svchost (1)[.]rar | Triage™

Resubmissions

05/09/2026, 18:24

260905-w136yaxtdv3

05/09/2026, 18:17

260905-ww3plsgk8s3

Sharing

Copy URL Twitter E-mail

General

Target
svchost (1).rar
Size 9.0MB
Sample260905-w136yaxtdv
SHA256 05bd2cdee4fb3f08dfec45928bf41d2b2b7e72cc0808367978609b3c7029cce7
MD5 fc45bdfbef8a8359d4b7763f7bf28c7d
SHA1 a6235cbf87c257e480ff770baea8dfee87d34a86
SHA512 ad107317f181beee6e9554d62c88f1d3cfb57bfabb3f6e28fa3b43ab401eb022fb7391be3893e0b9c52ee583681b7db76cc73de238e01ffa2dbc1f559344eeeb
SSDEEP 196608:4uW198sddGpnSZSUNea3kcQQJgXW4vLmLbypb9b1GIB54nmIN:4uWnvrGpSZSUb3wdXTWEbzGY54n7
TLSH
T11E9633574BD2F4389993E5FCC09280FF34E17B043E3AE49A5A7EB482B8759C2466E542
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/svchost.exe

File Explorer

svchost (1).rar

.rar 9.0MB
svchost.exe

.exe 10.0MB

svchost (1).rar

SHA256 05bd2cdee4fb3f08dfec45928bf41d2b2b7e72cc0808367978609b3c7029cce7
MD5 fc45bdfbef8a8359d4b7763f7bf28c7d
SHA1 a6235cbf87c257e480ff770baea8dfee87d34a86
SHA512 ad107317f181beee6e9554d62c88f1d3cfb57bfabb3f6e28fa3b43ab401eb022fb7391be3893e0b9c52ee583681b7db76cc73de238e01ffa2dbc1f559344eeeb
SSDEEP 196608:4uW198sddGpnSZSUNea3kcQQJgXW4vLmLbypb9b1GIB54nmIN:4uWnvrGpSZSUb3wdXTWEbzGY54n7
TLSH
T11E9633574BD2F4389993E5FCC09280FF34E17B043E3AE49A5A7EB482B8759C2466E542
MD5 SHA1 SHA512 SSDEEP TLSH

Password

123

svchost.exe

IMPHASH eec00476a63b581f234a908633ec63b1
SHA256 99f1b32d63dd81b284a22fa47e069619f9d72336c5e42b8eb7fe48ef7e553106
MD5 653ae2e8ac4515bc1553a732b6a0ff8e
SHA1 fa8cf9c714703c1c1ed614e965eddc8cc88174bd
SHA512 ba5be0a7dfdf01a267cb8f96c08467c5a2f075472df928238b3879faa7912098d3f6d65f07b6f5f39aa909c799336b40afb1b46b0db177abd5619c3e77d5d0c4
SSDEEP 196608:fFQ7Dt45e0++3iTKBk2cCAM+wRlQksbCizbz5173Un2/Hw5ZmcSBnd:fFUSM0DiTa/jakhiPZc4
TLSH
T16DB623D21BE092F5D0520520628E936661C16A1DC5FD0DA53EE62C11BF58CBA36CEFFB
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

123

Minor OS version

Major OS version

Entry point

15323424

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

shell32

ShellExecuteA

kernel32

IsProcessorFeaturePresent

user32

TranslateMessage

msvcp140

?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

imm32

ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

crypt32

CertGetCertificateChain

ws2_32

WSASetLastError

shlwapi

PathFindFileNameW

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy

api-ms-win-crt-runtime-l1-1-0

__sys_errlist

api-ms-win-crt-stdio-l1-1-0

_lseeki64

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-filesystem-l1-1-0

_fstat64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncmp

api-ms-win-crt-convert-l1-1-0

wcstombs

api-ms-win-crt-math-l1-1-0

_dsign

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

advapi32

CryptHashData

Name

��

Size

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

��

Size

Virtual Size

387KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

��

Size

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

��

Size

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

��

Size

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

��

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

��

Size

10.0MB

Virtual Size

10.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

��

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

��

Size

512B

Virtual Size

160B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

svchost (1).rar

svchost.exe

d3d11

d3dcompiler_43

shell32

kernel32

user32

msvcp140

imm32

dwmapi

crypt32

ws2_32

shlwapi

userenv

bcrypt

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

advapi32

generic