svchost[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
svchost.exe
Size 597KB
Sample251123-mc56yseq3x
SHA256 c290b6cabc5e418e02f796b67be6d9f7018f6092b3b4d74babf7e2748ff85fd6
MD5 e7ca18a5dd2de84180c872b02f1e8798
SHA1 11cf19b0e6e4ba8d27c4f30ffcb63757aef16fe6
SHA512 c101c6a760061177194eb4968491fb2d6494a37fc2c07c3df9fd32b6dd56ac3349defc80dcc98f1e7fef9bc4c3a475f581378af2c2f032b6adc4661a3d495772
SSDEEP 6144:UBsKFk5pfANiDyJ3xF4JYK5wf6t0FU29HUYoy:U3ijD43xFAwf6t0FUmHZ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
svchost.exe

File Explorer

svchost.exe

.exe 597KB

svchost.exe

IMPHASH 2a1bb0c52b45268a32bea7c08363145b
SHA256 c290b6cabc5e418e02f796b67be6d9f7018f6092b3b4d74babf7e2748ff85fd6
MD5 e7ca18a5dd2de84180c872b02f1e8798
SHA1 11cf19b0e6e4ba8d27c4f30ffcb63757aef16fe6
SHA512 c101c6a760061177194eb4968491fb2d6494a37fc2c07c3df9fd32b6dd56ac3349defc80dcc98f1e7fef9bc4c3a475f581378af2c2f032b6adc4661a3d495772
SSDEEP 6144:UBsKFk5pfANiDyJ3xF4JYK5wf6t0FU29HUYoy:U3ijD43xFAwf6t0FUmHZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleA ExitProcess lstrcmpi GetCurrentProcessId ExpandEnvironmentStringsA WriteFile GetProcessHeap GetStartupInfoW GetProcAddress GetCurrentThread CreateFileA MoveFileW WinExec OpenMutexA GetLogicalDriveStringsA FreeLibrary

user32

InsertMenuItemW EndMenu GetSysColorBrush GetCapture CreatePopupMenu CallWindowProcA CreateDialogParamA RegisterClassExA GetClassInfoExA DestroyIcon CharNextW BringWindowToTop CreateDesktopA GetWindowTextLengthA GetWindowTextLengthW GetClientRect keybd_event ActivateKeyboardLayout SetWindowRgn RegisterWindowMessageW IsIconic GetSystemMetrics PeekMessageA SetFocus SetMenu IsMenu mouse_event InvalidateRgn GetMenu LoadIconA GetCapture LoadMenuIndirectW LoadMenuA CharPrevA LoadMenuW GetClassInfoA GetDC GetClassInfoW CreateAcceleratorTableA WinHelpA

gdi32

CreateBitmapIndirect GetGlyphIndicesW SetPixelFormat CreateColorSpaceW GetTextExtentExPointI StrokePath CreatePalette CreateFontA

advapi32

RegCreateKeyExA RegQueryInfoKeyW RegCreateKeyExW RegSaveKeyW RegQueryInfoKeyA

shell32

SHGetDiskFreeSpaceExA StrRChrA StrStrW

shlwapi

UrlCompareA PathIsDirectoryA wnsprintfW StrSpnW

comctl32

FlatSB_GetScrollProp DllGetVersion ImageList_LoadImageW

urlmon

FindMediaType GetComponentIDFromCLSSPEC URLOpenPullStreamA FindMimeFromData URLDownloadToCacheFileW URLDownloadToFileW IsAsyncMoniker CoInternetQueryInfo DllRegisterServer FaultInIEFeature CoInternetCreateSecurityManager RevokeBindStatusCallback PrivateCoInstall IsLoggingEnabledW CoGetClassObjectFromURL CopyBindInfo

oledlg

OleUIChangeSourceA

crypt32

CertGetCertificateContextProperty I_CryptAddSmartCardCertToStore CertAddEncodedCRLToStore CertGetEnhancedKeyUsage CryptCreateKeyIdentifierFromCSP CertFreeCertificateContext CertFindChainInStore CertGetValidUsages CertGetStoreProperty CryptSignMessage CryptGetOIDFunctionValue CryptStringToBinaryW CertCreateCRLContext CertOpenSystemStoreW CryptSIPCreateIndirectData CryptVerifyCertificateSignature I_CryptEnumMatchingLruEntries I_CryptGetLruEntryIdentifier CryptVerifySignatureU

Name

.text

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.KQtnko

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.ekCw

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.lCVWhg

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.NVpk

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.lV

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.aPQcPU

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tH

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.QjKTjK

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.sKiMa

Size

129KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

168KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

svchost.exe

kernel32

user32

gdi32

advapi32

shell32

shlwapi

comctl32

urlmon

oledlg

crypt32

generic