Behavioral task
behavioral1
Sample
svchostexe.exe
Resource
win7-20230703-en
General
-
Target
svchostexe.exe
-
Size
7.1MB
-
MD5
716c1920c48cf67eb21212edea8ba36d
-
SHA1
9427c93730422107832f42c1c7f34a1dd21dadb8
-
SHA256
1a5ef68208365f3575fb08d6fba84b3a8a6564cec61db97279a8574522defe7c
-
SHA512
5374086c6cb5171e42399077fbb37160be3f879c1d706f5fd9882272555d83aacf788d3b5e354f8c2c4b5209b42b7cedf1cc8bfa93182e257e915cd82b230746
-
SSDEEP
196608:hDcUG4raKu24YY7HVT4hV0AD6QgqKRgX:HmKr4YYH+EUWpgX
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource svchostexe.exe
Files
-
svchostexe.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ