InputSwitch[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

InputSwitch.dll
Size

253KB
MD5

e60e47957fb27b2231419b1f413c474c
SHA1

afd8214cd303dba5619ee36ba0c86be2ef744bff
SHA256

2ca5785f7f8655b384d47e7ae1bb678589f070303747bf418c24baf0f49953fd
SHA512

4c41f91940133eb0f372d435fd8cf34c19c4469f015bd1f1598dfee070b1d3291cf33b51e159a348df3ba2a5aef185e87d777f1eeecd23e710e34d4ee522b4fb
SSDEEP

3072:6J+exBm223ygvJNdSNdEQnM80NHqTkNdgC4OkHRS4YxkyF/eUD1vO12F/o9td9dL:6txb2CEQnZ0N8bUkxMxkyLloLsp6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
InputSwitch.dll

Files

InputSwitch.dll
.dll windows:6 windows x64 arch:x64

3e0b9a89ee9b294729cbda4f1acb4498

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

InputSwitch.pdb

Imports

msvcrt

__dllonexit
_unlock
_lock
_onexit
memcpy
??2@YAPEAX_K@Z
__CxxFrameHandler3
memset
??3@YAXPEAX@Z
_initterm
malloc
free
_amsg_exit
_XcptFilter
_wcsicmp
toupper
islower
__isascii
wcsncmp
_vsnwprintf
_purecall
__C_specific_handler
floorf

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
WinSqmAddToStream
WinSqmIncrementDWORD
RtlVirtualUnwind

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-2-0

AcquireSRWLockShared
WaitForMultipleObjectsEx
InitializeCriticalSectionEx
ReleaseSRWLockShared
ReleaseSRWLockExclusive
SetEvent
CreateEventW
TryEnterCriticalSection
LeaveCriticalSection
Sleep
DeleteCriticalSection
AcquireSRWLockExclusive
EnterCriticalSection

api-ms-win-core-winrt-error-l1-1-1

RoOriginateError

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWrite
EventRegister

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-2-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-localization-l1-2-1

FormatMessageW
GetLocaleInfoEx
GetLocaleInfoW
GetThreadUILanguage
SetThreadUILanguage

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-sysinfo-l1-2-1

GetVersionExW
GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
GetCurrentProcess
TlsFree
GetCurrentThreadId
TlsGetValue
OpenThread
TlsAlloc
GetCurrentProcessId
TlsSetValue

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FindResourceExW
LoadResource
LockResource
LoadStringW
FreeLibrary

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsIsStringEmpty
WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegCreateKeyExW
RegGetValueW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-heap-obsolete-l1-1-0

LocalAlloc
LocalFree
LocalReAlloc

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

user32

TrackMouseEvent
SetCapture
GetClientRect
SetForegroundWindow
SetRectEmpty
ClientToScreen
GetDC
CreateIconIndirect
PtInRect
ReleaseDC
CreateWindowInBand
GetWindowBand
CopyIcon
SetLayeredWindowAttributes
LoadIconW
GetRawInputDeviceList
CopyImage
RegisterClassW
EndPaint
BeginPaint
DestroyIcon
LoadImageW
GetSystemMetrics
KillTimer
UnhookWindowsHookEx
ReleaseCapture
SetWindowsHookExW
SetTimer
SystemParametersInfoW
GetKeyState
CallNextHookEx
RegisterShellHookWindow
GetThreadDesktop
RegisterWindowMessageW
FindWindowExW
SetKeyboardState
GetKeyboardState
ScreenToClient
GetMonitorInfoW
MonitorFromRect
MonitorFromWindow
CalculatePopupWindowPosition
GetWindowRect
FindWindowW
DefWindowProcW
SetWindowLongPtrW
GetWindowLongPtrW
CreateWindowExW
DeregisterShellHookWindow
DestroyWindow
PostMessageW
DispatchMessageW
LoadCursorW
SetCursor
TranslateMessage
PostQuitMessage
PeekMessageW
MsgWaitForMultipleObjectsEx
SetThreadDesktop
GetParent
GetMessageW
NotifyWinEvent
GetDesktopWindow
ShowWindow
GetCursorPos
SetWindowPos
RegisterClassExW
SendMessageW

imm32

ImmDisableLegacyIME

bcp47langs

Bcp47GetLanguageName
Bcp47GetAbbreviation
Bcp47FromLcid

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

api-ms-win-core-kernel32-legacy-l1-1-1

MulDiv

api-ms-win-core-shlwapi-legacy-l1-1-0

PathRemoveFileSpecW
PathAppendW

kernel32

DelayLoadFailureHook
ResolveDelayLoadedAPI

gdi32

DeleteObject
SetBkColor
GetClipBox
CreateFontIndirectW
ExtTextOutW
GetTextMetricsW
SetTextAlign
GetTextExtentPoint32W
SetTextColor
SetBkMode
GetDIBits
GetDeviceCaps
GetLayout
GetObjectW
CreateDIBSection
SelectObject
CreateCompatibleDC
DeleteDC
GetStockObject

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 163KB - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3e0b9a89ee9b294729cbda4f1acb4498

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

user32

imm32

bcp47langs

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-shlwapi-legacy-l1-1-0

kernel32

gdi32

Exports

Exports

Sections

.text Size: 163KB - Virtual size: 162KB

.data Size: 2KB - Virtual size: 1KB

.pdata Size: 11KB - Virtual size: 10KB

.idata Size: 8KB - Virtual size: 8KB

.didat Size: 2KB - Virtual size: 1KB

.rsrc Size: 63KB - Virtual size: 63KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 163KB - Virtual size: 162KB

.data
Size: 2KB - Virtual size: 1KB

.pdata
Size: 11KB - Virtual size: 10KB

.idata
Size: 8KB - Virtual size: 8KB

.didat
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 63KB - Virtual size: 63KB

.reloc
Size: 2KB - Virtual size: 1KB