hostfxr[.]dll | Triage™

Resubmissions

23/09/2026, 14:14

260923-rj72ca1wax10

10/09/2026, 16:37

260910-t5bldaej6s3

31/07/2026, 21:22

260731-z8b9zagh743

Sharing

Copy URL Twitter E-mail

General

Target
hostfxr.dll
Size 1.8MB
Sample260910-t5bldaej6s
SHA256 3a8994928f512fffcb32e117ac45e0ee093541d99a9dba5f69a264f7f3054b19
MD5 a8adad7f62ff0fd80a1af50c81a74b28
SHA1 a8634004c63c9c91b2a66fbe77aaec5eaf0af5b7
SHA512 f8ce6a4b6a9fbe281fbe252d0f93476fe4e631994e35fcd5818832dd5b8fca8de063c10043f143697bcb19043083c605d25bdbc3ae49189428c78fe41e8439ae
SSDEEP 49152:7Z/J/JbAlb00gpMDdQSGMkZZ+GE01DzhGVKwgfZq5:73U9mE0WVLgfE5
TLSH
T100956D03E36781ACC16BC17886635776F5707C594538BD7F1A98DB321E32F609A2EB28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hostfxr.dll

File Explorer

hostfxr.dll

.dll 1.8MB

hostfxr.dll

IMPHASH 88e21b5991f5cd287116f3db7e94fbc3
SHA256 3a8994928f512fffcb32e117ac45e0ee093541d99a9dba5f69a264f7f3054b19
MD5 a8adad7f62ff0fd80a1af50c81a74b28
SHA1 a8634004c63c9c91b2a66fbe77aaec5eaf0af5b7
SHA512 f8ce6a4b6a9fbe281fbe252d0f93476fe4e631994e35fcd5818832dd5b8fca8de063c10043f143697bcb19043083c605d25bdbc3ae49189428c78fe41e8439ae
SSDEEP 49152:7Z/J/JbAlb00gpMDdQSGMkZZ+GE01DzhGVKwgfZq5:73U9mE0WVLgfE5
TLSH
T100956D03E36781ACC16BC17886635776F5707C594538BD7F1A98DB321E32F609A2EB28
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext GetUserNameA GetUserNameW RegCloseKey RegDeleteValueW RegEnumValueW RegOpenKeyExW RegQueryValueExW

crypt32

CertFreeCertificateContext CertGetCertificateContextProperty CryptBinaryToStringA CryptBinaryToStringW CryptStringToBinaryA

kernel32

AttachConsole CloseHandle ConnectNamedPipe CreateDirectoryW CreateEventA CreateFileW CreateNamedPipeW CreatePipe CreateProcessW CreateSemaphoreA CreateThread DeleteCriticalSection DeleteFileW DisableThreadLibraryCalls DisconnectNamedPipe DuplicateHandle EnterCriticalSection ExitProcess FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileW FindNextFileW FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetComputerNameA GetComputerNameExW GetComputerNameW GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileSize GetHandleInformation GetLastError GetLocalTime GetLogicalDriveStringsW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessAffinityMask GetProcessId GetProcessTimes GetStdHandle GetSystemDirectoryA GetSystemDirectoryW GetSystemTime GetSystemTimeAdjustment GetSystemTimeAsFileTime GetSystemWow64DirectoryW GetTempPathA GetTempPathW GetThreadContext GetThreadId GetThreadPriority GetThreadTimes GetTickCount GetTickCount64 GetVersionExA GetVolumeInformationW GetWindowsDirectoryA GetWindowsDirectoryW GlobalMemoryStatusEx InitializeCriticalSection IsDebuggerPresent IsProcessorFeaturePresent K32EnumProcesses LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalFree LockFile MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetEnvironmentVariableW SetEvent SetFileAttributesW SetHandleInformation SetLastError SetNamedPipeHandleState SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler lstrcmpiA lstrlenA

api-ms-win-crt-convert-l1-1-0

_wtoi atoi btowc mbrtowc mbsrtowcs strtol strtoul wcrtomb wctob

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_waccess _fstat64

api-ms-win-crt-heap-l1-1-0

calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func localeconv setlocale

api-ms-win-crt-math-l1-1-0

_fdopen

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmpex longjmp memchr memcmp memcpy memmove strchr wcsrchr

api-ms-win-crt-runtime-l1-1-0

_assert _beginthreadex _endthreadex _errno _execute_onexit_table _exit _initialize_onexit_table _initterm _initterm_e _register_onexit_function _set_errno abort strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf __stdio_common_vsprintf_s __stdio_common_vswprintf_s _fseeki64 _ftelli64 _get_osfhandle _lseeki64 _wfopen fclose fflush fopen fputc fputs fputwc fread freopen fwrite getc getwc putc putwc setvbuf ungetc ungetwc _write _read _fileno

api-ms-win-crt-string-l1-1-0

iswalnum iswctype iswspace memset strcmp strcoll strlen strncmp strnlen strxfrm towlower towupper wcscmp wcscoll wcscpy_s wcslen wcsncpy_s wcsnlen wcsxfrm wctype _strdup

api-ms-win-crt-time-l1-1-0

strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

ole32

CoCreateGuid CoCreateInstance CoInitializeEx CoSetProxyBlanket CoUninitialize StringFromGUID2

oleaut32

SafeArrayAccessData SafeArrayCreate SafeArrayCreateVector SafeArrayDestroy SafeArrayPutElement SafeArrayUnaccessData SysAllocString SysFreeString SysStringLen VariantClear VariantInit

secur32

AcquireCredentialsHandleW DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

shell32

SHCreateDirectoryExW SHGetFolderPathW

ws2_32

FreeAddrInfoW GetAddrInfoW WSACleanup WSAGetLastError WSAStartup __WSAFDIsSet closesocket connect freeaddrinfo getaddrinfo getsockopt inet_ntop ioctlsocket recv select send setsockopt shutdown socket

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

117KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

115B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

hostfxr.dll

advapi32

crypt32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ole32

oleaut32

secur32

shell32

ws2_32

generic