3d7095fae2bd3574c89940f9632cf3749aa795d97fc2c0d305119b8a8d2dc106

Sharing

Copy URL Twitter E-mail

General

Target

3d7095fae2bd3574c89940f9632cf3749aa795d97fc2c0d305119b8a8d2dc106
Size

524KB
MD5

9c367396c532c2db5b884fe58a6ad5ad
SHA1

92241bcc1b3f1c76fdfd0bc67babd932843eefa4
SHA256

3d7095fae2bd3574c89940f9632cf3749aa795d97fc2c0d305119b8a8d2dc106
SHA512

c5367862cce3d8ceb7b7429fc717eb86bc4b2570c7c86f8e9af2fff42305ab279bc95a25519193eb4112247e9ac3b6f61ced4f8599479d8d7008a023ffe552df
SSDEEP

6144:R7HGSN0HQKq16fGREHaKakOl/UOjEHj/PodMXZdaUQJ6em+/c3Sy4cJ8FozaOp6:R7HUg8feEF8lPu00LQJWv+F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3d7095fae2bd3574c89940f9632cf3749aa795d97fc2c0d305119b8a8d2dc106

Files

3d7095fae2bd3574c89940f9632cf3749aa795d97fc2c0d305119b8a8d2dc106
.dll windows:10 windows x64 arch:x64

7ecedf9b373a245b6b1bd960258f2e87

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

InputSwitch.pdb

Imports

msvcrt

memmove
memcpy
memcmp
floorf
_CxxThrowException
__CxxFrameHandler3
_callnewh
wcsrchr
wcsstr
_wcsicmp
_get_errno
_set_errno
wcstoul
wcschr
toupper
islower
__isascii
wcsncmp
_wtoi
memmove_s
_purecall
pow
memset
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
malloc
_itow_s
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_vsnprintf_s
??1type_info@@UEAA@XZ
_amsg_exit
_XcptFilter
free
memcpy_s
_vsnwprintf

propsys

PSPropertyBag_WriteStr
PropVariantToUInt32
PSCreateMemoryPropertyStore

api-ms-win-shcore-comhelpers-l1-1-0

IUnknown_Set
IUnknown_QueryService

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FindResourceExW
FindStringOrdinal
LoadResource
GetProcAddress
GetModuleHandleW
LockResource
LoadStringW
GetModuleFileNameA
GetModuleHandleExW
FreeLibrary

api-ms-win-core-synch-l1-1-0

TryEnterCriticalSection
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
CreateSemaphoreExW
OpenSemaphoreW
CreateMutexExW
WaitForMultipleObjectsEx
AcquireSRWLockExclusive
CreateEventW
WaitForSingleObjectEx
ReleaseSRWLockExclusive
DeleteCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
SetEvent
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionEx

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-processthreads-l1-1-0

TlsSetValue
TlsGetValue
OpenThread
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
TlsAlloc
TlsFree

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
GetThreadUILanguage
GetUserDefaultLangID
GetLocaleInfoEx
FormatMessageW
SetThreadUILanguage

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
Sleep
InitOnceExecuteOnce
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
SetRestrictedErrorInfo

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-heap-l2-1-0

LocalReAlloc
LocalFree
LocalAlloc

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegOpenCurrentUser
RegCloseKey
RegSetValueExW
RegQueryInfoKeyW
RegQueryValueExW
RegCreateKeyExW
RegGetValueW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference
WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsCreateString
WindowsIsStringEmpty

api-ms-win-core-file-l1-1-0

GetFullPathNameW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask
GetSystemTimePreciseAsFileTime

api-ms-win-security-base-l1-1-0

CheckTokenMembership
GetTokenInformation
CreateWellKnownSid

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-path-l1-1-0

PathAllocCombine
PathCchRemoveFileSpec

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-kernel32-legacy-l1-1-0

MulDiv

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW
PathFindExtensionW
PathFileExistsW
PathAppendW
PathIsFileSpecW
PathRemoveFileSpecW
PathIsRelativeW

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

api-ms-win-core-shlwapi-obsolete-l1-1-0

QISearch

api-ms-win-ntuser-sysparams-l1-1-0

GetMonitorInfoW
GetSystemMetrics
SystemParametersInfoW

api-ms-win-ntuser-rectangle-l1-1-0

CopyRect
PtInRect
SetRectEmpty
OffsetRect

api-ms-win-rtcore-ntuser-shell-l1-1-0

DeregisterShellHookWindow
RegisterShellHookWindow

api-ms-win-rtcore-ntuser-window-l1-1-0

DestroyWindow
PostMessageW
DispatchMessageW
TranslateMessage
PostQuitMessage
ClientToScreen
RegisterClassExW
GetDesktopWindow
CreateWindowExW
GetWindowLongPtrW
SetWindowLongPtrW
DefWindowProcW
FindWindowW
GetCursorPos
GetWindowRect
ScreenToClient
GetClientRect
SendMessageW
FindWindowExW
GetMessageExtraInfo
SetMessageExtraInfo
GetPropW
RegisterWindowMessageW
RemovePropW
SetPropW
GetWindowLongW
WindowFromPoint
GetClassNameW
SetWindowLongW
ShowWindow
RegisterClassW
GetMessageW
PeekMessageW
SetTimer
SetForegroundWindow
SetWindowPos
GetWindowThreadProcessId
GetParent
KillTimer

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjectsEx

api-ms-win-rtcore-ntuser-winevent-l1-1-0

NotifyWinEvent

api-ms-win-rtcore-ntuser-private-l1-1-0

GetWindowBand
CreateWindowInBand

ntdll

RtlPublishWnfStateData
WinSqmIncrementDWORD
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlGetDeviceFamilyInfoEnum
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
WinSqmAddToStream

api-ms-win-core-url-l1-1-0

UrlUnescapeW
PathIsURLW
UrlCreateFromPathW

api-ms-win-rtcore-ntuser-wmpointer-l1-1-0

GetCurrentInputMessageSource

api-ms-win-appmodel-runtime-l1-1-3

GetStagedPackagePathByFullName2

api-ms-win-appmodel-runtime-l1-1-1

FindPackagesByPackageFamily

api-ms-win-shlwapi-winrt-storage-l1-1-1

ord197
ord237
IUnknown_GetWindow

bcp47langs

Bcp47GetAbbreviation
Bcp47GetLanguageName
Bcp47FromLcid

gdi32

GetDIBits
RemoveFontMemResourceEx
DeleteObject
GetStockObject
SetBkColor
GetTextExtentPoint32W
SetTextAlign
ExtTextOutW
CreateFontIndirectW
SetStretchBltMode
ExcludeClipRect
GetObjectW
SetBkMode
SetTextColor
DeleteDC
GetDeviceCaps
StretchBlt
GdiAlphaBlend
CreateCompatibleDC
CreateDIBSection
SelectObject
BitBlt
CreateSolidBrush
GetCurrentObject
StretchDIBits
GetTextMetricsW
GetClipBox

imm32

ImmDisableLegacyIME

ole32

CreateBindCtx

user32

LoadMenuW
GetSysColor
SetThreadDesktop
SetCursor
LoadCursorW
DestroyIcon
CopyImage
GetAsyncKeyState
GetDpiForWindow
SetMenuItemInfoW
MonitorFromWindow
UnhookWindowsHookEx
GetKeyboardState
SetKeyboardState
GetThreadDesktop
DestroyMenu
TrackPopupMenuEx
BeginPaint
EndPaint
LoadIconW
SetLayeredWindowAttributes
ReleaseDC
DrawIconEx
DrawTextW
GetDC
GetMenuInfo
SetMenuInfo
MonitorFromPoint
GetDpiForSystem
GetWindowDpiAwarenessContext
DrawTextExW
AreDpiAwarenessContextsEqual
SetWindowCompositionAttribute
GetMenuItemInfoW
CallNextHookEx
GetMenuState
CheckMenuItem
SendInput
GetKeyState
CalculatePopupWindowPosition
SetWindowsHookExW
RemoveMenu
CreateIconIndirect
LoadImageW
CopyIcon
SetCapture
TrackMouseEvent
ReleaseCapture
MonitorFromRect
GetSubMenu
InjectKeyboardInput

wininet

InternetCrackUrlW

shcore

ord222
SHTaskPoolQueueTask

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 315KB - Virtual size: 314KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7ecedf9b373a245b6b1bd960258f2e87

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

propsys

api-ms-win-shcore-comhelpers-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-ntuser-rectangle-l1-1-0

api-ms-win-rtcore-ntuser-shell-l1-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-rtcore-ntuser-synch-l1-1-0

api-ms-win-rtcore-ntuser-winevent-l1-1-0

api-ms-win-rtcore-ntuser-private-l1-1-0

ntdll

api-ms-win-core-url-l1-1-0

api-ms-win-rtcore-ntuser-wmpointer-l1-1-0

api-ms-win-appmodel-runtime-l1-1-3

api-ms-win-appmodel-runtime-l1-1-1

api-ms-win-shlwapi-winrt-storage-l1-1-1

bcp47langs

gdi32

imm32

ole32

user32

wininet

shcore

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-stateseparation-helpers-l1-1-0

Exports

Exports

Sections

.text Size: 315KB - Virtual size: 314KB

.rdata Size: 114KB - Virtual size: 113KB

.data Size: 1024B - Virtual size: 4KB

.text
Size: 315KB - Virtual size: 314KB

.rdata
Size: 114KB - Virtual size: 113KB

.data
Size: 1024B - Virtual size: 4KB

.pdata
Size: 19KB - Virtual size: 18KB

.didat
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 67KB - Virtual size: 67KB

.reloc
Size: 3KB - Virtual size: 3KB