svchosts[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

svchosts.exe
Size

220KB
MD5

28b08dae6fe1c1af8921fc682a4d466d
SHA1

abedc3b269168207564d74a422b17dbece9b6a30
SHA256

f69a9632a9f823639d35ddd9c3e8cfb8ee92822812707b98aeb7e01dffc27460
SHA512

3a6b4ba2c38b593a89493646865503005d6b08d1f969989cbbb8767100041e629c3d442bffc106d848b93adae2997e3c4bea1795d65aeccb17ed2ca47f6d9494
SSDEEP

6144:khIkBR2npYC8n18lMkuT90UKR7sRa3Qt:khI1x8n1YMkuR09RIRa3e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
svchosts.exe

Files

svchosts.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 217KB - Virtual size: 217KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ