svchost[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

svchost.exe
Size

1.4MB
MD5

f86af47d52c3cd035c137d3a3097d06f
SHA1

5ec629884fea63bb82e2dffa441dca353d5f80e4
SHA256

eb977a803d155ea25837fa400dff81e8336746e6ed9f563cfaee92a544104705
SHA512

5f39928faa0fb04f2abc80565eea16d3522073768e5acf729619a8d0cc549199826193b2eef1eb8d5dd0c664461522748c5b2c1c3568ffb0a0b851ec29ffc04e
SSDEEP

24576:nkRRYVc2w2S8gtDXA9Ungu9yAsPRXtgcpOB82BgZlArww2hDpQzKt5pG:kfjvtD6A/yNRXNp+gZlAR2RSzKtu

Score

N/A

Malware Config

Signatures

Files

svchost.exe
.exe windows x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-03-2020 18:39

Not After

03-03-2021 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:d8:e6:7b:7f:a2:77:b8:2d:cb:b3:83:90:d0:61:32:6e:ae:da:e5:c7:31:a4:c0:ad:99:7d:73:fb:2f:4a:42
Signer

Actual PE Digest

11:d8:e6:7b:7f:a2:77:b8:2d:cb:b3:83:90:d0:61:32:6e:ae:da:e5:c7:31:a4:c0:ad:99:7d:73:fb:2f:4a:42

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

02-06-2022 18:29
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 263KB - Virtual size: 536KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 47KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 1KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 19KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 174KB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.micro
Size: 934KB - Virtual size: 936KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

11:d8:e6:7b:7f:a2:77:b8:2d:cb:b3:83:90:d0:61:32:6e:ae:da:e5:c7:31:a4:c0:ad:99:7d:73:fb:2f:4a:42Signer

Signature Validations

Verification

02-06-2022 18:29 Valid: false

Headers

DLL Characteristics

File Characteristics

Sections

Size: 263KB - Virtual size: 536KB

Size: 47KB - Virtual size: 108KB

Size: 1KB - Virtual size: 20KB

Size: 19KB - Virtual size: 28KB

Size: 174KB - Virtual size: 2.5MB

.micro Size: 934KB - Virtual size: 936KB

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

11:d8:e6:7b:7f:a2:77:b8:2d:cb:b3:83:90:d0:61:32:6e:ae:da:e5:c7:31:a4:c0:ad:99:7d:73:fb:2f:4a:42
Signer

02-06-2022 18:29
Valid: false

.micro
Size: 934KB - Virtual size: 936KB