LAB-02Easy

Suspicious API Identification

A binary's import table reveals its capability. Identify which imported APIs indicate keystroke-capture behavior.

15 min3 prerequisites5 tools

Investigate

Hints

Hint 1

Keyloggers use one of two techniques: a global hook, or polling key state in a loop.

Hint 2

Look for APIs that operate on windows, input, or keyboard state.

Hint 3

GetForegroundWindow is often paired with keylogging to know which window/app the keystrokes belong to.

Submit Findings

Solution

Suspicious API Identification — Solution

The import table tells a clear story:

USER32.dll — the DLL that owns window/input APIs; the specific functions matter.
SetWindowsHookExA — installs a system-wide hook that can intercept every keystroke before it reaches its target window.
GetAsyncKeyState — an alternative technique: poll the state of any key at any time, without a hook at all.
GetForegroundWindow — commonly paired with either technique to tag captured keystrokes with the application that was focused when they were typed.

The keylogging cluster is unmistakable:

SetWindowsHookExA   → install a global keyboard hook
  -- or --
GetAsyncKeyState    → poll key state in a loop

GetForegroundWindow  → attribute captured keys to the active window

Seeing these together — a capture technique plus window context — is a strong indicator of keystroke-logging capability.

Prerequisites

f4-executable-formats
PE import table structure (IAT, INT)
Common Windows APIs for input/window manipulation

Methodology

Investigation Methodology

1. Parse the Import Table

Open the binary in Ghidra or a PE viewer (PE-bear, CFF Explorer)
Navigate to the Import Directory (Data Directory [1])
Enumerate all imported DLLs and their functions

2. Categorize Imports by Capability

Group imports into functional categories:

Input Capture: SetWindowsHookExA/W, GetAsyncKeyState, GetKeyState, GetKeyboardState
Window Context: GetForegroundWindow, GetWindowTextA/W, GetClassNameA/W
Process/Memory Manipulation: VirtualAllocEx, WriteProcessMemory, CreateRemoteThread
Persistence: RegSetValueEx, CreateService, WriteFile (startup folders)
Network: InternetOpen, HttpSendRequest, WSASocket, connect

3. Identify Suspicious Clusters

Single suspicious API = weak signal (legitimate apps use them too — accessibility tools, IMEs)
Cluster of 2-3 related APIs = strong indicator of specific capability
Keystroke-capture cluster: SetWindowsHookExA (install a WH_KEYBOARD_LL hook) or a tight loop calling GetAsyncKeyState, usually paired with GetForegroundWindow to log which application had focus

4. Assess Intent

Legitimate use: accessibility software, hotkey managers, game overlays
Malicious use: credential theft, session recording
Context matters: is the binary signed? Does it register a visible window, or run headless?

5. Document Findings

List each suspicious API with DLL
Explain the capability it enables
Note whether the hook or polling technique is used

Common Pitfalls

Flagging `GetForegroundWindow` alone without considering context (used by countless legitimate apps)
Missing that `SetWindowsHookExA` needs a hook type argument (`WH_KEYBOARD_LL` = 13) to actually capture keys — the import alone only shows capability, not confirmed behavior
Confusing `GetAsyncKeyState` (polls current key state, works globally) with `GetKeyState` (only valid after a key message, not global)
Assuming keylogging requires kernel-mode code — the classic technique is entirely user-mode via USER32.dll

Tools

Ghidra (Imports window)
PE-bear / CFF Explorer (Import Table tab)
dumpbin /imports (Visual Studio)
pefile (Python)
Built-in Hex Viewer (manual parsing)

References

Lesson F4: Executable Formats — Import Address Table deep dive
Microsoft Docs: SetWindowsHookEx / Keyboard Input
MITRE ATT&CK: T1056.001 — Input Capture: Keylogging
Windows Internals: Message Loop & Hooks

Extensions & Challenges

Analyze a real malware sample's imports (e.g., from MalwareBazaar) for input-capture APIs
Build a YARA rule that detects the `SetWindowsHookEx` + `GetAsyncKeyState` combination
Research: How does a WH_KEYBOARD_LL hook differ from WH_KEYBOARD?
Compare: Hook-based vs. polling-based keylogging — which is easier to detect dynamically?