pGUAYVFxbN
Static task
static1
Behavioral task
behavioral1
Sample
svchost.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
svchost.dll
Resource
win10v2004-20220414-en
General
-
Target
svchost.dll
-
Size
2.6MB
-
MD5
1e561bf546eef5bb80e25ae25720199b
-
SHA1
2b182d08aeb6a4740c543e7e4b0c85034e89953c
-
SHA256
5bda2ccd3e92981caa7e60e21efa4fb96b6d1f3657361232e4958d900d816d6a
-
SHA512
3299b2b5436d2e01736a73a03654d4620bd533cb2695c8b9abe4a60cbd42f0155d8f11cb7d3e636b9c5a5caae993db04070f9f828b50e1c9f137760f1f82d255
-
SSDEEP
49152:/TJbbKekSCr84UEzgNkj+jec62ErgavWUNjEVC82KfVAbP:/TZbKekSCr8FlI+jP67E/UNIVC82qeP
Malware Config
Signatures
Files
-
svchost.dll.dll windows x64
0c85cc919aa73be02e9d5d942c58302e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateFileA
FindFirstFileA
FindNextFileA
LockFile
UnlockFile
CloseHandle
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ExitProcess
CreateThread
GetCurrentThreadId
FreeLibrary
GetModuleFileNameA
GetModuleHandleExA
GetProcAddress
CreateFileMappingA
LoadLibraryA
CreateActCtxA
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
Exports
Exports
Sections
.text Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ