dasHost[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dasHost.exe
Size

96KB
MD5

1179f79ddf6d33a7191265a95a21eb68
SHA1

ef2a82608fa93c831f3e0672e666163655dbdfb9
SHA256

62070aebd1589521667d1db4a81ddebadfc0b4e7add091536abd08a7968ba605
SHA512

1a3c74956f26bdea636242333042e4db2626e1da53eba5c5807055b4cf306d43a270904ca8c0f85d5543a8e706dae6d781d4f34ba39121b0402719c93c03d9e4
SSDEEP

1536:BluWuioPwXquhVKpEL2vRY2fLkjnCNpi1krQ+Jrj12S:7qufKpEL6Y0LcCn9rlrjkS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dasHost.exe

Files

dasHost.exe
.exe windows:10 windows x64 arch:x64

Password: iii323

2fa3d006e774952b3f9dff2dc941a2ed

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

dasHost.pdb

Imports

msvcrt

_vsnwprintf
?terminate@@YAXXZ
_commode
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
memcpy
_amsg_exit
_XcptFilter
_callnewh
malloc
free
__C_specific_handler
_fmode
memset

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

rpcrt4

RpcStringFreeW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcBindingSetOption
RpcSsDestroyClientContext
I_RpcExceptionFilter
RpcRevertToSelf
RpcImpersonateClient
I_RpcBindingInqLocalClientPID
UuidFromStringW
MesHandleFree
RpcExceptionFilter
MesIncrementalHandleReset
MesEncodeIncrementalHandleCreate
RpcBindingFree
RpcAsyncCompleteCall
RpcServerUnregisterIfEx
RpcServerRegisterIf3
I_RpcMapWin32Status
RpcServerUseProtseqEpW
NdrServerCall2
Ndr64AsyncServerCallAll
NdrServerCallAll
NdrClientCall3
NdrMesTypeEncode3
NdrMesTypeAlignSize3
NdrAsyncServerCall

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
TraceMessage
GetTraceEnableFlags
UnregisterTraceGuids

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-security-sddl-l1-1-0

ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

ResetEvent
CreateEventW
SetEvent
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
InitializeSRWLock
AcquireSRWLockShared

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-threadpool-l1-2-0

SubmitThreadpoolWork
CreateThreadpoolWork
CloseThreadpoolWait
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventWriteTransfer

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-security-base-l1-1-0

DuplicateToken

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
SetThreadToken
TerminateProcess

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadLibraryExW
GetProcAddress
GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-devices-query-l1-1-1

DevGetObjectPropertiesEx

api-ms-win-devices-query-l1-1-0

DevFreeObjectProperties

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegGetValueW

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: iii323

2fa3d006e774952b3f9dff2dc941a2ed

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

rpcrt4

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-devices-query-l1-1-1

api-ms-win-devices-query-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

Sections

.text Size: 56KB - Virtual size: 56KB

.rdata Size: 32KB - Virtual size: 32KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 56KB - Virtual size: 56KB

.rdata
Size: 32KB - Virtual size: 32KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB