AltTab[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

AltTab.dll
Size

115KB
MD5

1865b70e12f45529f2856782ca8e0481
SHA1

80f5cd35364018748e4a2e5a48de17d669efc248
SHA256

8f3965403dd8de325dae598146559164b9079e923a195303a7b0266203c3d90a
SHA512

32edca77a1788cf51dc302cbda476537d74dc8becd6e7d7f667e9409aacd2aa3bf4738e8babd7d9ec161262a3cc6e5c30064e6a37ec672a8ed9df89fdd69c667
SSDEEP

1536:0XlRdXPg1SQBl3GrDkjXENpsvA2APyJ9IbJfqiFIiEqF9MbcuyJZn2ysDkoqfPUJ:0f9gfjcDkVAgu1qihZNLZ2bCs1v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AltTab.dll

Files

AltTab.dll
.dll windows:6 windows x64 arch:x64

e81e36f88ca9fb4c506838dd41dbea86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

AltTab.pdb

Imports

msvcrt

??_V@YAXPEAX@Z
??2@YAPEAX_K@Z
_purecall
_XcptFilter
free
malloc
_initterm
__C_specific_handler
memset
_set_errno
_get_errno
__CxxFrameHandler3
wcstol
_vsnwprintf
??3@YAXPEAX@Z
cosf
_amsg_exit
memcmp
sinf

ntdll

EtwEventRegister
WinSqmIncrementDWORD
EtwEventWrite
EtwEventUnregister
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-synch-l1-2-0

Sleep
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection

api-ms-win-core-heap-l1-2-0

HeapDestroy

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter

propsys

PropVariantToFileTime

kernel32

ResolveDelayLoadedAPI
GetProcAddress
DelayLoadFailureHook
GetLocaleInfoW
GetThreadUILanguage
ResetEvent
CreateEventW
GetLastError
SetThreadPriority
GetCurrentThread
CreateMutexW
ReleaseMutex
CloseHandle
GlobalAddAtomW
GetModuleHandleW
MulDiv
CreateTimerQueueTimer
DeleteTimerQueueTimer
SetEvent
CreateEventExW
GetModuleHandleExW
TrySubmitThreadpoolCallback
FreeLibrary
CreateThread
WaitForSingleObject
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CallbackMayRunLong
FreeLibraryWhenCallbackReturns
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
FreeLibraryAndExitThread
TlsSetValue
OpenSemaphoreW
ReleaseSemaphore
TlsAlloc
CreateSemaphoreW
TlsFree
TlsGetValue
QueryPerformanceFrequency
OpenEventW
CompareFileTime
IsDebuggerPresent
LocalFree
LoadLibraryExW
LocalAlloc
LocalReAlloc
OpenProcess
DuplicateHandle

api-ms-win-core-com-l1-1-1

CoTaskMemFree
CoGetMalloc
CoDisableCallCancellation
CoCancelCall
CoEnableCallCancellation
CoTaskMemAlloc
CoUninitialize
CoTaskMemRealloc
CoInitializeEx
CoWaitForMultipleHandles
RoGetAgileReference
CoGetApartmentType
PropVariantClear
CoCreateInstance

api-ms-win-core-libraryloader-l1-2-0

LoadStringW

ole32

CoRegisterInitializeSpy
CoAllowSetForegroundWindow
CoRevokeInitializeSpy

comctl32

ord392
ord386
ord324
ord323
ord321
ord320
ord336
ord332
ord331
ord329
ord328
ord339
ord334
ImageList_CoCreateInstance

shlwapi

ord611
SHGetValueW
ord197
StrCmpW
ord176
ord219
SHSetThreadRef
SHCreateThreadRef
SHGetThreadRef
ord16
ord199

dwmapi

ord124
ord138
DwmUnregisterThumbnail
DwmUpdateThumbnailProperties
ord140
DwmQueryThumbnailSourceSize
DwmRegisterThumbnail
ord113
DwmSetWindowAttribute
DwmIsCompositionEnabled
DwmEnableBlurBehindWindow

gdi32

CreateDIBSection
DeleteObject
SelectObject
GetObjectW
DeleteDC
GdiAlphaBlend
CreateRectRgn
CreateCompatibleDC
StretchDIBits
GetStockObject
CreateFontIndirectW

user32

SendMessageCallbackW
InternalGetWindowText
SwitchToThisWindow
PostMessageW
FindWindowW
DestroyIcon
GetDesktopWindow
ClientToScreen
RemovePropW
SetPropW
SetWindowCompositionAttribute
GetShellWindow
UpdateLayeredWindow
HungWindowFromGhostWindow
GetWindowBand
IsWindowEnabled
GhostWindowFromHungWindow
SetForegroundWindow
MonitorFromPoint
GetMonitorInfoW
SetTimer
MonitorFromWindow
GetKeyState
ReleaseCapture
GetCapture
ShowWindow
NotifyWinEvent
GetFocus
GetForegroundWindow
SetFocus
GetAsyncKeyState
SystemParametersInfoW
GetClassLongPtrW
UpdateWindow
SetCapture
LoadCursorW
SetCursor
GetSysColor
GetClientRect
InvalidateRect
GetWindowLongW
SetWindowLongW
SetLayeredWindowAttributes
SetWindowPos
ScreenToClient
LoadIconW
GetParent
IsIconic
GetWindowRgnBox
GetWindowThreadProcessId
ord2521
GetCursorPos
EndPaint
BeginPaint
GetUpdateRect
GetWindow
SendMessageW
CreateWindowInBand
UnregisterClassW
SetRectEmpty
EnumWindows
GetWindowRect
IsWindowVisible
GetPropW
ReleaseDC
GetDC
CopyRect
PeekMessageW
MsgWaitForMultipleObjectsEx
PostThreadMessageW
OffsetRect
IsRectEmpty
InflateRect
KillTimer
OpenInputDesktop
GetSystemMetrics
SetThreadDesktop
CloseDesktop
GetMessageW
TranslateMessage
DispatchMessageW
SetWinEventHook
UnhookWinEvent
RegisterClassW
CreateWindowExW
GetWindowLongPtrW
DestroyWindow
SetWindowLongPtrW
DefWindowProcW
GetCurrentInputMessageSource
RegisterHotKey
UnregisterHotKey
IsWindow
PtInRect

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 548B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e81e36f88ca9fb4c506838dd41dbea86

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

propsys

kernel32

api-ms-win-core-com-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

ole32

comctl32

shlwapi

dwmapi

gdi32

user32

Exports

Exports

Sections

.text Size: 88KB - Virtual size: 88KB

.data Size: 2KB - Virtual size: 2KB

.pdata Size: 8KB - Virtual size: 8KB

.idata Size: 9KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 216B

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 1024B - Virtual size: 548B

.text
Size: 88KB - Virtual size: 88KB

.data
Size: 2KB - Virtual size: 2KB

.pdata
Size: 8KB - Virtual size: 8KB

.idata
Size: 9KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 216B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 1024B - Virtual size: 548B