vshost[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
vshost.exe
Size 2.4MB
Sample260629-par8esev6m
SHA256 f07b3bf518ed267db82ce81086facbf9502c45118d99de5fcb86b378879ddeb6
MD5 12752a95c804bc68131219174c06dbaa
SHA1 b474cc92cf0effb0704f5f04645a9574cebe5c80
SHA512 152a0205d1f42bced62542e16ffa3080b38d5b95868111bed32c9780fc83940442b005e25a046ff705034169bf1d4c237e7b9904d8ca4877bfa50ac9f957ff87
SSDEEP 49152:l+qzo3wm4kOyo+2UM20GKnHasaJtVxjDcDugMNCiO:dzTwond20GKKDRR
TLSH
T1E3B59E22FB829072E4D701B012AAABFB5D7D6630533558C7E3C02D6A59206D3763AF5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
vshost.exe

File Explorer

vshost.exe

.exe 2.4MB

vshost.exe

IMPHASH 8684487403c12451c5bccaac8ca8596d
SHA256 f07b3bf518ed267db82ce81086facbf9502c45118d99de5fcb86b378879ddeb6
MD5 12752a95c804bc68131219174c06dbaa
SHA1 b474cc92cf0effb0704f5f04645a9574cebe5c80
SHA512 152a0205d1f42bced62542e16ffa3080b38d5b95868111bed32c9780fc83940442b005e25a046ff705034169bf1d4c237e7b9904d8ca4877bfa50ac9f957ff87
SSDEEP 49152:l+qzo3wm4kOyo+2UM20GKnHasaJtVxjDcDugMNCiO:dzTwond20GKKDRR
TLSH
T1E3B59E22FB829072E4D701B012AAABFB5D7D6630533558C7E3C02D6A59206D3763AF5F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1838957

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

getsockopt closesocket select WSAGetLastError getaddrinfo WSACreateEvent socket connect recv freeaddrinfo ioctlsocket setsockopt WSACloseEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents WSASetLastError ntohs WSAStartup WSACleanup bind getpeername getsockname htons WSAIoctl __WSAFDIsSet accept htonl send listen gethostname sendto recvfrom

wldap32

ord217 ord46 ord211 ord60 ord45 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord143

crypt32

CryptUnprotectData CryptStringToBinaryA CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFreeCertificateChainEngine CertFindExtension CertFreeCertificateChain CertGetCertificateChain CertOpenStore CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA

advapi32

GetTokenInformation GetUserNameW RegOpenKeyExW RegCloseKey DuplicateToken OpenProcessToken ImpersonateLoggedOnUser LookupPrivilegeValueA RevertToSelf AdjustTokenPrivileges RegDeleteValueW RegSetValueExW SystemFunction036 CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA OpenThreadToken RegDeleteKeyW RegCreateKeyExW RegQueryValueExW

kernel32

EncodePointer LCMapStringEx CompareStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime WriteConsoleW CreateThread ExitThread FreeLibraryAndExitThread ExitProcess SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleOutputCP GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle GetTimeZoneInformation FormatMessageA MultiByteToWideChar AreFileApisANSI ReadFile TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA IsValidCodePage WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle RaiseException GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers SizeofResource FindFirstFileW FindNextFileW GetModuleFileNameW InitializeCriticalSectionEx FindResourceA FindClose OpenProcess LockResource LoadResource DecodePointer GetComputerNameW CreateProcessW GetModuleHandleW Process32First TerminateProcess CreateToolhelp32Snapshot Process32Next CreateProcessA GetCurrentProcess K32GetModuleFileNameExW K32EnumProcesses CreateDirectoryW GetModuleFileNameA RemoveDirectoryW SetFileAttributesW K32GetModuleFileNameExA Process32NextW Process32FirstW GetNativeSystemInfo GlobalLock CopyFileW QueryFullProcessImageNameW GlobalUnlock ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError SetEvent CreateEventA GetCurrentThread GetSystemDirectoryA GetModuleHandleA SleepEx MoveFileExA GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoW GetFileSizeEx GetCurrentDirectoryW InitOnceBeginInitialize InitOnceComplete GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable TryAcquireSRWLockExclusive GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW GetLocaleInfoEx LoadLibraryA GetFileInformationByHandleEx GetFileInformationByHandle FindFirstFileExW QueryPerformanceFrequency

user32

MessageBoxW ReleaseDC GetClipboardData CloseClipboard GetMonitorInfoW OpenClipboard EnumDisplayMonitors SendMessageA EmptyClipboard GetDC DestroyWindow

gdi32

GetDIBits GetObjectA BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC CreateDCW DeleteDC DeleteObject

shell32

SHGetKnownFolderPath ShellExecuteExW SHGetFolderPathW

ole32

CreateStreamOnHGlobal CoTaskMemFree CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoUninitialize

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

api-ms-win-shcore-scaling-l1-1-1

SetProcessDpiAwareness

shlwapi

StrStrIW

bcrypt

BCryptSetProperty BCryptDecrypt BCryptGenRandom BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider

gdiplus

GdipSaveImageToStream GdiplusStartup GdiplusShutdown GdipGetImageEncoders GdipCloneImage GdipAlloc GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipFree GdipGetImageEncodersSize

avicap32

capCreateCaptureWindowA