taskhostw[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

taskhostw.exe
Size

110KB
MD5

4887a65fd4f6598af4986cbc1c0e5488
SHA1

0882f3f9947405bb80c2e830adf69af85c9b51c7
SHA256

82472a84bcbb4009add338200f8e853fe4c5eafe2e2c3a2d711b85bf29b72d54
SHA512

7b18f7b7bc90e850e2d97b2985610c812584edcc993bf999e20c8b4a604e8e59d241f28b3c0be5314983799812ba407ba42f0adb7f2c1b5d210848e944636304
SSDEEP

3072:6dC1m5Y8V8Ed5z/B+xFfHzw1TYKOJ6Ev:X1UYX0z5+FfM1TYK

Score

1^/10

Malware Config

Signatures

Files

taskhostw.exe
.exe windows:10 windows x64

1c4e2d9936e4d9f2490b08aab4d24260

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f2:00:2c:d4:bf:51:1c:8d:d6:cc:c7:74:d9:9c:49:15:88:d4:bb:58:6d:fd:96:38:f1:d3:bb:9e:1e:5e:cf:35
Signer

Actual PE Digest

f2:00:2c:d4:bf:51:1c:8d:d6:cc:c7:74:d9:9c:49:15:88:d4:bb:58:6d:fd:96:38:f1:d3:bb:9e:1e:5e:cf:35

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

free
malloc
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
??3@YAXPEAX@Z
__CxxFrameHandler4
memmove
_XcptFilter
memcpy_s
memmove_s
??0exception@@QEAA@AEBV0@@Z
??1type_info@@UEAA@XZ
wcsstr
?what@exception@@UEBAPEBDXZ
_CxxThrowException
__CxxFrameHandler3
memcpy
_purecall
_onexit
calloc
_callnewh
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_commode
_fmode
_wcmdln
__C_specific_handler
_initterm
__setusermatherr
??1exception@@UEAA@XZ
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
memset

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapSize
HeapFree
HeapDestroy
GetProcessHeap
HeapAlloc

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetStartupInfoW
CreateThread
GetCurrentThread
SetProcessShutdownParameters
GetExitCodeThread
GetCurrentProcess
TerminateProcess
GetThreadPriority
SetThreadPriority
GetCurrentProcessId

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
LoadStringW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-security-base-l1-1-0

InitializeAcl
AddAce
GetAclInformation
GetSecurityDescriptorOwner
SetSecurityDescriptorOwner
IsValidSid
SetSecurityDescriptorGroup
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetSecurityDescriptorControl
MakeAbsoluteSD
InitializeSecurityDescriptor
GetLengthSid
CopySid
GetSidSubAuthority
CreateWellKnownSid
InitializeSid
GetSidLengthRequired
AllocateAndInitializeSid
GetSecurityDescriptorGroup
FreeSid

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeSRWLock
SetEvent
ResetEvent
CreateEventW
WaitForSingleObject

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer

ntdll

EtwTraceMessage
NtSetInformationProcess
RtlUnhandledExceptionFilter
RtlIsMultiSessionSku
DbgPrintEx

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 376B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 820B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1c4e2d9936e4d9f2490b08aab4d24260

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

f2:00:2c:d4:bf:51:1c:8d:d6:cc:c7:74:d9:9c:49:15:88:d4:bb:58:6d:fd:96:38:f1:d3:bb:9e:1e:5e:cf:35Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-heap-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

ntdll

Sections

.text Size: 44KB - Virtual size: 43KB

.rdata Size: 32KB - Virtual size: 30KB

.data Size: 4KB - Virtual size: 2KB

.pdata Size: 4KB - Virtual size: 3KB

.didat Size: 4KB - Virtual size: 376B

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 820B

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

f2:00:2c:d4:bf:51:1c:8d:d6:cc:c7:74:d9:9c:49:15:88:d4:bb:58:6d:fd:96:38:f1:d3:bb:9e:1e:5e:cf:35
Signer

.text
Size: 44KB - Virtual size: 43KB

.rdata
Size: 32KB - Virtual size: 30KB

.data
Size: 4KB - Virtual size: 2KB

.pdata
Size: 4KB - Virtual size: 3KB

.didat
Size: 4KB - Virtual size: 376B

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 820B