sahost[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll

sahost.exe

IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
SHA256 e422323e3d0333b32a7dfbaf49befecd314d7e969d5848e71e07096ebc106604
MD5 3cd277b692b93cea6874d7879f1134d0
SHA1 074e16af7a0fdc9c8744edd85a72b088c219afb3
SHA512 c163e32f95467881f1bc234a68bd7e1e40081b753d36e9c70cc83c553577b1166de1ac2670379959afe8c84fdb2bd030f8a0fa1b9d076a460db047620aa0a0b3
SSDEEP 6144:TMm4CCe7wZZRdeg+FWMqn1g0qmaV0UnuBAPm5P9LX29AS+tPoc+2fvwPsgzG:TMwSdN+FWJghmzAPmdBjW4fZwG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

8c:99:a0:93:ec:c6:2a:16:9d:2c:48:e0:67:63:9b:b2:6c:c0:b6:ca:86:6b:82:4e:79:f7:06:b1:3a:ba:c4:31

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Wongsky afholdelsernes\ ,O=Kokerboom,L=Roca,ST=Nebraska,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

4

Entry point

13455

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/LangDLL.dll

IMPHASH 3e8d18bb71c7ebbda2ddc2a4bb03547b
SHA256 4883cd4231744be2dca4433ef62824b7957a3c16be54f8526270402d9413ebe6
MD5 08de81a4584f5201086f57a7a93ed83b
SHA1 266a6ecc8fb7dca115e6915cd75e2595816841a8
SHA512 b72e7cea5ce1f4dc64e65a1f683a3ef9e3fa2dc45cf421f569eb461f1fdcc0caf4ff62a872e62b400579f567c6ff9fc3c2e6e020cdca89d96015502c803a09b9
SSDEEP 48:S46+/1TKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mLofjLl:zHuPbOBtWZBV8jAWiAJCdv2CmeL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
MD5 6e55a6e7c3fdbd244042eb15cb1ec739
SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Guddomme.Gen

SHA256 298d4a8a68181b2151e3fd186faa6f6a6630c5e3a07db210a524e003d8cc0f38
MD5 f564f6fdde367bb7965fc8392eaa978b
SHA1 d23bf8557e4d61cddd87ea919b2a4f03040d78b4
SHA512 91872dfe34493e2400a7c35d7a601a86d31f33aa7b8696fb96918fd53d4fa70161975342d42edfb53c2586ca6fe07a445cc7ec903277e3a3d3f37d7f5dff07c2
SSDEEP 1536:D6PUYGxKE1W3MTonGMuGvbHUogVP09X7NOVzaqcKueY8NW799s:/hWzGayzaV1s
MD5 SHA1 SHA512 SSDEEP

Kontraktforholdene.Aro

SHA256 6f3094d50c44e9b8d4930486a05d114409f3ea6bd53762a61306030982287a5e
MD5 21d9e5a1e5ee62378ee957c2e35f2814
SHA1 78e5720f9ac016d29bd6d9fd5ed70e9787243082
SHA512 3ad34ae8f7c6758b64b020a5eb0e01cc98c70cf8df372552f1be315ff0fe586086ef38f8b02d270c1239737e199e1b8edce5915bb61b85c668b90f6a6b586224
SSDEEP 6144:OYMkqvMYp82l3vmFTgQgHO+77GXXOUb8vrqpu06m2lttMwFYg:O1kJYp8o3vegQiO+7Metrqpu06m2lvug
MD5 SHA1 SHA512 SSDEEP

Opspring.dia

SHA256 bd2421d6c1b53d016f7c61004bfa7640a36a25686d29d87372d736e241ad5314
MD5 82a269f5bae8475eacd0e5cf4c7fa6db
SHA1 e50aa449bfeab5c72eb98bf0f98d16c7b5846e23
SHA512 896244a0c5819e2d4979529797fab0b801fe4ca13dbf7039531ed157b8c4f55c512447878c5cc764fc78c1d01300894c038996d31ce66099deb930cfaa730a8b
SSDEEP 192:MVenofP5CL1Vkht0EjXViZ/jjRI6CUwHC6dqSAzZ+PHPwEc2VO:9s5CLwIaXkZLjMrC2EZ+PvwX
MD5 SHA1 SHA512 SSDEEP

Overfamiliarly.lit

SHA256 4336f9f5f28e007e6a48a5b2078d04fcbfabddf8fa91c7a1a1496965459600f2
MD5 19ad849311a96a6e4cf732f801e4e82f
SHA1 097a4d680e6ec048650497bf0a5de57045435ac2
SHA512 4b454937708f04506e2444434b005badd21cc7d901d72cd3ddfbb97e74c617d1a6558613c2ba6921c3c3c8818f920d6d635f82ca4a7037b37d87192fd45ee0b3
MD5 SHA1 SHA512

cuddled.txt

SHA256 17931d5fa3f3e93fe13344de61e8239d41a1b7b603493f07aa5a04d131557592
MD5 3483fab1a78f10e7784ca3ca3150b2ca
SHA1 fe5e671a0a0d3b278bef62e29d3bc95a6b842b82
SHA512 ec6d70b3f03dfd8ae89112e66a07847597d7d1d3b6a508fb396ddf0b7e69ff6109ea1929dd904d5fe6b7dc41fe79d599e05e3869483838416f95a0adb663d670
MD5 SHA1 SHA512

nsec.tar

SHA256 8f73ab5e525b86591b138f15fd4315876f07f0222683711d84a56966c5901a9f
MD5 39dcabfd6c10c19cc2d532b2c03e57ea
SHA1 1b2813c18ff9f2f6344704133e579a70d623f0e2
SHA512 2c63bdde2fcc891fdb41fc45d46dad3083828512704533e427ffc1d1c8a04140be96bfbfa6d4277b9ee2ad73983350452526583c38d0a2efe1631413f8e1eb26
SSDEEP 96:YPAr4BCbpOje1kysgOM27luhZl9ubZmlRe9zKOfTKeDxy8nO433trIO8syU+B8:Y4rSje1FI85uU78hTTDUB433tkGCu
MD5 SHA1 SHA512 SSDEEP

piggy.riv

SHA256 706a3591732ab4fc5a227386e6c3b32592f9a5467327c876d45a3070035c844b
MD5 0843d03d3c1cc92613470216de0ef1a1
SHA1 ac8e656c3a2044b4fc51b38ba985e57eabf0b995
SHA512 afdf0c65fd83f494a9d2a7094614d66608d7eef0e5427c74d2c2e787f3338c0c530a57055b5e3db5ac90c0c6cbc4f683d3c590e5477260bd7f9edb141a41b7cc
SSDEEP 192:A9k5U5K4UkC9ZN17ktv4u2vwusr8JwlHRPguH48XsSNdJOAosgASLfljirw:AsMtlCHTwCu29K8uJRhH488oJ4MSzc0
MD5 SHA1 SHA512 SSDEEP

produktionskden.slu

SHA256 d757263bdbcdb4ae46691df9bcb12e168f745a5716a9feea75c20e359e2ad2af
MD5 2bb28d61ddf2533ccbb803ddbe326bdc
SHA1 8b7c2571f544ec2aed6ac232d561fee3016d99c8
SHA512 66ddbf35ba173a8dcc8204426e66200436347890d2154a8bc604cdbe2da59577dcc35156d1a4ce46cf1e775d0e9aa6e875c28841b4f7adc78a77c7501e285cc8
SSDEEP 192:cvQVyl9vo9vkEB/g8s5GI4SGvPEu/mVI1PVpb80:c4V4xbEdR8T4SaFuVI7
MD5 SHA1 SHA512 SSDEEP

sahost.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Guddomme.Gen

Kontraktforholdene.Aro

Opspring.dia

Overfamiliarly.lit

cuddled.txt

nsec.tar

piggy.riv

produktionskden.slu

Sharing

General

Malware Config

Signatures

File Explorer

sahost.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Guddomme.Gen

Kontraktforholdene.Aro

Opspring.dia

Overfamiliarly.lit

cuddled.txt

nsec.tar

piggy.riv

produktionskden.slu