Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

.svchost.exe

UPX PE32 PE File

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 11, 2021, 6:54 p.m.	Aug. 11, 2021, 7:04 p.m.

Size	225.1KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`8056c1da01723959661caf103a001271`
SHA256	`b05b832ba690f4fee5cb0c810f9a329592ef5736a01f77d2190d7d7d24fe9a0c`
CRC32	`032070F6`
ssdeep	`1536:cvO0b3VUKXBzmF9cyUQNdxyTEG0DGpVOppH1sWTmFHyCWCZ:0O0VRXBzbyjxSEG4GpkH1pTUHbWCZ`
Yara	UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE32 - (no description)

.svchost.exe "C:\Users\test22\AppData\Local\Temp\.svchost.exe"
2444

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Aug. 11, 2021, 6:54 p.m.	process_identifier: 2444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f92000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 11, 2021, 6:54 p.m.	process_identifier: 2444 region_size: 57344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02400000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Foreign language identified in PE resource (1 event)

name

RT_VERSION

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_TRADITIONAL

offset

0x000360f0

size

0x000002e4

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Aug. 11, 2021, 6:54 p.m.	process_identifier: 2444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x02380000 process_handle: 0xffffffff	1	0	0

File has been identified by 12 AntiVirus engines on VirusTotal as malicious (12 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.8056c1da01723959
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_70% (W)
APEX	Malicious
Sophos	ML/PE-A
SentinelOne	Static AI - Suspicious PE
eGambit	Unsafe.AI_Score_99%
Cynet	Malicious (score: 100)
BitDefenderTheta	Gen:NN.ZevbaF.34058.om1@a0NF2lkb
MaxSecure	Trojan.Malware.300983.susgen