sihost[.]exe | Triage™

Resubmissions

12/07/2026, 00:53

260712-a8t3cady6t8

11/07/2026, 04:33

260711-e6154ady9s8

Sharing

Copy URL Twitter E-mail

General

Target
sihost.exe
Size 136KB
Sample260711-e6154ady9s
SHA256 6e271366388fbc5a1e2e5204e7cf98557b44db2e9e34e1b6a7c8e7b80e14caab
MD5 af9ba4aa79ba3cdd28236a06d05b70d4
SHA1 796e728f0e7f4d3d526535c263ea499635404a92
SHA512 27d75f582e4a7d799fd6644ce45eff1f8df070254f8f8eb8f54551ab4be640ef5fab9c7b49162a976bb788105926607530f5bf889aa481b06a53a8fdb83b12bf
SSDEEP 3072:/XnJlVBr9YjVjbMj/slbwnbTxwxAD0VCbpfgiK7d5:/XJlVR9YjxgklbwnvxnD6CbpfgiK
TLSH
T146D33A6D36E510F5E27AF13CC592060AE3B1B49153125BDF02A442AE0F97FE46D3E7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sihost.exe

File Explorer

sihost.exe

.exe 136KB

sihost.exe

IMPHASH 0c2e5d141aca7fb7e39618995321c151
SHA256 6e271366388fbc5a1e2e5204e7cf98557b44db2e9e34e1b6a7c8e7b80e14caab
MD5 af9ba4aa79ba3cdd28236a06d05b70d4
SHA1 796e728f0e7f4d3d526535c263ea499635404a92
SHA512 27d75f582e4a7d799fd6644ce45eff1f8df070254f8f8eb8f54551ab4be640ef5fab9c7b49162a976bb788105926607530f5bf889aa481b06a53a8fdb83b12bf
SSDEEP 3072:/XnJlVBr9YjVjbMj/slbwnbTxwxAD0VCbpfgiK7d5:/XJlVR9YjxgklbwnvxnD6CbpfgiK
TLSH
T146D33A6D36E510F5E27AF13CC592060AE3B1B49153125BDF02A442AE0F97FE46D3E7A1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

sihost.pdb

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm _c_exit _initterm_e _register_thread_local_exe_atexit_callback

api-ms-win-crt-private-l1-1-0

_o__crt_atexit _o__errno _o__exit _o__get_wide_winmain_command_line _o__initialize_onexit_table _o__initialize_wide_environment _o__invalid_parameter_noinfo _o__invalid_parameter_noinfo_noreturn _o__purecall _o__register_onexit_function _o__seh_filter_exe _o__set_app_type _o__set_fmode _o__set_new_mode memmove _o_exit _o_free _o_malloc _o_terminate __C_specific_handler __current_exception __current_exception_context __CxxFrameHandler3 _o___stdio_common_vswprintf _CxxThrowException _o__cexit _o__callnewh _o__configure_wide_argv _o___std_exception_destroy _o___std_exception_copy _o___p__commode _o__configthreadlocale wcsrchr __std_terminate __CxxFrameHandler4 memcmp memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA GetModuleHandleW GetProcAddress GetModuleHandleExW GetModuleFileNameW

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize Sleep InitOnceComplete

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection EnterCriticalSection CreateSemaphoreExW SetEvent InitializeCriticalSectionEx InitializeCriticalSectionAndSpinCount ReleaseSRWLockShared AcquireSRWLockShared ReleaseSRWLockExclusive AcquireSRWLockExclusive CreateEventW ResetEvent CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx ReleaseSemaphore ReleaseMutex WaitForSingleObject LeaveCriticalSection

api-ms-win-core-heap-l1-1-0

HeapSetInformation HeapAlloc HeapFree GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter GetLastError UnhandledExceptionFilter SetLastError

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer EventRegister EventActivityIdControl EventSetInformation EventUnregister

api-ms-win-core-processthreads-l1-1-0

SetThreadPriority CreateThread GetCurrentThreadId GetStartupInfoW GetCurrentProcessId SetProcessShutdownParameters GetCurrentProcess TerminateProcess GetCurrentThread

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent DebugBreak OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-com-l1-1-0

CoUninitialize CoInitializeSecurity CoInitializeEx CoGetApartmentType CoTaskMemAlloc CoCreateInstance CoTaskMemFree CoGetMalloc CoTaskMemRealloc CoRegisterClassObject CoCreateFreeThreadedMarshaler StringFromGUID2 CoRevokeClassObject

api-ms-win-core-heap-l2-1-0

LocalAlloc LocalFree

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

coremessaging

CoreUICreate

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer SetThreadpoolTimer CreateThreadpoolTimer

api-ms-win-security-base-l1-1-0

GetSecurityDescriptorDacl GetLengthSid CopySid MakeAbsoluteSD SetSecurityDescriptorDacl GetTokenInformation

api-ms-win-security-trustee-l1-1-0

BuildTrusteeWithSidW

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

ntdll

NtSetInformationProcess

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Name

.text

Size

72KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

fothk

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

32KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

900B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

sihost.exe

msvcp_win

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-synch-l1-2-1

coremessaging

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-trustee-l1-1-0

api-ms-win-security-provider-l1-1-0

ntdll

api-ms-win-core-registry-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

generic