MsSpellCheckingHost[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

MsSpellCheckingHost.exe
Size

59KB
MD5

c5f77c0d2b8e76b798ef55a3edd5b216
SHA1

6ee6b087fbb6766445c595dcb78a817052a78fb1
SHA256

2acb42932bdaa5e196b170d1bb7661b57f9deecf57148c0995b56ec2e1508dc5
SHA512

27f8b3f695b6266015ae0218cb7328dd9bac7c236bd2cbad148dd25eaf77de19e5c17fa9a2ae42bdf5de463c8f890329369aab7239b49db207b98d7598d069c3
SSDEEP

1536:Cj4FcTdEgreoalVjjA+iRsKb4dBzAhAWU0E5hApXN6Do:EdEkglVGRLsd9+RUr5hApd7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MsSpellCheckingHost.exe

Files

MsSpellCheckingHost.exe
.exe windows x86

779b10426325ca77b12e3c01d2170be2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

UnregisterClassA
DispatchMessageW
TranslateMessage
CharNextW
GetMessageW
PostThreadMessageW
CharUpperW

msvcrt

??1type_info@@UAE@XZ
_onexit
_except_handler4_common
_errno
_unlock
_lock
?terminate@@YAXXZ
_controlfp
_acmdln
_initterm
realloc
__setusermatherr
_ismbblead
__dllonexit
__p__fmode
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
__p__commode
_XcptFilter
_CxxThrowException
_callnewh
??0exception@@QAE@XZ
memset
?what@exception@@UBEPBDXZ
_purecall
??0exception@@QAE@ABV0@@Z
memmove
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
wcscat_s
wcscpy_s
memcpy_s
free
malloc
wcsncpy_s
??_V@YAXPAX@Z
??3@YAXPAX@Z
__CxxFrameHandler3
memcpy

oleaut32

RegisterTypeLi
LoadTypeLi
SysStringLen
VarUI4FromStr
SysAllocString
SysFreeString
UnRegisterTypeLi

api-ms-win-core-com-l1-1-1

StringFromGUID2
CoSuspendClassObjects
CoCreateInstance
CoRevokeClassObject
CoRegisterClassObject
CoUninitialize
CoInitializeEx
CoResumeClassObjects
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWrite

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
GetCurrentThread
OpenThreadToken
CreateThread
GetCurrentProcessId
TerminateProcess
OpenProcessToken
GetCurrentProcess

api-ms-win-core-errorhandling-l1-1-1

RaiseException
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-security-base-l1-2-0

GetTokenInformation

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleA
LoadLibraryExW
GetModuleFileNameW
GetProcAddress
GetModuleHandleW
LoadResource
FindResourceExW
SizeofResource

api-ms-win-core-sysinfo-l1-2-1

GetVersionExW
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW

api-ms-win-core-synch-l1-2-0

CreateEventW
CreateMutexW
SetEvent
DeleteCriticalSection
OpenMutexW
InitializeCriticalSection
LeaveCriticalSection
ReleaseMutex
WaitForSingleObject
EnterCriticalSection
Sleep

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-memory-l1-1-2

CreateFileMappingW
OpenFileMappingW
UnmapViewOfFile
MapViewOfFile

api-ms-win-core-processenvironment-l1-2-0

GetCommandLineW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-kernel32-legacy-l1-1-1

GetStartupInfoA

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

779b10426325ca77b12e3c01d2170be2

Headers

DLL Characteristics

File Characteristics

Imports

user32

msvcrt

oleaut32

api-ms-win-core-com-l1-1-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-security-base-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

Sections

.text Size: 40KB - Virtual size: 40KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 40KB - Virtual size: 40KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 6KB - Virtual size: 5KB