InputSwitch[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

InputSwitch.dll
Size

181KB
MD5

9a300874c85a44672c97a5b43361fddc
SHA1

1582079923015ab180f1b3678cbf5b8fd426475a
SHA256

9bfe30ad583b09ea12d5f44324b36c2c7313c7c8a3bddf991fa8170833c17962
SHA512

7831fc942873b233e99825703beb9359ec536dd004ec3fd03b1d45e2b09c10cf74ca4b6f6add808435335761e623425f2149b75e2dbabd9fa49d4db0a8f46be9
SSDEEP

3072:BLVYU2tWojqfR9Y0meesGuuXG15DbPRVIdlpSdLT+LQjF6U:D2t0K25D7RV5BSLQp6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
InputSwitch.dll

Files

InputSwitch.dll
.dll windows:6 windows x86 arch:x86

6750b87d021987ee57b357223dc205c7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

InputSwitch.pdb

Imports

msvcrt

__CxxFrameHandler3
memcmp
_except_handler4_common
_ftol2_sse
memset
??3@YAXPAX@Z
??2@YAPAXI@Z
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
free
_amsg_exit
_XcptFilter
_wcsicmp
toupper
islower
__isascii
wcsncmp
_vsnwprintf
_purecall
memcpy
floor

ntdll

WinSqmIncrementDWORD
WinSqmAddToStream

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-synch-l1-2-0

CreateEventW
ReleaseSRWLockShared
AcquireSRWLockShared
LeaveCriticalSection
SetEvent
DeleteCriticalSection
TryEnterCriticalSection
WaitForMultipleObjectsEx
EnterCriticalSection
AcquireSRWLockExclusive
Sleep
InitializeCriticalSectionEx
ReleaseSRWLockExclusive

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWrite
EventRegister

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-2-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-localization-l1-2-1

GetThreadUILanguage
FormatMessageW
SetThreadUILanguage
GetLocaleInfoEx
GetLocaleInfoW

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetVersionExW
GetSystemDirectoryW
GetSystemTimeAsFileTime

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
OpenThread

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsCreateString
WindowsIsStringEmpty
WindowsDeleteString
WindowsGetStringRawBuffer

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FindResourceExW
FreeLibrary
LoadResource
LockResource
LoadStringW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegCloseKey
RegGetValueW
RegOpenKeyExW
RegCreateKeyExW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-heap-obsolete-l1-1-0

LocalAlloc
LocalFree
LocalReAlloc

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

user32

TrackMouseEvent
SetCapture
GetClientRect
PtInRect
SetForegroundWindow
ClientToScreen
GetDC
LoadImageW
CreateIconIndirect
SetRectEmpty
ReleaseDC
CreateWindowInBand
CopyIcon
SetLayeredWindowAttributes
LoadIconW
GetRawInputDeviceList
CopyImage
RegisterClassW
GetSystemMetrics
EndPaint
BeginPaint
DestroyIcon
KillTimer
UnhookWindowsHookEx
ReleaseCapture
SetWindowsHookExW
SetTimer
SystemParametersInfoW
CallNextHookEx
RegisterShellHookWindow
GetThreadDesktop
RegisterWindowMessageW
FindWindowExW
SendMessageW
SetKeyboardState
GetKeyboardState
ScreenToClient
GetMonitorInfoW
MonitorFromRect
MonitorFromWindow
CalculatePopupWindowPosition
DeregisterShellHookWindow
DestroyWindow
PostMessageW
DispatchMessageW
LoadCursorW
SetCursor
TranslateMessage
PostQuitMessage
PeekMessageW
MsgWaitForMultipleObjectsEx
SetThreadDesktop
GetParent
GetMessageW
NotifyWinEvent
GetDesktopWindow
ShowWindow
GetCursorPos
SetWindowPos
RegisterClassExW
CreateWindowExW
GetWindowLongW
SetWindowLongW
DefWindowProcW
FindWindowW
GetWindowRect
GetKeyState

imm32

ImmDisableLegacyIME

bcp47langs

Bcp47GetAbbreviation
Bcp47FromLcid
Bcp47GetLanguageName

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateError

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-kernel32-legacy-l1-1-1

MulDiv

api-ms-win-core-shlwapi-legacy-l1-1-0

PathRemoveFileSpecW
PathAppendW

kernel32

DelayLoadFailureHook
ResolveDelayLoadedAPI

gdi32

GetLayout
DeleteObject
SetBkColor
GetClipBox
CreateFontIndirectW
ExtTextOutW
GetTextMetricsW
SetTextAlign
GetTextExtentPoint32W
GetDeviceCaps
SetTextColor
SetBkMode
GetDIBits
GetObjectW
CreateDIBSection
SelectObject
CreateCompatibleDC
DeleteDC
GetStockObject

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

minATL
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6750b87d021987ee57b357223dc205c7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

user32

imm32

bcp47langs

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-shlwapi-legacy-l1-1-0

kernel32

gdi32

Exports

Exports

Sections

.text Size: 103KB - Virtual size: 103KB

.data Size: 2KB - Virtual size: 2KB

.idata Size: 6KB - Virtual size: 6KB

minATL Size: 512B - Virtual size: 24B

.rsrc Size: 62KB - Virtual size: 61KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 103KB - Virtual size: 103KB

.data
Size: 2KB - Virtual size: 2KB

.idata
Size: 6KB - Virtual size: 6KB

minATL
Size: 512B - Virtual size: 24B

.rsrc
Size: 62KB - Virtual size: 61KB

.reloc
Size: 6KB - Virtual size: 5KB