Static task
static1
Behavioral task
behavioral1
Sample
InputSwitchToastHandler.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
InputSwitchToastHandler.exe
Resource
win10v2004-20230703-en
General
-
Target
InputSwitchToastHandler.exe
-
Size
84KB
-
MD5
281be84f0d4f7aac6a965bc84f2601ed
-
SHA1
075d9814a3793c7fe532260a8f554377bc6113ed
-
SHA256
c7894fd7d612033d69d0cefe679614a0cc4f45c07aa4b081ed5791af20e6ef00
-
SHA512
7b83b170d7b913bea4a6fce59623828e2151f99600ddaf9e90b660d586ded27c70facea1d434c829d4d4450d693015db5ddc8812f5abc20271c8eb473415c72e
-
SSDEEP
1536:4C/E3o69UzCfOUhEq/EHbYvEeVkB8cITVovb/E4DLi:V/EdXfOUhV/gYvUCT5eLE4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource InputSwitchToastHandler.exe
Files
-
InputSwitchToastHandler.exe.exe windows x64
e1d88f4b1d4c6dae79adfcf44df28c32
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configthreadlocale
_o__configure_wide_argv
_o__crt_atexit
_o__errno
_o__exit
_o__get_initial_wide_environment
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
memcpy
_o__wcsicmp
_o_exit
_o_free
_o_malloc
_o_terminate
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o___p___wargv
_o___p___argc
__CxxFrameHandler4
api-ms-win-crt-string-l1-1-0
wcscmp
memset
api-ms-win-core-com-l1-1-0
CoResumeClassObjects
CoRevokeClassObject
CoAddRefServerProcess
CoReleaseServerProcess
CoCreateInstance
CoRegisterClassObject
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsGetStringRawBuffer
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-1-0
WaitForSingleObjectEx
CreateSemaphoreExW
OpenSemaphoreW
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
CreateEventW
ReleaseSRWLockShared
CreateMutexExW
AcquireSRWLockShared
ReleaseSRWLockExclusive
SetEvent
AcquireSRWLockExclusive
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoRevokeActivationFactories
RoInitialize
RoRegisterActivationFactories
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoOriginateErrorW
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer
EventActivityIdControl
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
CreateProcessW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemDirectoryW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
Sections
.text Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ