IME_Switcher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
IME_Switcher.exe
Size 3.0MB
Sample261107-yj2b5aey2x
SHA256 3e597387ed5af9f9fd39604c8b0827f6251e1a2eda83e756a73e65980eb6391e
MD5 9a2c288192c3285b3ec1704c87989bea
SHA1 9e81518eed123dddd3a69e4f4115075942f7bf71
SHA512 1e5513d15aa6d8eb106aaae34238020b8d5e65f55f4b2d708a76449e7f009328c8ef26fa79f1d14353e375795b2caa4b847a8e94b2b44b1903fca7782f5808a6
SSDEEP 49152:UziOubzfSxc06VGmttWtA7H2ahAOeC5SV2v1bdma5CzP2y1e:XVGm6Aizdl
TLSH
T105E58D06E3E941A5D427DB34CA659332D6707C569731D24F0A98FA1A3F33EA08B3B725
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
IME_Switcher.exe

File Explorer

IME_Switcher.exe

.exe 3.0MB

IME_Switcher.exe

IMPHASH 7a2e9a593f56897ec83f9078c47e5171
SHA256 3e597387ed5af9f9fd39604c8b0827f6251e1a2eda83e756a73e65980eb6391e
MD5 9a2c288192c3285b3ec1704c87989bea
SHA1 9e81518eed123dddd3a69e4f4115075942f7bf71
SHA512 1e5513d15aa6d8eb106aaae34238020b8d5e65f55f4b2d708a76449e7f009328c8ef26fa79f1d14353e375795b2caa4b847a8e94b2b44b1903fca7782f5808a6
SSDEEP 49152:UziOubzfSxc06VGmttWtA7H2ahAOeC5SV2v1bdma5CzP2y1e:XVGm6Aizdl
TLSH
T105E58D06E3E941A5D427DB34CA659332D6707C569731D24F0A98FA1A3F33EA08B3B725
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1804152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

DeregisterEventSource RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegisterEventSourceW ReportEventW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptGenRandom

kernel32

TlsFree TlsSetValue CancelThreadpoolIo CloseHandle CloseThreadpoolIo CloseThreadpoolWork CreateDirectoryW CreateEventExW CreateFileW CreateMutexExW CreateThread CreateThreadpoolIo CreateThreadpoolWork DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FlushFileBuffers FormatMessageW FreeLibrary GetCPInfo GetCPInfoExW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumberEx GetCurrentThread GetDynamicTimeZoneInformation GetEnvironmentVariableW GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetLocaleInfoEx GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetStdHandle GetSystemDirectoryW GetSystemTime GetThreadPriority GetTickCount64 GetTimeZoneInformation InitializeConditionVariable InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection LoadLibraryExW LocalAlloc LocalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseFailFastException ReadConsoleW ReadFile ReleaseMutex ResetEvent ResumeThread SetConsoleCtrlHandler SetEvent SetFileInformationByHandle SetLastError SetThreadErrorMode SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableCS StartThreadpoolIo SubmitThreadpoolWork SystemTimeToFileTime TzSpecificLocalTimeToSystemTime VirtualAlloc VirtualFree WaitForMultipleObjectsEx WaitForSingleObject WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile FlushProcessWriteBuffers WaitForSingleObjectEx AddVectoredExceptionHandler RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread GetCurrentThreadId SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualProtect CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery GetSystemTimeAsFileTime InitializeCriticalSectionEx SleepEx DebugBreak GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter RtlLookupFunctionEntry

ole32

CoTaskMemAlloc CoTaskMemFree CoInitializeEx CoGetContextToken CoGetApartmentType CoWaitForMultipleHandles CoUninitialize CoCreateGuid

api-ms-win-crt-heap-l1-1-0

free calloc malloc _callnewh realloc _set_new_mode

api-ms-win-crt-math-l1-1-0

ceil modf __setusermatherr

api-ms-win-crt-string-l1-1-0

wcsncmp strlen _stricmp strcpy_s strcmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function _initialize_onexit_table terminate abort _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _register_thread_local_exe_atexit_callback _initterm_e exit _exit _c_exit __p___argc __p___wargv _cexit _initterm

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale