apphost_dEV7lOB7z6[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
apphost_dEV7lOB7z6.exe
Size 1.1MB
Sample260818-sladjavcma
SHA256 78d01a4f6310752aef254a3f5cf9ec31816d52dadc75da72a9e425a867bb9281
MD5 dc6c6e49dcf960a14ffa4b5c01dd8388
SHA1 de2fc50b597dfd27f61172b46084c9e93416e51a
SHA512 868acab51651c08dcccded934827e8882c49e3077855b35916a7d3415c78cd4fcf69d3bd935af0524046b58b9f1528851a731eafcb62f66748767ceed49128fb
SSDEEP 24576:5+ubKPnC57+8ZnsTWzVvJfoFH11N+2ttMud3LbKi6tP5K2+:tbKPC5XoX1N+2tt/kPJ
TLSH
T1EE458E1E5B8402BCE0B2D578CF568892E776740A47B15EEF0AC04D625F27AF49F3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
apphost_dEV7lOB7z6.exe

File Explorer

apphost_dEV7lOB7z6.exe

.exe 1.1MB

apphost_dEV7lOB7z6.exe

IMPHASH 62b08797c28cd1f1674518143fc915d9
SHA256 78d01a4f6310752aef254a3f5cf9ec31816d52dadc75da72a9e425a867bb9281
MD5 dc6c6e49dcf960a14ffa4b5c01dd8388
SHA1 de2fc50b597dfd27f61172b46084c9e93416e51a
SHA512 868acab51651c08dcccded934827e8882c49e3077855b35916a7d3415c78cd4fcf69d3bd935af0524046b58b9f1528851a731eafcb62f66748767ceed49128fb
SSDEEP 24576:5+ubKPnC57+8ZnsTWzVvJfoFH11N+2ttMud3LbKi6tP5K2+:tbKPC5XoX1N+2tt/kPJ
TLSH
T1EE458E1E5B8402BCE0B2D578CF568892E776740A47B15EEF0AC04D625F27AF49F3A712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

558432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

kernel32

CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTickCount64 GetLastError Process32NextW OutputDebugStringW GetDiskFreeSpaceExW GetCurrentThread LoadLibraryA DeleteFileW Process32FirstW CloseHandle K32GetModuleInformation HeapAlloc GetLocalTime K32EnumProcesses GetWindowsDirectoryW GetProcAddress GlobalLock ReadProcessMemory GetComputerNameW GetCurrentProcessId GetProcessHeap GlobalMemoryStatusEx CreateProcessW GetModuleHandleW CopyFileW WideCharToMultiByte QueryFullProcessImageNameW K32EnumProcessModules QueryPerformanceCounter GetTickCount GlobalUnlock OpenThread IsDebuggerPresent VirtualQueryEx SetUnhandledExceptionFilter GetExitCodeProcess GetFileAttributesW OutputDebugStringA LoadLibraryExW LoadLibraryW FreeLibrary RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetLogicalDriveStringsW GetSystemTimeAsFileTime InitializeCriticalSectionEx GetExitCodeThread WaitForSingleObjectEx TryAcquireSRWLockExclusive AcquireSRWLockExclusive OpenProcess RtlCaptureStackBackTrace K32EnumProcessModulesEx GetModuleHandleA GetCurrentThreadId CreateFileW WaitForSingleObject GetEnvironmentVariableA Thread32First CreateMutexW GetTempPathW GetEnvironmentVariableW SetFilePointer SetErrorMode Thread32Next K32GetModuleFileNameExW SetEnvironmentVariableW GetModuleFileNameW TerminateProcess VirtualAlloc WriteFile GetCurrentProcess RtlUnwind SetLastError HeapFree VirtualProtect GetFileSizeEx GetVolumeInformationW QueryDosDeviceW ReadFile CreateDirectoryW SetEndOfFile RtlLookupFunctionEntry ReleaseSRWLockExclusive QueryPerformanceFrequency GetLocaleInfoEx FormatMessageA LocalFree WriteConsoleW HeapSize SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType SetFilePointerEx GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread RtlVirtualUnwind CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetCurrentDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx UnhandledExceptionFilter

user32

GetMessageW DefWindowProcW AllowSetForegroundWindow PostMessageW SetProcessDpiAwarenessContext DestroyWindow GetDC SetWindowPos MessageBoxW CreateWindowExW SendMessageW GetSystemMetrics SetWindowTextW RegisterClassExW ShowWindow IsWindow DispatchMessageW SetTimer SetWindowDisplayAffinity TranslateMessage LoadIconW LoadCursorW GetClientRect IsZoomed KillTimer PostQuitMessage UpdateWindow ReleaseCapture SetForegroundWindow LoadImageW ReleaseDC EnableWindow

gdi32

DeleteObject DeleteDC BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC CreateSolidBrush

comdlg32

GetOpenFileNameW CommDlgExtendedError

advapi32

AdjustTokenPrivileges GetTokenInformation OpenTraceW RegGetValueW RegCloseKey RegQueryValueExW RegOpenKeyExW EventUnregister EventWriteTransfer EventSetInformation EventRegister LookupPrivilegeValueW StartTraceW ProcessTrace CloseTrace AllocateAndInitializeSid OpenProcessToken FreeSid CheckTokenMembership ControlTraceW GetUserNameW

shell32

SetCurrentProcessExplicitAppUserModelID ShellExecuteW Shell_NotifyIconW SHGetFolderPathW

ole32

GetHGlobalFromStream CoCreateInstance CoInitializeEx CreateStreamOnHGlobal CoTaskMemFree

winhttp

WinHttpCloseHandle WinHttpQueryDataAvailable WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse

wininet

HttpOpenRequestW HttpQueryInfoA InternetOpenW HttpQueryInfoW InternetCloseHandle InternetConnectW HttpSendRequestA InternetSetOptionW InternetReadFile

gdiplus

GdipFree GdipSaveImageToStream GdipGetImageEncodersSize GdipDisposeImage GdiplusStartup GdipGetImageEncoders GdipCloneImage GdipAlloc GdipCreateBitmapFromHBITMAP

iphlpapi

GetAdaptersInfo

tdh

TdhGetProperty TdhGetPropertySize

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

bcrypt

BCryptCreateHash BCryptFinishHash BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptGetProperty

Name

.text

Size

718KB

Virtual Size

717KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

282KB

Virtual Size

282KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

94KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

apphost_dEV7lOB7z6.exe

version

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

winhttp

wininet

gdiplus

iphlpapi

tdh

dwmapi

bcrypt

generic