svchost[.]exe_

Sharing

Copy URL Twitter E-mail

General

Target

svchost.exe_
Size

1.3MB
MD5

3d79ad138a37a7a854b5a1b22657f711
SHA1

9d995e0a9f1474e82f2f9bb2fbf7d96bde5ff160
SHA256

5577d18b54433d58c4f8ee7fd0dd0961af2965003637dca4a6cad8f805c093ae
SHA512

da69e7382c63b81611ad1ec951205ba6b69ca62865efc9dd832dd95955f443f9164ed403b01b0da6ed78434b9644905f3cc8e3418177bfae66d8b1d60ace4c9c
SSDEEP

24576:MDivo81oS1pk8w5QGLQ9JmcMljVIH06iySE:MDp81Z1pXw5pLQzMXIU6iN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
svchost.exe_

Files

svchost.exe_
.exe windows:6 windows x64 arch:x64

c20d3fc99c8481f20040a14b0f5cfa92

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

FormatMessageW
GetModuleFileNameW
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
EncodePointer
PostQueuedCompletionStatus
SetHandleInformation
GetCurrentProcessId
TryAcquireSRWLockExclusive
LoadLibraryA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetSystemInfo
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
WaitForSingleObjectEx
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
CreateEventW
CancelIo
ReadFile
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetCurrentDirectoryW
RtlCaptureContext
OpenProcess
AcquireSRWLockShared
SetLastError
AcquireSRWLockExclusive
ReleaseSRWLockShared
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
SwitchToThread
HeapReAlloc
GetModuleHandleW
WriteConsoleW
LocalFree
VirtualQueryEx
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
DeviceIoControl
UnhandledExceptionFilter
GetTickCount64
GetConsoleMode
GetProcessHeap
RtlLookupFunctionEntry
GetEnvironmentVariableW
ReleaseMutex
GetCurrentProcess
GetStdHandle
GetLogicalDrives
GetCurrentThread
HeapAlloc
GetProcAddress
SetThreadStackGuarantee
AddVectoredExceptionHandler
MultiByteToWideChar
GetExitCodeProcess
WaitForSingleObject
GetOverlappedResult
WaitForMultipleObjects
RaiseException
GetModuleHandleA
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
SetCurrentDirectoryW
lstrlenW
WakeAllConditionVariable
GetHandleInformation
CreateIoCompletionPort
GetQueuedCompletionStatusEx
InitializeSRWLock
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitOnceExecuteOnce
SetFileCompletionNotificationModes
WakeConditionVariable
RtlVirtualUnwind
SleepConditionVariableSRW
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
HeapFree
TerminateProcess
InitializeCriticalSectionAndSpinCount
TlsAlloc
RtlUnwindEx
CreateMutexA
ReadProcessMemory
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GlobalMemoryStatusEx
GetLogicalProcessorInformationEx
GetLastError
LoadLibraryExW
CloseHandle
RtlPcToFileHeader
CompareStringOrdinal
ReleaseSRWLockExclusive

pdh

PdhCloseQuery
PdhGetFormattedCounterValue
PdhOpenQueryA
PdhCollectQueryData
PdhRemoveCounter
PdhAddEnglishCounterW

advapi32

RegOpenKeyExW
RegQueryValueExW
GetUserNameW
OpenProcessToken
RegCloseKey
GetTokenInformation
IsValidSid
GetLengthSid
CopySid
RegEnumKeyExW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
LookupAccountSidW
SystemFunction036

user32

EnumDisplayMonitors
EnumDisplaySettingsExW
GetMonitorInfoW
GetWindowRect
GetDesktopWindow
MonitorFromPoint

gdi32

SelectObject
GetObjectW
CreateCompatibleDC
DeleteDC
SetStretchBltMode
CreateCompatibleBitmap
StretchBlt
CreateDCW
GetDIBits
GetDeviceCaps
DeleteObject

ws2_32

getsockopt
select
connect
WSAGetLastError
ioctlsocket
getaddrinfo
WSAStartup
closesocket
WSACleanup
WSASocketW
recv
WSASend
freeaddrinfo
setsockopt
WSAIoctl
send

shell32

SHGetKnownFolderPath
CommandLineToArgvW

ole32

CoInitializeEx
CoUninitialize
CoTaskMemFree
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance

ntdll

NtQuerySystemInformation
NtQueryInformationProcess
RtlNtStatusToDosError
NtWriteFile
NtReadFile
RtlGetVersion

bcrypt

BCryptGenRandom

iphlpapi

FreeMibTable
GetIfEntry2
GetIfTable2
GetAdaptersAddresses

netapi32

NetApiBufferFree
NetUserGetLocalGroups
NetUserGetInfo
NetUserEnum

secur32

LsaEnumerateLogonSessions
LsaFreeReturnBuffer
LsaGetLogonSessionData

powrprof

CallNtPowerInformation

oleaut32

SysFreeString
SysAllocString
VariantClear

psapi

GetPerformanceInfo
GetModuleFileNameExW

api-ms-win-crt-string-l1-1-0

wcsncmp
strcpy_s
wcslen

api-ms-win-crt-heap-l1-1-0

calloc
free
malloc
realloc
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_c_exit
_exit
_initialize_onexit_table
exit
_set_app_type
_cexit
terminate
_initterm_e
_initterm
_seh_filter_exe
abort
_errno
_get_initial_narrow_environment
_initialize_narrow_environment
__p___argv
_wassert
_crt_atexit
__p___argc
_register_onexit_function
_configure_narrow_argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 834KB - Virtual size: 833KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 434KB - Virtual size: 433KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c20d3fc99c8481f20040a14b0f5cfa92

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

pdh

advapi32

user32

gdi32

ws2_32

shell32

ole32

ntdll

bcrypt

iphlpapi

netapi32

secur32

powrprof

oleaut32

psapi

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 834KB - Virtual size: 833KB

.rdata Size: 434KB - Virtual size: 433KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 26KB - Virtual size: 25KB

_RDATA Size: 512B - Virtual size: 348B

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 834KB - Virtual size: 833KB

.rdata
Size: 434KB - Virtual size: 433KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 26KB - Virtual size: 25KB

_RDATA
Size: 512B - Virtual size: 348B

.reloc
Size: 6KB - Virtual size: 5KB