plHost[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

plHost.exe
Size

496KB
MD5

0ee7fd20d77371a19b5f754032851472
SHA1

148aa4d7fb7435ce0efa32b8360e2b61ff044c29
SHA256

02ee3096c2471e5645404518b3fefd9c72b473bcefbd7c2ee167256546cdd030
SHA512

98bfe64d5b83265f702bbc5ae314b86e7fe23a9b01f690bff407d270c8c15502d2f038c032a656c4db0099e847458bba8be754ad55d411ba7b5d7e81ce194ecb
SSDEEP

6144:sexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O7rpUlLaEx:seZeWSpda70ADIgSoxgUW/zFun7OpY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
plHost.exe

Files

plHost.exe
.exe windows:4 windows x86

0a726b87493ed3e84de155787907fb84

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHAutoComplete
PathRemoveExtensionW
PathGetArgsW
PathRemoveArgsW
PathQuoteSpacesW
StrFormatKBSizeW
PathFindFileNameW
PathCompactPathExW
PathFindExtensionW
PathUnquoteSpacesW
PathRemoveFileSpecW
PathIsRelativeW
PathAppendW
StrTrimW
PathFileExistsW
StrFormatByteSizeW
PathIsDirectoryW

kernel32

GetStartupInfoW
ExitProcess
RtlUnwind
HeapFree
RaiseException
HeapAlloc
TerminateProcess
HeapSize
HeapReAlloc
GetTimeZoneInformation
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentStrings
GetCommandLineA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
GetCPInfo
IsBadReadPtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
SetStdHandle
CompareStringA
CompareStringW
GetOEMCP
SetEnvironmentVariableA
GetFileTime
FindResourceA
GetProfileStringA
LocalFree
LocalAlloc
GetModuleFileNameW
GetFileAttributesW
CreateDirectoryW
GlobalFree
GlobalAlloc
ExpandEnvironmentStringsW
GetSystemDirectoryW
GetWindowsDirectoryW
MulDiv
GetLogicalDrives
GetLastError
SetLastError
LoadLibraryW
GetProcAddress
GetModuleHandleW
CloseHandle
GetCurrentProcess
Sleep
FreeLibrary
GetVersionExW
SetFilePointer
ReadFile
CreateFileW
GlobalUnlock
GlobalLock
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
GetACP
GetFullPathNameW
GetVolumeInformationW
UnlockFile
LockFile
FlushFileBuffers
DuplicateHandle
SetErrorMode
GetThreadLocale
WritePrivateProfileStringW
SizeofResource
GetProcessVersion
GetUserDefaultLangID
GetFileSize
SetEndOfFile
WriteFile
GetLocaleInfoW
GetTickCount
FormatMessageW
GetTimeFormatW
GetDateFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
GlobalAddAtomA
SystemTimeToFileTime
GetLocalTime
GetPrivateProfileStringW
LeaveCriticalSection
EnterCriticalSection
GlobalFlags
lstrcmpiW
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
lstrcpynW
lstrcmpW
lstrcmpA
lstrcmpiA
GetCurrentThread
GetModuleHandleA
LoadLibraryA
FindResourceW
LoadResource
LockResource
GetVersion
lstrcatW
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
lstrlenA
lstrlenW
lstrcpyW
CreateProcessW
GlobalSize
WaitForSingleObject
GetExitCodeProcess
GetCommandLineW
FindFirstFileW
FindNextFileW
FindClose
WideCharToMultiByte
TerminateThread
CreateThread
DeleteCriticalSection
InitializeCriticalSection

user32

PostThreadMessageW
CharUpperW
MessageBeep
GetNextDlgGroupItem
CopyAcceleratorTableW
CharNextW
InflateRect
GetSysColorBrush
MapDialogRect
SetWindowContextHelpId
DestroyMenu
GetMessageW
ValidateRect
GrayStringW
TabbedTextOutW
EndPaint
BeginPaint
GetWindowDC
EndDialog
GetActiveWindow
CreateDialogIndirectParamW
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
SetMenuItemBitmaps
GetNextDlgTabItem
IsWindowEnabled
IsDialogMessageW
SetDlgItemTextW
SetDlgItemInt
GetDlgItemInt
LoadIconW
SendDlgItemMessageW
SendDlgItemMessageA
MapWindowPoints
SetActiveWindow
SetFocus
AdjustWindowRectEx
GetTopWindow
IsChild
WinHelpW
GetClassInfoW
RegisterClassW
TrackPopupMenu
SetWindowPlacement
GetDlgItem
GetWindowTextLengthW
GetDlgCtrlID
DestroyWindow
CreateWindowExW
SetWindowsHookExW
CallNextHookEx
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
IsIconic
GetWindowPlacement
ScrollWindow
SetScrollPos
GetScrollInfo
GetSystemMetrics
SetForegroundWindow
ReleaseCapture
SetCapture
DestroyCaret
GetScrollPos
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
SendMessageW
SetWindowTextW
UnregisterClassW
GetWindowTextLengthA
ExcludeUpdateRgn
GetWindowTextA
GetClassInfoA
DefDlgProcA
DefWindowProcA
SetScrollInfo
ShowScrollBar
EnableScrollBar
DrawTextA
HideCaret
CreateCaret
SetCaretPos
ShowCaret
GetCapture
GetPropW
DefWindowProcW
CallWindowProcW
RemovePropW
SetPropW
SetTimer
KillTimer
PostQuitMessage
GetFocus
RedrawWindow
TranslateAcceleratorW
WindowFromPoint
CreatePopupMenu
AppendMenuW
GetMenuState
SetMenuDefaultItem
CheckMenuItem
CheckMenuRadioItem
LoadMenuW
LoadAcceleratorsW
GetMenu
GetMenuStringW
RegisterWindowMessageW
GetMenuItemCount
GetMenuItemID
GetSubMenu
RemoveMenu
DeleteMenu
EnableMenuItem
InsertMenuW
SetWindowLongW
UpdateWindow
GetMenuItemInfoW
PeekMessageW
DispatchMessageW
TranslateMessage
MessageBoxW
LoadImageW
LoadStringW
SetCursor
DrawFrameControl
DrawEdge
GetWindowTextW
DrawFocusRect
PtInRect
DrawIconEx
InvalidateRect
PostMessageW
GetSysColor
DestroyIcon
LoadCursorW
CharNextA
CallWindowProcA
RemovePropA
SetWindowsHookExA
GetWindowLongA
SendMessageA
IsWindowUnicode
GetClassNameA
SetWindowLongA
SetPropA
GetPropA
DrawTextW
OffsetRect
ReleaseDC
GetDC
SystemParametersInfoW
ScreenToClient
ClientToScreen
GetCursorPos
GetWindowRect
GetWindowLongW
IntersectRect
IsWindow
ShowWindow
SetWindowPos
IsWindowVisible
GetParent
GetDesktopWindow
RegisterClipboardFormatW
GetKeyState
DestroyCursor
GetClientRect
FillRect
SetRect
CopyRect
GetDialogBaseUnits
GetClassNameW
IsZoomed
MoveWindow
GetWindow
EnableWindow
keybd_event
GetIconInfo
wsprintfW

gdi32

SaveDC
RestoreDC
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
IntersectClipRect
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutW
Escape
PatBlt
LPtoDP
GetClipBox
GetTextExtentPoint32W
RoundRect
CreatePen
CopyMetaFileW
DeleteEnhMetaFile
GetTextColor
SetBkMode
GetBkColor
CreateFontIndirectW
SetPixel
SetBitmapBits
CreateSolidBrush
GetBitmapBits
CreateCompatibleDC
GetPixel
DPtoLP
CreateCompatibleBitmap
BitBlt
DeleteDC
CreateBitmap
GetMapMode
SetMapMode
SelectObject
GetTextExtentPointW
GetStockObject
GetObjectW
GetDeviceCaps
SetTextColor
ExtTextOutW
SetBkColor
CreateDIBitmap
DeleteObject
ExtTextOutA
GetTextExtentPointA

comdlg32

GetFileTitleW
GetOpenFileNameW
GetSaveFileNameW
ChooseFontW

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

advapi32

RegOpenKeyW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegEnumValueW
RegCloseKey
RegEnumKeyW
RegDeleteKeyW
RegCreateKeyW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHGetMalloc
SHGetDesktopFolder
ShellExecuteExW
SHChangeNotify
SHGetFileInfoW
ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW
SHFreeNameMappings
SHGetSpecialFolderPathW

comctl32

_TrackMouseEvent
ImageList_Draw
ImageList_GetIconSize
ImageList_DrawEx
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_Remove
ImageList_Add
ord17
ImageList_Create

oledlg

OleUIBusyW

ole32

CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
DoDragDrop
OleSetClipboard
OleDuplicateData
CoTaskMemFree
CoInitialize
CoUninitialize
OleIsCurrentClipboard
OleFlushClipboard
OleUninitialize
OleInitialize
CoTaskMemAlloc
CoCreateInstance
ReleaseStgMedium
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRevokeClassObject
CLSIDFromProgID

olepro32

ord253

oleaut32

SysStringLen
VariantTimeToSystemTime
SysFreeString
SysAllocStringLen
VariantClear
VariantCopy
SysAllocString
VariantChangeType

Sections

.text
Size: 328KB - Virtual size: 327KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0a726b87493ed3e84de155787907fb84

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

Sections

.text Size: 328KB - Virtual size: 327KB

.rdata Size: 60KB - Virtual size: 57KB

.data Size: 28KB - Virtual size: 51KB

.rsrc Size: 76KB - Virtual size: 75KB

.text
Size: 328KB - Virtual size: 327KB

.rdata
Size: 60KB - Virtual size: 57KB

.data
Size: 28KB - Virtual size: 51KB

.rsrc
Size: 76KB - Virtual size: 75KB