fontdrvhost[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
fontdrvhost.exe
Size 821KB
Sample260627-b6r1msg12l
SHA256 fec0c85ffdceab2d739114f6f04534250381860b0ac0859f8474f85e042001ee
MD5 e3b7f9d52327e9010eb53beb6f7c3a9d
SHA1 5ef58fa96fc28360ea41d0802d4f7dce22249397
SHA512 b5792b68c96897b839bc3109e81dfc110499e027805dc156aa797a4f41d7b322db85f430315f4759d8b64ac0af5d4e8d7ef76d2d2b6f159e3cbd23b1cae8f3dc
SSDEEP 12288:d58vIQLuLqVItq+I7+AubTctrcH0T26J6etHSbIiC9nFxgoh2:z8bLKUI037+xbTQrcH066JVjiWnFqE
TLSH
T11705AE45F2B900FAD07B9138D59ABA0BEA763809071069DB13D5469C3FB77E41BBB312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fontdrvhost.exe

File Explorer

fontdrvhost.exe

.exe 821KB

fontdrvhost.exe

IMPHASH 59cb39b8bdb6ef0006d35e15af3d6db5
SHA256 fec0c85ffdceab2d739114f6f04534250381860b0ac0859f8474f85e042001ee
MD5 e3b7f9d52327e9010eb53beb6f7c3a9d
SHA1 5ef58fa96fc28360ea41d0802d4f7dce22249397
SHA512 b5792b68c96897b839bc3109e81dfc110499e027805dc156aa797a4f41d7b322db85f430315f4759d8b64ac0af5d4e8d7ef76d2d2b6f159e3cbd23b1cae8f3dc
SSDEEP 12288:d58vIQLuLqVItq+I7+AubTctrcH0T26J6etHSbIiC9nFxgoh2:z8bLKUI037+xbTQrcH066JVjiWnFqE
TLSH
T11705AE45F2B900FAD07B9138D59ABA0BEA763809071069DB13D5469C3FB77E41BBB312
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

433840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetWindowThreadProcessId EnumWindows SetWindowLongW GetWindowLongW GetWindowTextA UpdateWindow GetSystemMetrics MapVirtualKeyW GetKeyNameTextW GetAsyncKeyState IsWindowVisible SetWindowPos SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage UnregisterHotKey RegisterHotKey PeekMessageW DispatchMessageW TranslateMessage LoadCursorW ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState DefWindowProcW GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard

kernel32

LoadLibraryExW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent TerminateProcess GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread ReadFile DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead WriteConsoleW OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock MultiByteToWideChar WideCharToMultiByte FlushFileBuffers QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA GetLocaleInfoA IsDBCSLeadByte GetStdHandle CreateFileW DeleteFileW WriteFile GetTempPathW IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle GetLastError CreateMutexW Sleep GetCurrentProcess ExitProcess OpenProcess GetTickCount GetTickCount64 ReadProcessMemory GetModuleFileNameW AllocConsole GetConsoleMode SetConsoleMode SetConsoleOutputCP SetConsoleCursorInfo SetConsoleScreenBufferSize SetConsoleWindowInfo SetConsoleTitleA GetConsoleWindow CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW GetConsoleOutputCP GetSystemTimeAsFileTime GetCurrentThreadId LCMapStringW GetFileType GlobalFree GetCurrentProcessId SetEndOfFile HeapReAlloc HeapSize GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileSizeEx SetFilePointerEx ReadConsoleW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW

shell32

ShellExecuteW

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

d3dcompiler_47

D3DCompile

d3d11

D3D11CreateDeviceAndSwapChain

winmm

timeEndPeriod timeBeginPeriod

winhttp

WinHttpCloseHandle WinHttpOpen WinHttpConnect WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetOption WinHttpQueryDataAvailable

ole32

CoCreateInstance CoInitialize CoUninitialize

Name

.text

Size

597KB

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

186KB

Virtual Size

185KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

440B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

fontdrvhost.exe

user32

kernel32

shell32

imm32

dwmapi

d3dcompiler_47

d3d11

winmm

winhttp

ole32

generic