sahost[.]exe | Triage

Sharing

General

Target

sahost.exe
Size

635KB
MD5

92e7773bd2be4ff8dd137c8cfdef08c3
SHA1

dbcf1772fc6d31aa65b6a481662c808880ce5611
SHA256

d9863b7b710599bc2b308a0b78970da8c42ee5bc6d3dcda05c2de52a88125726
SHA512

7d3caa57f6585ffe44d3418df60f56e0ebe3937362788f5b509b3ac242852fd01aa833818d01130d192aed975783b3f3036c5e29a2d2a2deb84dff2b49d0b159
SSDEEP

12288:UPH4AnF0/ZDVliwXM0QxetWs2wqH4qRN7icI+bqs2kC:UAkEN5XMHxjYgwbo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sahost.exe

Files

sahost.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

vOqy.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 566KB - Virtual size: 566KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ