svchost[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

svchost.exe
Size

1.6MB
MD5

f3a03f7c5045a6712b011fcff8de3756
SHA1

87f146f66acde4e3443e2f8e727b7a59a8bc0ebc
SHA256

0b26cde3e3219104c124ccfd29fcdac35d480aaa3fde068686748a343b94f535
SHA512

08efe5ae901a75bfa9701e59b328c9a3de5525e0f4362416c1a1971f0845f4e4cd5dc8b2b114c6a9e55c18b5e9484eb8a2aed72980be0aa98787da179e143ec7
SSDEEP

24576:fO7OLeLClnqAnRfmkVpveqjNPQbOgCtsRWBWiY9NVTBmQNr6tJrAYU6LG9ud8g3U:fiOLeaDfEYWyltsQWz/BHetJPU6+x

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
svchost.exe

Files

svchost.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ