svchost.exe

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	.xuzo
section	.ziw
section	.new

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

None

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 13, 2021, 4:12 p.m.	process_identifier: 4656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 131072 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002dc000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory April 13, 2021, 4:12 p.m.	process_identifier: 4656 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02200000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section	{u'size_of_data': u'0x00045000', u'virtual_address': u'0x00001000', u'entropy': 7.536900763754327, u'name': u'.text', u'virtual_size': u'0x00044e7f'}				entropy	7.53690076375				description	A section with a high entropy has been found
entropy	0.838905775076				description	Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host	172.217.25.14

File has been identified by 25 AntiVirus engines on VirusTotal as malicious (25 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
FireEye	Generic.mg.10a6ee4d2adc0ebf
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0056f9be1 )
K7GW	Trojan ( 0056f9be1 )
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZexaF.34670.uCX@aa1Nr3fG
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HKJX
APEX	Malicious
Kaspersky	UDS:Trojan.Multi.GenericML.xnet
Sophos	ML/PE-A
McAfee-GW-Edition	BehavesLike.Win32.Trojan.fc
Emsisoft	Trojan.Agent (A)
Microsoft	Trojan:Win32/Caynamer.A!ml
Cynet	Malicious (score: 100)
Acronis	suspicious
McAfee	Artemis!10A6EE4D2ADC
Cylance	Unsafe
Rising	Trojan.Generic@ML.80 (RDML:o083kWm92yXdRVsLEQlJKg)
SentinelOne	Static AI - Malicious PE
Fortinet	W32/GenKryptik.FDZD!tr
Cybereason	malicious.077e6b
Qihoo-360	HEUR/QVM10.1.8D09.Malware.Gen