inputhost[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
inputhost.exe
Size 3.0MB
Sample261102-qtt2sscv6p
SHA256 4795bfee1785b7df565aaeb46ff308eb1f8c5562c54276855c1d6d749b2857e1
MD5 c370d5066853da00410c9e32fbe82385
SHA1 a85128e7935ff2ff588cb56630b1f064fdb08072
SHA512 fe4381ec1daf2a61ab06d564e0ab822f9d85bec2dd0aa18cae4ae6540c4b6da6411c477b077ad952f4bb5c09d70c71ff4c381e055b7e3c8ce332f5613b10318d
SSDEEP 49152:9JcjBOtWAHloUR13x7ISvPowXiSFrCWrnnfYYIXr7GWNWJK:bTtX3laYI77GW5
TLSH
T173E5D016B3A901E8E1B3D178CA22A317E7327855173056FF13D44E666F23AE15EBBB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
inputhost.exe

File Explorer

inputhost.exe

.exe 3.0MB

inputhost.exe

IMPHASH ecbef7a8361019c5ec6f3a8cdeef5b91
SHA256 4795bfee1785b7df565aaeb46ff308eb1f8c5562c54276855c1d6d749b2857e1
MD5 c370d5066853da00410c9e32fbe82385
SHA1 a85128e7935ff2ff588cb56630b1f064fdb08072
SHA512 fe4381ec1daf2a61ab06d564e0ab822f9d85bec2dd0aa18cae4ae6540c4b6da6411c477b077ad952f4bb5c09d70c71ff4c381e055b7e3c8ce332f5613b10318d
SSDEEP 49152:9JcjBOtWAHloUR13x7ISvPowXiSFrCWrnnfYYIXr7GWNWJK:bTtX3laYI77GW5
TLSH
T173E5D016B3A901E8E1B3D178CA22A317E7327855173056FF13D44E666F23AE15EBBB01
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1435056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpOpen

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptImportKeyPair BCryptGenRandom BCryptHash BCryptVerifySignature

crypt32

CryptProtectData CryptUnprotectData CryptStringToBinaryA

d3d11

D3D11CreateDevice D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dcomp

DCompositionCreateDevice

winmm

timeEndPeriod timeBeginPeriod

ole32

CoCreateInstance CoCreateGuid CoTaskMemFree CoInitializeEx CoUninitialize

shell32

CommandLineToArgvW SHGetKnownFolderPath

kernel32

GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID SetFilePointerEx ReadConsoleW OutputDebugStringW IsValidLocale GetLocaleInfoW LCMapStringW IsValidCodePage GetACP LoadLibraryExW VirtualProtect UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext WriteFile TerminateProcess ExitProcess IsProcessorFeaturePresent FreeLibraryAndExitThread WriteConsoleW GetModuleHandleExW GetFileType CreateFileW GetFileSizeEx CloseHandle GetLastError WaitForSingleObject Sleep GetExitCodeProcess GetProcessId OpenProcess ReadProcessMemory WriteProcessMemory CreateFileMappingW MapViewOfFile UnmapViewOfFile QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW MultiByteToWideChar WideCharToMultiByte GetCommandLineW GetEnvironmentVariableW GetTempPathW QueryPerformanceCounter CreateMutexW GetProcessTimes GetCurrentProcess GetCurrentProcessId GetCurrentThread SetThreadPriority GetLocalTime GetTickCount64 GetWindowsDirectoryW GetModuleFileNameW GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW LocalFree lstrcmpiW MoveFileExW IsDebuggerPresent CheckRemoteDebuggerPresent GetOEMCP GlobalUnlock GlobalLock GlobalFree QueryPerformanceFrequency FreeLibrary LoadLibraryA GetLocaleInfoA CreateFileA ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap CreateFileMappingA GetStdHandle RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo CreateThread GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection WakeAllConditionVariable SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetExitCodeThread GetCurrentThreadId WaitForSingleObjectEx GetSystemTimePreciseAsFileTime GetFileInformationByHandleEx CopyFile2 AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx ExitThread GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapSize GlobalAlloc SetEndOfFile FormatMessageA

user32

SetCursorPos IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard MapVirtualKeyA GetKeyNameTextA GetDpiForWindow GetAncestor SetProcessDpiAwarenessContext SystemParametersInfoW LoadImageW LoadCursorW GetClassNameW SetWindowLongPtrW GetWindowLongPtrW PtInRect WindowFromPoint ScreenToClient GetCursorPos MessageBoxA AdjustWindowRectEx GetWindowRect GetWindowTextW SetWindowTextW SetForegroundWindow GetForegroundWindow GetSystemMetrics IsWindowEnabled EnableWindow SendInput GetAsyncKeyState IsIconic GetWindowDisplayAffinity SetWindowPos SetLayeredWindowAttributes ShowWindow DestroyWindow IsWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage GetWindow GetWindowThreadProcessId EnumWindows GetClientRect IsWindowVisible SetCursor ClientToScreen SetWindowDisplayAffinity

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

529KB

Virtual Size

529KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

857KB

Virtual Size

856KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

inputhost.exe

winhttp

bcrypt

crypt32

d3d11

d3dcompiler_47

dcomp

winmm

ole32

shell32

kernel32

user32

imm32

generic