Learning Malware Analysis

1.3.2 Keylogger Using SetWindowsHookEx()

Another common keylogger technique is where it installs a function (called hook procedure) to monitor keyboard events (such as key press). In this method, the malicious program registers a function (hook procedure) that will be notified when a keyboard event is triggered, and that function can log the keystrokes to a file or send them over the network. The malicious program uses the SetWindowsHookEx() API to specify what type of event to monitor (such as the keyboard, mouse, and so on) and the hook procedure that should be notified when a specific type of event occurs. The hook procedure can be contained within a DLL or the current module. In the following screenshot, the malware sample registers a ...