Static task
static1
Behavioral task
behavioral1
Sample
svchost_protected.exe
Resource
win7-20240221-en
General
-
Target
svchost_protected.exe
-
Size
1.1MB
-
MD5
ef13ae353851b5448b525dd9b6d189a7
-
SHA1
5cb08d7d986225e77674abe45549f3eade02f773
-
SHA256
e7626fbc911bec3d24721e093c676ceae62ec3548e6a8b01f1da7026a48bb393
-
SHA512
2abb619491ba6b3f3edd56c3bfc73a3c8b95b397ca064ac5be602f9aa3ffc21541e49bd6171e99a5035507e9410671c62f1d176acd440ec70a66bf7a5b7d66e3
-
SSDEEP
24576:muytJtFbsMt+S4VXZPoYR0n2WNA+/Uz3L5jbSfatC1cSf:4JtFsw+FNZP3RFsPMDLFSeEcS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource svchost_protected.exe
Files
-
svchost_protected.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 18KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 186KB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 942KB - Virtual size: 944KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE