dasHost[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dasHost.exe
Size

92KB
MD5

66cfaa5940a06daf10f5203bc2b1a5ab
SHA1

ef3fa9c80439b6a8df17c0e5e11b2f8373d0d8df
SHA256

96c8f4b3e1f325dcd1ee5ae1fec78562d115099a731934aeadc3e49ef19a720d
SHA512

c962adf5ae6aed7d1887ce147cb0ac1a59bbc076cda01edad05cf6dbc5e62875695c9102423acb0bcfa8c7cc0d26a725a6294e6e1a8e4e4e20dfc6d3fc89ba5f
SSDEEP

1536:52WqC3B2KcVR5SjPAKnwHqZRM6crqThEjCn8dXqe6cckUs:52ZV5Sj4KnwKft2Cn8dXWg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dasHost.exe

Files

dasHost.exe
.exe windows:6 windows x64

124aadd241597f90758a2ff30497093a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_vsnwprintf
?terminate@@YAXXZ
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_callnewh
malloc
free
memcpy
memset

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

rpcrt4

RpcServerUnregisterIfEx
RpcSsDestroyClientContext
RpcStringFreeW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcBindingSetOption
RpcBindingFree
MesEncodeIncrementalHandleCreate
I_RpcExceptionFilter
MesIncrementalHandleReset
RpcExceptionFilter
MesHandleFree
UuidFromStringW
I_RpcBindingInqLocalClientPID
RpcImpersonateClient
RpcServerRegisterIf3
I_RpcMapWin32Status
RpcServerUseProtseqEpW
NdrServerCallAll
Ndr64AsyncServerCallAll
NdrServerCall2
NdrAsyncServerCall
NdrMesTypeEncode3
RpcRevertToSelf
NdrMesTypeAlignSize3
NdrClientCall3
RpcAsyncCompleteCall

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
TraceMessage

api-ms-win-core-heap-l1-2-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-synch-l1-2-0

LeaveCriticalSection
AcquireSRWLockExclusive
Sleep
DeleteCriticalSection
ResetEvent
WaitForSingleObject
SetEvent
CreateEventW
InitializeCriticalSection
EnterCriticalSection
InitializeSRWLock
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseSRWLockExclusive

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
CreateThreadpoolWork
CloseThreadpoolWait
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWork

api-ms-win-security-base-l1-2-0

DuplicateToken

api-ms-win-core-processthreads-l1-1-2

SetThreadToken
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
OpenProcess
GetCurrentThreadId

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FreeLibrary
GetModuleHandleW
GetProcAddress

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-devices-query-l1-1-1

DevFreeObjectProperties
DevGetObjectPropertiesEx

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegGetValueW
RegOpenKeyExW

api-ms-win-eventing-provider-l1-1-0

EventWrite

Sections

.text
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

124aadd241597f90758a2ff30497093a

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

rpcrt4

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-devices-query-l1-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

Sections

.text Size: 79KB - Virtual size: 78KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 3KB - Virtual size: 2KB

.idata Size: 5KB - Virtual size: 5KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 79KB - Virtual size: 78KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 3KB - Virtual size: 2KB

.idata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB