TextInputMethodFormatter[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

TextInputMethodFormatter.dll
Size

1.5MB
MD5

9687df48caccd06b1708a47af89e5692
SHA1

a2f1e2ec9bab6c1c5c0d61a4987a60c0403bc928
SHA256

3ef8f440bb408d78faadaaccf677657d7ba271abfbe50794d6948e160c6620c9
SHA512

2965c4d6cbc6a2b9b02b643657fb7d31cd594066903e274eb817558eba6167c571bac370fdb3aa0ed5c655c618cf3f95aae414cd4b0a390aad35e47b5c0357f6
SSDEEP

24576:CV71Re1PfnUTeqsQRbs2VeTKufyHfvzUfUEMl8eXKCMTrurhf5Y1Hnwn3+o0H8pJ:Cd1AlnUSqdukvzUfUEFC3+qwSsifOcH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TextInputMethodFormatter.dll

Files

TextInputMethodFormatter.dll
.dll windows:10 windows x86 arch:x86

b9c73a2f9a70dd7fbd4eb6ba8d7df1d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

TextInputMethodFormatter.pdb

Imports

msvcrt

_unlock
_lock
memmove
memcpy
_CxxThrowException
??0exception@@QAE@ABQBDH@Z
_ismbblead
_callnewh
localeconv
strncmp
malloc
sprintf
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
memset
?what@exception@@UBEPBDXZ
__pctype_func
isupper
calloc
islower
realloc
ldexp
free
setlocale
sprintf_s
___lc_codepage_func
strcspn
__uncaught_exception
??3@YAXPAX@Z
__mb_cur_max
vfprintf
_errno
??8type_info@@QBEHABV0@@Z
__iob_func
__crtCompareStringW
__crtCompareStringA
__crtLCMapStringW
__crtLCMapStringA
_wsetlocale
abort
_Getdays
_Getmonths
_W_Getdays
memmove_s
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
_W_Getmonths
_W_Gettnames
??1exception@@UAE@XZ
_purecall
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
memcpy_s
___lc_handle_func
isdigit
isalnum
_wcsdup
memcmp
___lc_collate_cp_func
_vsnwprintf
memchr
tolower
isspace
??_V@YAXPAX@Z
__CxxFrameHandler3
___mb_cur_max_func
_Strftime
_Gettnames
_Wcsftime

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW
SetEvent
CreateEventW
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
WaitForMultipleObjectsEx
ReleaseSRWLockShared
AcquireSRWLockShared
ResetEvent
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
DeleteCriticalSection
AcquireSRWLockExclusive
LeaveCriticalSection
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
EnterCriticalSection

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapReAlloc
HeapSize
HeapAlloc
HeapFree
HeapDestroy

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentProcessId
CreateThread
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-errorhandling-l1-1-3

TerminateProcessOnMemoryExhaustion

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-string-l1-1-0

GetStringTypeW
WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

coremessaging

MsgRelease
CoreUICreate
MsgStringCreateShared

coreuicomponents

CoreUIFactoryCreate
CoreUIClientCreate

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-file-l1-1-0

ReadFile
WriteFile

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-io-l1-1-0

GetOverlappedResult

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

??0TextInputMethodFormatter@@QAE@XZ
??1TextInputMethodFormatter@@QAE@XZ
?ConnectToHost@TextInputMethodFormatter@@IAEJXZ
?DataReceived@TextInputMethodFormatter@@UAEJIAAV?$vector@DV?$allocator@D@std@@@std@@@Z
?GetCIVMSender@TextInputMethodFormatter@@UAEJPAPAUIRemoteCoreInputViewManager@@@Z
?GetCIVSender@TextInputMethodFormatter@@UAEJPAPAUIRemoteCoreInputView@@@Z
?GetIsHost@TextInputMethodFormatter@@UAE_NXZ
?GetTICImpl@TextInputMethodFormatter@@UAEJPAPAUIRemoteTextInputClient@@@Z
?GetTISImpl@TextInputMethodFormatter@@UAEJPAPAUIRemoteTextInputServer@@@Z
?GetTVIImpl@TextInputMethodFormatter@@UAEJPAPAUITextVirtualizationInternal@@@Z
?GetTVKRImpl@TextInputMethodFormatter@@UAEJPAPAUITextVirtualizationKeyRouting@@@Z
?GetVirtTIS@TextInputMethodFormatter@@QAEJPAPAUIRemoteTextInputServer@@@Z
?Initialize@TextInputMethodFormatter@@QAEJPAUIMessagePort@@W4VirtualizationEnvironment@@PAUIVirtualizedTextDataSender@@U_GUID@@@Z
?Initialize@TextInputMethodFormatter@@UAEJPAUIMessagePort@@@Z
?ProcessQueue@TextInputMethodFormatter@@QAEJXZ
?SetCIVMTarget@TextInputMethodFormatter@@UAEJPAUIRemoteCoreInputViewManager@@@Z
?SetCIVTarget@TextInputMethodFormatter@@UAEJPAUIRemoteCoreInputView@@PAVVirtCoreInputViewForwarder@@@Z
?SetTICTarget@TextInputMethodFormatter@@UAEJPAUIRemoteTextInputClient@@PAVVirtTextInputClient@@@Z
?SetTIHTarget@TextInputMethodFormatter@@UAEJPAVVirtTextInputHost@@@Z
?SetTISTarget@TextInputMethodFormatter@@UAEJPAUIRemoteTextInputServer@@@Z
?SetTVKRTarget@TextInputMethodFormatter@@UAEJPAUITextVirtualizationKeyRouting@@@Z
?Uninitialize@TextInputMethodFormatter@@UAEJXZ

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b9c73a2f9a70dd7fbd4eb6ba8d7df1d1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-2

api-ms-win-core-errorhandling-l1-1-3

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

coremessaging

coreuicomponents

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-synch-l1-2-1

api-ms-win-core-io-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.data Size: 2KB - Virtual size: 97KB

.idata Size: 6KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 28B

.reloc Size: 57KB - Virtual size: 56KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 2KB - Virtual size: 97KB

.idata
Size: 6KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 28B

.reloc
Size: 57KB - Virtual size: 56KB