GetACP GetVersionExA GetModuleHandleW GetComputerNameA GetConsoleWindow IsValidCodePage WriteConsoleW SetEndOfFile GetTimeZoneInformation RtlLookupFunctionEntry QueryPerformanceCounter QueryPerformanceFrequency CloseHandle GetLastError WaitForSingleObjectEx Sleep GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WakeAllConditionVariable EncodePointer DecodePointer LCMapStringEx GetCPInfo GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlPcToFileHeader RaiseException RtlUnwind RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetProcAddress GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW

advapi32

GetUserNameA

shell32

SHGetFolderPathW

iphlpapi

GetAdaptersInfo

Name

.text

Size

212KB

Virtual Size

212KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

keylogger.exe

user32

winhttp

kernel32

advapi32

shell32

iphlpapi

generic