Static task
static1
Behavioral task
behavioral1
Sample
svchost.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
svchost.exe
Resource
win10v2004-20231215-en
General
-
Target
EpicGlobal [V32].zip
-
Size
33.5MB
-
MD5
5eb9768fdf8b609ae3b1b52d6b8b0e63
-
SHA1
7c92f99c397005e3c9226cd6bea7f2cd64dcd0f3
-
SHA256
74cec943eefdaf35ed23a464f2e971ef885a17739c6e707f3771aa219389c04f
-
SHA512
14036f1beaca2fa22ef53000de16565c57234846cb9ab64f1e303675b76aed32b58a7396296017128a4db8033e76552ab4e37f33a3a4a9c95897acdc96869812
-
SSDEEP
786432:h4VG0ykTI/DvdwA2b3P1Url8ngS/A+j2KDxPDA:h8TKy3P02nD62x7A
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/svchost.exe
Files
-
EpicGlobal [V32].zip.zip
-
README.TXT
-
svchost.exe.exe windows:6 windows x64 arch:x64
fffc6b26bd166cb76fa8a5b162758c3f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
K32GetModuleFileNameExA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SwitchDesktop
CharUpperBuffW
advapi32
GetUserNameW
shell32
CommandLineToArgvW
ole32
CoGetObject
oleaut32
VariantClear
shlwapi
PathIsDirectoryW
ntdll
NtQuerySystemInformation
dbghelp
ImageNtHeader
d3d11
D3D11CreateDeviceAndSwapChain
ws2_32
setsockopt
imm32
ImmGetContext
d3dcompiler_47
D3DCompile
Sections
.text Size: - Virtual size: 623KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 227KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.EGlobal Size: - Virtual size: 32.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.EGlobal Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.EGlobal Size: 33.9MB - Virtual size: 33.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ