Can benign applications have such APIs?

Question

I am new to malware analysis .. and I was analyzing some 'windows' apps and found functions that I thought it exist only on malware, is this possible or there is something wrong with my analysis ? I am using Cuckoo sandbox .. the functions are: SetWindowsHookExA, IsDebuggerPresent .. and others as well

One of the app examples is AcroRd32.exe: It calls IsDebuggerPresent .. and this is its page on virustotal including all the information related to the sample in addition to the MD5. https://www.virustotal.com/en/file/9e702e7b53f6f00e344a1cb42c63eaf4d52ed4adb5407744a654753569044555/analysis/

Answer 1

IsDebuggerPresent is found in most executables compiled with Visual C++ in the setup code that is executed before the main function. There are also legitimate use cases for SetWindowsHookExA, so you will often see them in clean executables.

Answer 2

Yeah, there are definitely legitimate use cases for both IsDebuggerPresent and SetWindowsHookExA common windows functions.

I propose you a simple experiment you can try, take this little legitimate c++ snippet of mine:

#include <stdio.h>
#include <stdlib.h>
#include <windows.h>

void main(int argc, char* argv[]) {
    printf("Hello world\n");
    while(true) {
        printf("Debugger present: %d\n", IsDebuggerPresent());
        Sleep(200);
    }
    system("pause");
}

Build it with your favourite c++ windows compiler and run it. Now, take your favourite debugger, I recommend you x64dbg and try this:

• Attach and detach to the running process to see how IsDebuggerPresent changes
• Once it's attached, try to hide the debugger

By doing so, you'll understand the very basics about IsDebuggerPresents.

About SetWindowsHookExA, I've seen it used on legit apps countless times so I can guarantee you is definitely not a microsoft function whose purpose is to be used on "naughty" apps :)