sihost64[.]exe | Triage

Sharing

General

Target

sihost64.exe
Size

31KB
MD5

99f6ddfde83c4a40084b29ec309336c7
SHA1

7246f470c153a8c107fb4ff153da01f76c14db8e
SHA256

37773977416a09ae07d05dda3ecf488bba262436cd59a161f8189aeac5a35c81
SHA512

c488d00bf7678d4c28b392ddf8749cdef8875b0e451c4e7d1dcf214acbd15bfc2d71d6514c3e122a2dd7fc91aee9d4257d4551eeb12983a2858c14c8ddf23b95
SSDEEP

768:Qvr89iyH9Pk/O0lXg6VtsHOjog+5ipycYyk0f:G8wyVkm02arf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

sihost64.exe

Files

sihost64.exe
.exe windows:4 windows x64 arch:x64

02549ff92b49cce693542fc9afb10102

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

malloc
memset
_get_pgmptr
getenv
sprintf
__argc
__argv
_environ
_XcptFilter
__set_app_type
_controlfp
__getmainargs
exit

kernel32

Sleep
CreateProcessA
SetUnhandledExceptionFilter

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ