taskhostsw.exe
First submission 2024-10-17 01:25:02
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
| Mime type: | application/x-dosexec |
| File size: | 643.02 KB (658448 bytes) |
| Compile time: | 2024-03-30 17:55:21 |
| MD5: | 5f0d270fd5e773cd03b98c72112e5426 |
| SHA1: | 62fdb5555dd2df30884918dfb02314f3ee59572e |
| SHA256: | 6f7297c7c71d0153376186340f768677b6a91d39e0c3834d9bdb506c9b954aae |
| Import Hash : | 671f2a1f8aee14d336bab98fea93d734 |
| Sections 5 | .text .rdata .data .ndata .rsrc |
| Directories 3 | import resource security |
File features detected
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://192.3.101.145/240/taskhostsw.exe  |
192.3.101.145 |
2024-10-17 01:25:02 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x660c | 26624 | 1745768b9da2f6050229e67ef05016dc68ba6d93 | 3b90adcd2f1248db844446cb2ef15486 | |
| .rdata | 0x8000 | 0x1340 | 5120 | 13f6167860cfbcc7990a21a83a3bde4373dfefcc | b3bd9ad1bd1020c5cf4d51a4d7b61e07 | |
| .data | 0xa000 | 0x25138 | 1536 | 72c5291f3d3d9e7bd2d564664152279a2370fd74 | c4e774255fea540ed5efa114edfa6420 | |
| .ndata | 0x30000 | 0xf000 | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
| .rsrc | 0x3f000 | 0x65b0 | 26112 | 96afe6b710cb7c9857a877e99e6587b58e2e8612 | fcc4cfc3e98fe6ef679138c9e3f42e29 |
PE Resources 5
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x3f208 | 23440 | |
| RT_DIALOG | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x45080 | 96 | |
| RT_GROUP_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x450e0 | 20 | |
| RT_VERSION | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x450f8 | 376 | |
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x45270 | 830 |
Meta infos 4
| Translation: | 0x0409 0x04b0 |
| ProductName: | Aetna Inc. |
| ProductVersion: | 3.3.0.0 |
| FileVersion: | 3.3.0.0 |
Anti debug functions 2
| FindWindowExA |
| GetLastError |
File signature
| MD5 | SHA1 | Block size | Virtual Address |
|---|---|---|---|
| 713951a8196f64f80583d16092cb4446 | d6131b8c707906e483e0f628456dc0418269b99b | 2328 | 656120 |
Strings analysis - File found
| Temporary |
| ~nsu%X.tmp |
| Library |
| ADVAPI32.dll |
| SHELL32.dll |
| COMCTL32.dll |
| %s%s.dll |
| ole32.dll |
| GDI32.dll |
| USER32.dll |
| KERNEL32.dll |
Strings analysis - Possible URLs found 1
| http://nsis.sf.net/NSIS_Error |
Import functions
| Name | Latest seen | MD5 |
|---|---|---|
| winiti.exe | 2024-07-19 16:48:03 | 6298475c0e4860db7568c5b231e3cca9 |
| 66f4186b24569_sfx_123_500.exe | 2024-09-25 16:33:02 | 9aca15a320ce8fe7eabb268f7116cbcc |