svchost[.]fix2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
svchost.fix2.exe
Size 15.9MB
Sample261001-z5dnmayhpg
SHA256 18200b2817e654629a63a94971fc9fe818c222bf36ae15c08c0f06b241f85ccf
MD5 bfb430fb90a5a762f95a40e071b754ad
SHA1 fb44f4ce09bebaf252c5c86c3baac69bd0dcd57a
SHA512 5b3a5c5f4cbe8e173d4ae803b8ac42312f658d72647c47acf1232cf0e7c7ff8e544b9dfa981ac40cbfa2b66a1c44ae7bae22485c38ecaadce89b3a4a89b56156
SSDEEP 196608:odHZN3isXwiMcbgUwTTBTJfyOmdKvZGjlKUkiP1W3kBPMFvv6Jj0bZkOgu/L01f1:oTIsgEbPwPByQvpiP1W3kBMkjm/Txl
TLSH
T1FDF633E762DD93EAC0835975A6870383B0C26456DAAF8F1836CF5C05B960C1946CBF7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
svchost.fix2.exe

File Explorer

svchost.fix2.exe

.exe 15.9MB

svchost.fix2.exe

IMPHASH 456afb3a9ae9d8631d083351c6db97a1
SHA256 18200b2817e654629a63a94971fc9fe818c222bf36ae15c08c0f06b241f85ccf
MD5 bfb430fb90a5a762f95a40e071b754ad
SHA1 fb44f4ce09bebaf252c5c86c3baac69bd0dcd57a
SHA512 5b3a5c5f4cbe8e173d4ae803b8ac42312f658d72647c47acf1232cf0e7c7ff8e544b9dfa981ac40cbfa2b66a1c44ae7bae22485c38ecaadce89b3a4a89b56156
SSDEEP 196608:odHZN3isXwiMcbgUwTTBTJfyOmdKvZGjlKUkiP1W3kBPMFvv6Jj0bZkOgu/L01f1:oTIsgEbPwPByQvpiP1W3kBMkjm/Txl
TLSH
T1FDF633E762DD93EAC0835975A6870383B0C26456DAAF8F1836CF5C05B960C1946CBF7B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27372233

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

crypt32

CryptStringToBinaryA

ws2_32

getpeername

rpcrt4

UuidToStringA

winhttp

WinHttpCloseHandle

ole32

CoCreateInstance

kernel32

GetCurrentThreadId

user32

UpdateWindow

gdi32

GetStockObject

advapi32

EventRegister

shell32

ShellExecuteW

windivert

WinDivertClose

msvcp140

?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

msvcp140_atomic_wait

__std_wait_for_threadpool_work_callbacks

urlmon

URLDownloadToFileW

winmm

PlaySoundW

imm32

ImmReleaseContext

dwmapi

DwmExtendFrameIntoClientArea

ntdll

RtlLookupFunctionEntry

iphlpapi

GetAdaptersAddresses

shlwapi

PathMakeSystemFolderW

userenv

UnloadUserProfile

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

wintrust

CryptCATAdminReleaseContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy

api-ms-win-crt-heap-l1-1-0

calloc

api-ms-win-crt-stdio-l1-1-0

_set_fmode

api-ms-win-crt-string-l1-1-0

strcspn

api-ms-win-crt-runtime-l1-1-0

strerror

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-math-l1-1-0

sinf

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

api-ms-win-crt-time-l1-1-0

_localtime64_s

wldap32

ord50

normaliz

IdnToAscii

Name

.text

Size

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

632KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

772KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.aAq

Size

Virtual Size

9.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.YkD

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pIe

Size

15.8MB

Virtual Size

15.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

304B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

svchost.fix2.exe

d3d11

d3dcompiler_43

crypt32

ws2_32

rpcrt4

winhttp

ole32

kernel32

user32

gdi32

advapi32

shell32

windivert

msvcp140

msvcp140_atomic_wait

urlmon

winmm

imm32

dwmapi

ntdll

iphlpapi

shlwapi

userenv

d3dx11_43

wintrust

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

wldap32

normaliz

generic