taskhostw[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

taskhostw.exe
Size

110KB
MD5

aaa6ba42398b2d70f12f00a110701041
SHA1

ced61e8f26b48188e1aae8fc629ed45a666348d0
SHA256

58cc5757bb129557652797ea92aee701de5c574b22fdcd5dcddf141caeea3c02
SHA512

9bf01f585125add531b3ea912bdec980aed0eb53a20dfeb06be4cc5391c8fd75e8622e7246a499ed1cd5434ba7f50f058aa23938c2752d27cdd6e63bf788086a
SSDEEP

3072:DsyzW5Y8Vvg6vz/J+x+fHz51TYKsQEh23:JzEY0xzx++fV1TYKF3

Score

1^/10

Malware Config

Signatures

Files

taskhostw.exe
.exe windows:10 windows x64 arch:x64

1c4e2d9936e4d9f2490b08aab4d24260

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-02-2023 00:05

Not After

01-02-2024 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

78:8e:9d:6a:df:13:bc:98:80:20:f5:f8:9a:09:f0:5c:b5:c0:7d:89:29:79:8c:82:c4:fb:81:82:0d:61:9f:41
Signer

Actual PE Digest

78:8e:9d:6a:df:13:bc:98:80:20:f5:f8:9a:09:f0:5c:b5:c0:7d:89:29:79:8c:82:c4:fb:81:82:0d:61:9f:41

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

taskhostw.pdb

Imports

msvcrt

free
malloc
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
??3@YAXPEAX@Z
__CxxFrameHandler4
memmove
_XcptFilter
memcpy_s
memmove_s
??0exception@@QEAA@AEBV0@@Z
??1type_info@@UEAA@XZ
wcsstr
?what@exception@@UEBAPEBDXZ
_CxxThrowException
__CxxFrameHandler3
memcpy
_purecall
_onexit
calloc
_callnewh
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_commode
_fmode
_wcmdln
__C_specific_handler
_initterm
__setusermatherr
??1exception@@UEAA@XZ
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
memset

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapSize
HeapFree
HeapDestroy
GetProcessHeap
HeapAlloc

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetStartupInfoW
CreateThread
GetCurrentThread
SetProcessShutdownParameters
GetExitCodeThread
GetCurrentProcess
TerminateProcess
GetThreadPriority
SetThreadPriority
GetCurrentProcessId

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
LoadStringW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-security-base-l1-1-0

InitializeAcl
AddAce
GetAclInformation
GetSecurityDescriptorOwner
SetSecurityDescriptorOwner
IsValidSid
SetSecurityDescriptorGroup
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetSecurityDescriptorControl
MakeAbsoluteSD
InitializeSecurityDescriptor
GetLengthSid
CopySid
GetSidSubAuthority
CreateWellKnownSid
InitializeSid
GetSidLengthRequired
AllocateAndInitializeSid
GetSecurityDescriptorGroup
FreeSid

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeSRWLock
SetEvent
ResetEvent
CreateEventW
WaitForSingleObject

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer

ntdll

EtwTraceMessage
NtSetInformationProcess
RtlUnhandledExceptionFilter
RtlIsMultiSessionSku
DbgPrintEx

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 376B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 820B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1c4e2d9936e4d9f2490b08aab4d24260

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

78:8e:9d:6a:df:13:bc:98:80:20:f5:f8:9a:09:f0:5c:b5:c0:7d:89:29:79:8c:82:c4:fb:81:82:0d:61:9f:41Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-heap-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

ntdll

Sections

.text Size: 44KB - Virtual size: 43KB

.rdata Size: 32KB - Virtual size: 30KB

.data Size: 4KB - Virtual size: 2KB

.pdata Size: 4KB - Virtual size: 3KB

.didat Size: 4KB - Virtual size: 376B

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 820B

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

78:8e:9d:6a:df:13:bc:98:80:20:f5:f8:9a:09:f0:5c:b5:c0:7d:89:29:79:8c:82:c4:fb:81:82:0d:61:9f:41
Signer

.text
Size: 44KB - Virtual size: 43KB

.rdata
Size: 32KB - Virtual size: 30KB

.data
Size: 4KB - Virtual size: 2KB

.pdata
Size: 4KB - Virtual size: 3KB

.didat
Size: 4KB - Virtual size: 376B

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 820B