InputSwitch[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

InputSwitch.dll
Size

200KB
MD5

26f01907408d6bf10d151f4cd2d23145
SHA1

3e61c2ddbd256939510f9c64e966174ab5348d2a
SHA256

0f62aedd63cfa616984e92885a92e3cf646490d06747cf2dc56612557a84f581
SHA512

2030843c2c59af5ed895a283ab5d87224dd367d1863ca34282b3d3a6d2d34d4ae366b9df872d2173b743cc1d60cc3f00e5a8438fdc00e14bcf8fbdf3a1d08555
SSDEEP

3072:ia4fv4c6p3tUNf4Y1qKvAbiNRKZ9cp2yNs1LsjF67:34H4c43o+KIGNRKfOYLsp6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
InputSwitch.dll

Files

InputSwitch.dll
.dll windows:6 windows x86 arch:x86

062692ef697f3fec0f8cd7feb4633c34

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

InputSwitch.pdb

Imports

msvcrt

??2@YAPAXI@Z
memcmp
memcpy
__CxxFrameHandler3
_except_handler4_common
_ftol2_sse
??3@YAXPAX@Z
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
free
_amsg_exit
_XcptFilter
_wcsicmp
toupper
islower
__isascii
wcsncmp
_vsnwprintf
_purecall
memset
floor

ntdll

WinSqmIncrementDWORD
WinSqmAddToStream

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-2-0

WaitForMultipleObjectsEx
AcquireSRWLockShared
SetEvent
ReleaseSRWLockShared
TryEnterCriticalSection
CreateEventW
DeleteCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
Sleep
LeaveCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection

api-ms-win-core-winrt-error-l1-1-1

RoOriginateError

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWrite
EventRegister

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-2-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-localization-l1-2-1

FormatMessageW
GetLocaleInfoEx
SetThreadUILanguage
GetThreadUILanguage
GetLocaleInfoW

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-sysinfo-l1-2-1

GetVersionExW
GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW

api-ms-win-core-processthreads-l1-1-2

TlsFree
TlsSetValue
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
OpenThread
TlsAlloc
TlsGetValue
TerminateProcess

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FreeLibrary
FindResourceExW
LoadResource
LockResource
LoadStringW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference
WindowsIsStringEmpty

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegCloseKey
RegGetValueW
RegOpenKeyExW
RegSetValueExW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-heap-obsolete-l1-1-0

LocalAlloc
LocalFree
LocalReAlloc

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

user32

TrackMouseEvent
SetCapture
GetClientRect
SetForegroundWindow
SetRectEmpty
ClientToScreen
GetDC
CreateIconIndirect
PtInRect
ReleaseDC
CreateWindowInBand
GetWindowBand
CopyIcon
SetLayeredWindowAttributes
LoadIconW
GetRawInputDeviceList
CopyImage
RegisterClassW
EndPaint
BeginPaint
DestroyIcon
LoadImageW
GetSystemMetrics
KillTimer
UnhookWindowsHookEx
ReleaseCapture
SetWindowsHookExW
SetTimer
SystemParametersInfoW
GetKeyState
CallNextHookEx
RegisterShellHookWindow
GetThreadDesktop
FindWindowExW
SendMessageW
SetKeyboardState
GetKeyboardState
ScreenToClient
GetMonitorInfoW
MonitorFromRect
MonitorFromWindow
CalculatePopupWindowPosition
GetWindowRect
FindWindowW
DefWindowProcW
DeregisterShellHookWindow
DestroyWindow
PostMessageW
DispatchMessageW
LoadCursorW
SetCursor
TranslateMessage
PostQuitMessage
PeekMessageW
MsgWaitForMultipleObjectsEx
SetThreadDesktop
GetParent
GetMessageW
NotifyWinEvent
GetDesktopWindow
ShowWindow
GetCursorPos
SetWindowPos
RegisterClassExW
CreateWindowExW
GetWindowLongW
SetWindowLongW
RegisterWindowMessageW

imm32

ImmDisableLegacyIME

bcp47langs

Bcp47GetAbbreviation
Bcp47FromLcid
Bcp47GetLanguageName

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

api-ms-win-core-kernel32-legacy-l1-1-1

MulDiv

api-ms-win-core-shlwapi-legacy-l1-1-0

PathAppendW
PathRemoveFileSpecW

kernel32

DelayLoadFailureHook
ResolveDelayLoadedAPI

gdi32

GetLayout
DeleteObject
SetBkColor
GetClipBox
CreateFontIndirectW
ExtTextOutW
GetTextMetricsW
SetTextAlign
GetTextExtentPoint32W
GetDeviceCaps
SetTextColor
SetBkMode
GetDIBits
GetObjectW
CreateDIBSection
SelectObject
CreateCompatibleDC
DeleteDC
GetStockObject

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 119KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

062692ef697f3fec0f8cd7feb4633c34

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

user32

imm32

bcp47langs

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-shlwapi-legacy-l1-1-0

kernel32

gdi32

Exports

Exports

Sections

.text Size: 119KB - Virtual size: 118KB

.data Size: 1KB - Virtual size: 1KB

.idata Size: 6KB - Virtual size: 6KB

.didat Size: 1024B - Virtual size: 980B

.rsrc Size: 63KB - Virtual size: 63KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 119KB - Virtual size: 118KB

.data
Size: 1KB - Virtual size: 1KB

.idata
Size: 6KB - Virtual size: 6KB

.didat
Size: 1024B - Virtual size: 980B

.rsrc
Size: 63KB - Virtual size: 63KB

.reloc
Size: 8KB - Virtual size: 7KB