popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

.svchost.exe

GuLoader Generic Malware Malicious Library UPX Malicious Packer PE File PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 12, 2021, 1:43 p.m. Aug. 12, 2021, 1:45 p.m.
Size 225.1KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 8056c1da01723959661caf103a001271
SHA256 b05b832ba690f4fee5cb0c810f9a329592ef5736a01f77d2190d7d7d24fe9a0c
CRC32 032070F6
ssdeep 1536:cvO0b3VUKXBzmF9cyUQNdxyTEG0DGpVOppH1sWTmFHyCWCZ:0O0VRXBzbyjxSEG4GpkH1pTUHbWCZ
Yara
  • Malicious_Packer_Zero - Malicious Packer
  • GuLoader_IN - GuLoader
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2388
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72d72000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2388
region_size: 57344
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00830000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name RT_VERSION language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_TRADITIONAL offset 0x000360f0 size 0x000002e4
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2388
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 24576
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x003c0000
process_handle: 0xffffffff
1 0 0
Elastic malicious (high confidence)
FireEye Generic.mg.8056c1da01723959
McAfee Artemis!8056C1DA0172
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
APEX Malicious
Kaspersky UDS:DangerousObject.Multi.Generic
McAfee-GW-Edition Artemis!Trojan
Sophos ML/PE-A
Kingsoft Win32.Troj.Generic_a.a.(kcloud)
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Cynet Malicious (score: 100)
BitDefenderTheta Gen:NN.ZevbaF.34058.om1@a0NF2lkb
SentinelOne Static AI - Suspicious PE
eGambit Unsafe.AI_Score_99%
MaxSecure Trojan.Malware.300983.susgen
CrowdStrike win/malicious_confidence_70% (W)