svchost_d3ed59a2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
svchost_d3ed59a2.exe
Size 266KB
Sample260706-vkpsyady7j
SHA256 50a33096551be37d2378c59be12e6305685944252a50e0165e04826f6f3b1197
MD5 8465286c7238fa42a3fd383705cb0274
SHA1 e79fdcd1c2f388c6fa74a9c02447b1454d17574d
SHA512 43d049f5413f083d6854e208cc6aa771f1e066ac6b9d7d80e75e353de89e74b6adea022a3e001d1bd2ea3312e1b26b2e27968e438b86610c0e1f538e3c5d37cd
SSDEEP 6144:jRzBIDef6gFfSJDKf4Zcbj3S+vtgbCWX4j/zAGEKQ7c:NjwcbbS+qbCWoj/zA
TLSH
T1D4448D1673940DF9ED77C2BE8D814A46E7727C0607A0DADF07A086A65F236E05E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
svchost_d3ed59a2.exe

File Explorer

svchost_d3ed59a2.exe

.exe 266KB

svchost_d3ed59a2.exe

IMPHASH 54168ad88cdd1a46050db5e0abe4ec04
SHA256 50a33096551be37d2378c59be12e6305685944252a50e0165e04826f6f3b1197
MD5 8465286c7238fa42a3fd383705cb0274
SHA1 e79fdcd1c2f388c6fa74a9c02447b1454d17574d
SHA512 43d049f5413f083d6854e208cc6aa771f1e066ac6b9d7d80e75e353de89e74b6adea022a3e001d1bd2ea3312e1b26b2e27968e438b86610c0e1f538e3c5d37cd
SSDEEP 6144:jRzBIDef6gFfSJDKf4Zcbj3S+vtgbCWX4j/zAGEKQ7c:NjwcbbS+qbCWoj/zA
TLSH
T1D4448D1673940DF9ED77C2BE8D814A46E7727C0607A0DADF07A086A65F236E05E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

58020

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

MessageBoxW

shell32

ShellExecuteExW

advapi32

RegOpenKeyExW QueryServiceStatusEx OpenServiceW OpenSCManagerW OpenProcessToken GetTokenInformation RegCloseKey RegCreateKeyW RegCreateKeyExW CloseServiceHandle RegQueryValueExW RegSetValueExW RegDeleteTreeW ControlService

winhttp

WinHttpCloseHandle WinHttpQueryHeaders WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpOpen

bcrypt

BCryptGenRandom

ntdll

NtQuerySystemInformation RtlInitUnicodeString NtLoadDriver NtUnloadDriver RtlAdjustPrivilege RtlPcToFileHeader RtlUnwindEx

kernel32

WriteConsoleW HeapReAlloc HeapSize ReadConsoleW ReadFile GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetFilePointerEx CreateDirectoryW CreateFileW DeleteFileW RemoveDirectoryW WriteFile GetTempPathW CloseHandle GetLastError QueryPerformanceCounter GetCurrentProcessId GetTickCount64 GetStdHandle ExitProcess GetConsoleMode SetConsoleMode ReadConsoleInputW FlushConsoleInputBuffer SetConsoleOutputCP SetConsoleCursorInfo SetConsoleTitleW GetCurrentProcess GetModuleFileNameW FindClose FindFirstFileW FindNextFileW FlushFileBuffers GetFileSizeEx SetFilePointer SetFileTime DeviceIoControl Sleep GetCurrentThreadId GetTickCount VirtualAlloc VirtualFree SetProcessWorkingSetSize GetModuleHandleA GetProcAddress MoveFileW MoveFileExW GetEnvironmentVariableW SetEnvironmentVariableW CreateProcessW CopyFileW WaitForSingleObject GetExitCodeProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead TerminateProcess LCMapStringW GetConsoleOutputCP GetFileType RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW

Name

.text

Size

152KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

svchost_d3ed59a2.exe

user32

shell32

advapi32

winhttp

bcrypt

ntdll

kernel32

generic