KeyboardLayoutManager[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

KeyboardLayoutManager.dll
Size

10KB
MD5

7bc6bc893e3228db583599494751b8ab
SHA1

bc59083ffa952e23d7fb6211366bc64e6a8fec1d
SHA256

09d2b516c6803c2d72e73a85bd0a970f0f9a1a55407e075142ceea9cf565d46b
SHA512

0e3f3815ab9a566e8ce75c6d56b61887580c9af84e1daa61668e24fb97380d3f531c8b8d8fa813de1961eccd4d007cfbbe80d47d5ac0df7fde1d004f6034a61f
SSDEEP

192:GAnDxyTzyk/WZbNxtvEMkpg8KQXQqNpVpjzzxwAaOa3Xy6RkqWpEfjST:hDx0zo/J2lKAQYvwzOWC6aS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KeyboardLayoutManager.dll

Files

KeyboardLayoutManager.dll
.dll windows:4 windows x86 arch:x86

060a20b1cee35b6cbc17f0a532e2f356

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Documents and Settings\Administrator\桌面\TinyFire\Release\KeyboardLayoutManager.pdb

Imports

kernel32

GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
QueryPerformanceCounter

user32

ActivateKeyboardLayout
LoadKeyboardLayoutA

advapi32

RegOpenKeyA
RegCloseKey
RegQueryValueExA

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z

msvcr80

_lock
_onexit
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_except_handler4_common
__dllonexit
_malloc_crt
_encode_pointer
vsprintf_s
_vscprintf
memmove_s
memcpy_s
??3@YAXPAX@Z
_unlock
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
free
_encoded_null
_decode_pointer
_initterm
_CxxThrowException

Exports

Exports

ChangeInputMethod

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 676B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

060a20b1cee35b6cbc17f0a532e2f356

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

msvcp80

msvcr80

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 968B

.rsrc Size: 512B - Virtual size: 428B

.reloc Size: 1024B - Virtual size: 676B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 968B

.rsrc
Size: 512B - Virtual size: 428B

.reloc
Size: 1024B - Virtual size: 676B