fontdrvhost[.]exe | Triage

Sharing

General

Target

fontdrvhost.exe
Size

904KB
MD5

f41ddb7839baaf8afb9e06244cca63af
SHA1

a28a821a6259a502291085e606c3d6695f76b77e
SHA256

bb87be5fac469d9486bd959166ad1a879a361651450fef3ab4e23d89e387aac2
SHA512

d9af2a8786067027b3e13200f2102c3df58db236c3aba1f2b2f6adbd4de49e867991120f1afac9642e9d647c5e2c3f5da121f19baf9ec11bc441a0fb5f001421
SSDEEP

12288:gpM6njfvne5t4vVc5mbljYDuRm/e5t4vVc5mbljYDuRmg5t4vVc5mbljYDuRm4:unbAmmCsbAmmCKAmmC5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fontdrvhost.exe

Files

fontdrvhost.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\TD-Files\TD\FiveM\Premium 3 C# Loader New - hider, new\obj\Release\fontdrvhost.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 832KB - Virtual size: 832KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ