hostsfix[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
hostsfix.exe
Size 167KB
Sample260723-ph3n5ack4s
SHA256 5362ee8d7f1d7d263dfa8570adb839855d28f1f520a477f1733cc4f7707149ca
MD5 4cfc5d538fccba273032765605586097
SHA1 94f2fe106045885f107968efcb323e92676d3d8d
SHA512 25cac75e3f6d7fb951cccc57ba96cb739e612adbc520bfcb3162fbe23d61b91b089b6b680544df9c1b22e6a9d0f878ae095d503ab272080e1e6b3a2b18e61d3f
SSDEEP 3072:aUBZ36A3AhfmuJewyPn1CDvoc8vIeOJXZwYvXpPpP1WZOqG0Su/:aUrqA3AheuswyPn0DuDOJTv5PWo8Sg
TLSH
T1A4F3839A5B4714E4CA92C03225F8A1EB5B2C3DB0F5FBA0FC635D063CBA11B6A5D135D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hostsfix.exe

File Explorer

hostsfix.exe

.exe 167KB

hostsfix.exe

IMPHASH 50610e34092d6ce13e51e7c9d5197081
SHA256 5362ee8d7f1d7d263dfa8570adb839855d28f1f520a477f1733cc4f7707149ca
MD5 4cfc5d538fccba273032765605586097
SHA1 94f2fe106045885f107968efcb323e92676d3d8d
SHA512 25cac75e3f6d7fb951cccc57ba96cb739e612adbc520bfcb3162fbe23d61b91b089b6b680544df9c1b22e6a9d0f878ae095d503ab272080e1e6b3a2b18e61d3f
SSDEEP 3072:aUBZ36A3AhfmuJewyPn1CDvoc8vIeOJXZwYvXpPpP1WZOqG0Su/:aUrqA3AheuswyPn0DuDOJTv5PWo8Sg
TLSH
T1A4F3839A5B4714E4CA92C03225F8A1EB5B2C3DB0F5FBA0FC635D063CBA11B6A5D135D2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

42968

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb

comctl32

ord17

kernel32

DeleteFileA DeleteFileW CreateDirectoryA CreateDirectoryW FindClose FindNextFileA FindFirstFileA FindNextFileW FindFirstFileW GetTickCount WideCharToMultiByte MultiByteToWideChar GetVersionExA GlobalAlloc lstrlenA GetModuleFileNameA FindResourceA GetModuleHandleA HeapAlloc GetProcessHeap HeapFree HeapReAlloc CompareStringA ExitProcess GetLocaleInfoA GetNumberFormatA GetProcAddress DosDateTimeToFileTime GetDateFormatA GetTimeFormatA FileTimeToSystemTime FileTimeToLocalFileTime ExpandEnvironmentStringsA WaitForSingleObject SetCurrentDirectoryA Sleep GetTempPathA MoveFileExA GetModuleFileNameW SetEnvironmentVariableA GetCommandLineA LocalFileTimeToFileTime SystemTimeToFileTime GetSystemTime IsDBCSLeadByte GetCPInfo FreeLibrary LoadLibraryA GetCurrentDirectoryA GetFullPathNameA SetFileAttributesW SetFileAttributesA GetFileAttributesW GetFileAttributesA WriteFile GetStdHandle ReadFile SetLastError CreateFileW CreateFileA GetFileType SetEndOfFile SetFilePointer MoveFileA SetFileTime GetCurrentProcess CloseHandle GetLastError lstrcmpiA

user32

ReleaseDC GetDC SendMessageA wsprintfA SetDlgItemTextA EndDialog DestroyIcon SendDlgItemMessageA GetDlgItemTextA DialogBoxParamA IsWindowVisible WaitForInputIdle GetSysColor PostMessageA SetMenu SetFocus LoadBitmapA LoadIconA CharToOemA OemToCharA GetClassNameA CharUpperA GetWindowRect GetParent MapWindowPoints CreateWindowExA UpdateWindow SetWindowTextA LoadCursorA RegisterClassExA SetWindowLongA GetWindowLongA DefWindowProcA PeekMessageA GetMessageA DispatchMessageA DestroyWindow GetClientRect CopyRect IsWindow MessageBoxA ShowWindow GetDlgItem EnableWindow FindWindowExA wvsprintfA CharToOemBuffA LoadStringA SetWindowPos GetWindowTextA GetWindow GetSystemMetrics OemToCharBuffA TranslateMessage

gdi32

GetDeviceCaps GetObjectA CreateCompatibleBitmap SelectObject StretchBlt CreateCompatibleDC DeleteObject DeleteDC

comdlg32

GetSaveFileNameA CommDlgExtendedError GetOpenFileNameA

advapi32

LookupPrivilegeValueA RegOpenKeyExA RegQueryValueExA RegCreateKeyExA RegSetValueExA RegCloseKey SetFileSecurityW SetFileSecurityA OpenProcessToken AdjustTokenPrivileges

shell32

ShellExecuteExA SHFileOperationA SHGetFileInfoA SHGetSpecialFolderLocation SHGetMalloc SHBrowseForFolderA SHGetPathFromIDListA SHChangeNotify

ole32

CreateStreamOnHGlobal OleInitialize CoCreateInstance OleUninitialize CLSIDFromString

oleaut32

VariantInit