769b1629c402abdf7e912469d40f7c6d Stealer Keylogger Analysis
| Online Virus Checker | v.1.0.156.174 |
| DB Version: | 2024-01-26 08:02:44 |
Spy.Win32.Keylogger.cld
Keylogger is designed to secretly record keystrokes on a computer or mobile device, capturing everything a user types, including sensitive information like passwords and credit card numbers. It can be used by cybercriminals to steal personal and confidential data without the user's knowledge or consent.
| File | 769b1629c402abdf7e912469d40f7c6d |
| Checked | 2024-01-26 06:19:54 |
| MD5 | 769b1629c402abdf7e912469d40f7c6d |
| SHA1 | 7317fadb3d4bf45b7942db433e9474aef5945caa |
| SHA256 | 0af67910b3d4fb47a7e669456821116cf31ccf78bb1dc1e1e6cc5895adb4ecfb |
| SHA512 | 852709253494a7c7023e6fae4c9d0d79cbfb26b1f3ea7a16dc84b300bba6ce4c24247df79a531e1bc9a672884db83aec2d837a2f541bdee0aaf56a6ae651857c |
| Imphash | f9e81afd2870aaecd8ace36b2893b1d3 |
| File Size | 1400320 bytes |
Spy.Win32.Keylogger.cld Removal
Gridinsoft has the capability to identify and eliminate Spy.Win32.Keylogger.cld without requiring further user intervention.
- Start by downloading Gridinsoft Anti-Malware to your computer.
- Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
- Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
- Click on the "Standard Scan" button.
- After the scanning process is finished, click on "Clean Now" to remove any detected threats.
- If prompted, restart your system to complete the removal process.
Portable Executable Info
| Image Base: | 0x00400000 |
| Entry Point: | 0x0052b9ac |
| Compilation: | 2021-08-25 08:08:10 |
| Checksum: | 0x00000000 (Actual: 0x0015be1a) |
| OS Version: | 5.0 |
| PEiD: | PE32 executable (DLL) (GUI) Intel 80386, for MS Windows |
| Sign: | The PE file does not contain a certificate table. |
| Sections: | 10 |
| Imports: | oleaut32, advapi32, user32, kernel32, gdi32, version, netapi32, msvcrt, |
| Exports: | 3 |
| Resources: | 15 |
Sections
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Entropy |
|---|---|---|---|---|---|
| .text | 0x00001000 | 0x001293dc | 0x00129400 | 23d5571dbf4e04dbd21c6501e92bfe67 | 6.52 |
| .itext | 0x0012b000 | 0x000009f8 | 0x00000a00 | d21a5217895e5202205b638aa1bb134c | 6.37 |
| .data | 0x0012c000 | 0x00007f10 | 0x00008000 | 98bee6780438551b9890d7377849d7ba | 6.23 |
| .bss | 0x00134000 | 0x00005ea0 | 0x00000000 | d41d8cd98f00b204e9800998ecf8427e | 0.00 |
| .idata | 0x0013a000 | 0x000019be | 0x00001a00 | 112b2f79058373e36e96c11aa59381ae | 5.08 |
| .didata | 0x0013c000 | 0x000002da | 0x00000400 | f28c265f7a6f1c30decd46ace97b19b8 | 2.69 |
| .edata | 0x0013d000 | 0x00000096 | 0x00000200 | 45cbdd719c3e37d2cc920f1c79c130a5 | 1.81 |
| .rdata | 0x0013e000 | 0x00000044 | 0x00000200 | c9f8bfa36b2dc5163b75d3196d251b45 | 1.17 |
| .reloc | 0x0013f000 | 0x0001e808 | 0x0001ea00 | e870cea089363bb753155274c814e675 | 6.77 |
| .rsrc | 0x0015e000 | 0x00003000 | 0x00003000 | 61507bbb66b88d03faf4fa60bb1bae92 | 3.61 |
