scvh0st[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

scvh0st.exe
Size

7.5MB
MD5

a20cbf1fa8df8000af05d545cd83c73b
SHA1

65a63d642c63152595ecda6fbc2a53458d954f65
SHA256

02f0d67f3d1775e58ce57320ab3aca351ea708003acb95473466ec0f012c99ff
SHA512

8e56153e172b7c638d6337a85018fe4b272271b5372c1f5295477d6f2f15573a30af76915108719445ca9b2df6801959a81ec7b8eb35cba33623932a2c431bfd
SSDEEP

196608:6uhtVi9cvrXu/9ptM5ZDA2ARTYFav/xuM9TIqfcqG5KE:9htViGvru//iZALTY4xTVvcqk

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

scvh0st.exe
.exe windows x64

861ee65b120ae218c4c55f236e3ab85d

Code Sign

75:74:2b:f4:bb:7a:68:cd:fc:6e:9d:37:4d:1e:db:ab:d2:0f:ac:e2
Certificate

Issuer

CN=Brian.com,L=Hong Kong,ST=Central and Western District,C=HK

Not Before

28/04/2023, 01:56

Not After

27/04/2024, 01:56

Subject

CN=Brian.com,L=Hong Kong,ST=Central and Western District,C=HK

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

75:74:2b:f4:bb:7a:68:cd:fc:6e:9d:37:4d:1e:db:ab:d2:0f:ac:e2
Certificate

Issuer

CN=Brian.com,L=Hong Kong,ST=Central and Western District,C=HK

Not Before

28/04/2023, 01:56

Not After

27/04/2024, 01:56

Subject

CN=Brian.com,L=Hong Kong,ST=Central and Western District,C=HK

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b6:97:4c:b6:3e:8b:17:43:3b:b7:8a:1b:7e:1e:4a:74:35:54:b7:ff:da:c6:76:8b:53:98:f5:3f:65:ca:2e:5e
Signer

Actual PE Digest

b6:97:4c:b6:3e:8b:17:43:3b:b7:8a:1b:7e:1e:4a:74:35:54:b7:ff:da:c6:76:8b:53:98:f5:3f:65:ca:2e:5e

Digest Algorithm

sha256

PE Digest Matches

true

12:9b:59:92:cf:c2:b4:47:10:c2:e0:9f:ab:d6:3c:e0:a4:9d:61:df
Signer

Actual PE Digest

12:9b:59:92:cf:c2:b4:47:10:c2:e0:9f:ab:d6:3c:e0:a4:9d:61:df

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

DestroyAcceleratorTable
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

gdi32

GetDIBits

oleaut32

SysAllocString

msimg32

AlphaBlend

comctl32

ImageList_Destroy

shlwapi

PathFindFileNameA

oledlg

ord8

gdiplus

GdipGetImageGraphicsContext

oleacc

AccessibleObjectFromWindow

imm32

ImmReleaseContext

winmm

PlaySoundA

winspool.drv

GetJobA

comdlg32

GetFileTitleA

advapi32

RegQueryValueA

shell32

SHGetPathFromIDListA

ole32

CoRegisterMessageFilter

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 680KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 7.5MB - Virtual size: 7.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

861ee65b120ae218c4c55f236e3ab85d

Code Sign

75:74:2b:f4:bb:7a:68:cd:fc:6e:9d:37:4d:1e:db:ab:d2:0f:ac:e2Certificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

75:74:2b:f4:bb:7a:68:cd:fc:6e:9d:37:4d:1e:db:ab:d2:0f:ac:e2Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

b6:97:4c:b6:3e:8b:17:43:3b:b7:8a:1b:7e:1e:4a:74:35:54:b7:ff:da:c6:76:8b:53:98:f5:3f:65:ca:2e:5eSigner

12:9b:59:92:cf:c2:b4:47:10:c2:e0:9f:ab:d6:3c:e0:a4:9d:61:dfSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

oleaut32

msimg32

comctl32

shlwapi

oledlg

gdiplus

oleacc

imm32

winmm

winspool.drv

comdlg32

advapi32

shell32

ole32

wtsapi32

Sections

.text Size: - Virtual size: 1.9MB

.rdata Size: - Virtual size: 680KB

.data Size: - Virtual size: 86KB

.pdata Size: - Virtual size: 91KB

text Size: - Virtual size: 2KB

data Size: - Virtual size: 1KB

.vmp0 Size: - Virtual size: 5.5MB

.vmp1 Size: 7.5MB - Virtual size: 7.5MB

.rsrc Size: 31KB - Virtual size: 30KB

75:74:2b:f4:bb:7a:68:cd:fc:6e:9d:37:4d:1e:db:ab:d2:0f:ac:e2
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

75:74:2b:f4:bb:7a:68:cd:fc:6e:9d:37:4d:1e:db:ab:d2:0f:ac:e2
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

b6:97:4c:b6:3e:8b:17:43:3b:b7:8a:1b:7e:1e:4a:74:35:54:b7:ff:da:c6:76:8b:53:98:f5:3f:65:ca:2e:5e
Signer

12:9b:59:92:cf:c2:b4:47:10:c2:e0:9f:ab:d6:3c:e0:a4:9d:61:df
Signer

.text
Size: - Virtual size: 1.9MB

.rdata
Size: - Virtual size: 680KB

.data
Size: - Virtual size: 86KB

.pdata
Size: - Virtual size: 91KB

text
Size: - Virtual size: 2KB

data
Size: - Virtual size: 1KB

.vmp0
Size: - Virtual size: 5.5MB

.vmp1
Size: 7.5MB - Virtual size: 7.5MB

.rsrc
Size: 31KB - Virtual size: 30KB