Static task
static1
General
-
Target
dasHost.exe
-
Size
148KB
-
MD5
f53a1b7a0ad5c1431cd4cfa8949a3a57
-
SHA1
4e475841f73d92d8695afb82c6889dc3c8fa04c7
-
SHA256
2983124e12eb0dd0dd4bb2c17bf957728e8c5d045c4bac493283f5824c569c1c
-
SHA512
bcfa10dacc94c47e6d193585a0d0d1456471db134ef7282194e3ff0ed1361f56cad2ec0af621d5edca14cf6be52a1602432d4cb953d8c7c52045a7e912f0b4d2
-
SSDEEP
3072:Rt0z4h8Q+qOm/VHLHPfemX6JExiPHY3aiASCqY9CytC+r525F:U4hSq9/VHLHOrExiPHY3vAZho+r5
Malware Config
Signatures
Files
-
dasHost.exe.exe windows x64
27885cacc6ee39b866942a47cd01c180
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__exit
_o__get_initial_wide_environment
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
memcpy
_o__configure_wide_argv
_o_exit
_o_free
_o_malloc
_o_terminate
__current_exception
__current_exception_context
_CxxThrowException
_o__configthreadlocale
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o__crt_atexit
_o__cexit
_o__callnewh
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o___p___wargv
_o___p___argc
__C_specific_handler
__std_terminate
__CxxFrameHandler4
__C_specific_handler_noexcept
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
LoadLibraryExW
GetModuleFileNameA
GetModuleHandleW
FreeLibrary
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
ReleaseSemaphore
InitializeCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseMutex
LeaveCriticalSection
ResetEvent
EnterCriticalSection
DeleteCriticalSection
CreateSemaphoreExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeSRWLock
SetEvent
CreateEventW
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
api-ms-win-core-processthreads-l1-1-0
SetThreadToken
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
rpcrt4
I_RpcBindingInqLocalClientPID
RpcBindingFromStringBindingW
RpcBindingSetOption
NdrClientCall3
RpcBindingFree
RpcStringFreeW
NdrMesTypeEncode3
NdrMesTypeAlignSize3
NdrAsyncServerCall
NdrServerCallAll
Ndr64AsyncServerCallAll
NdrServerCall2
RpcSsDestroyClientContext
RpcServerUseProtseqEpW
I_RpcMapWin32Status
RpcServerRegisterIf3
RpcServerUnregisterIfEx
RpcAsyncCompleteCall
MesEncodeIncrementalHandleCreate
MesIncrementalHandleReset
RpcExceptionFilter
MesHandleFree
I_RpcExceptionFilter
RpcStringBindingComposeW
RpcImpersonateClient
RpcRevertToSelf
UuidFromStringW
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceLoggerHandle
TraceMessage
UnregisterTraceGuids
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
wpprecorderum
WppAutoLogStop
WppAutoLogStart
WppAutoLogTrace
api-ms-win-security-sddl-l1-1-0
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
CreateThreadpoolWork
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolWait
CloseThreadpoolWork
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventActivityIdControl
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-security-base-l1-1-0
DuplicateToken
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
ntdll
RtlInitUnicodeString
api-ms-win-devices-query-l1-1-1
DevGetObjectPropertiesEx
api-ms-win-devices-query-l1-1-0
DevFreeObjectProperties
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegGetValueW
RegCloseKey
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
Sections
.text Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ