popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

svchost.exe

Generic Malware PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 9, 2021, 9:01 a.m. Sept. 9, 2021, 9:07 a.m.
Size 1.4MB
Type PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5 fc8ce0eb1a60a03e0b167b680af1625d
SHA256 1118b519f21a145a3e72b8c4b03fa7c8f22d6e1ab7ee6b103595d5cd6775b0a1
CRC32 2DFEA2B9
ssdeep 24576:tndRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkzwvWJrPwStB:1XDFBU2iIBb0xY/6sUYYDelPwSv
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
65.21.3.192 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b32000
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00170a00', u'virtual_address': u'0x00272000', u'entropy': 7.936666637619127, u'name': u'UPX1', u'virtual_size': u'0x00171000'} entropy 7.93666663762 description A section with a high entropy has been found
entropy 0.999661016949 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeShutdownPrivilege
1 1 0
section UPX0 description Section name indicates UPX
section UPX1 description Section name indicates UPX
section UPX2 description Section name indicates UPX
host 65.21.3.192
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 8 (SystemProcessorPerformanceInformation)
1 0 0
description svchost.exe tried to sleep 19097656 seconds, actually delayed analysis time by 19097653 seconds
Time & API Arguments Status Return Repeated

SetWindowsHookExW

 thread_identifier: 0
callback_function: 0x0050f84a
hook_identifier: 14 (WH_MOUSE_LL)
module_address: 0x00000000
1 6226501 0
Time & API Arguments Status Return Repeated

SetWindowsHookExW

 thread_identifier: 0
callback_function: 0x004ca8cc
hook_identifier: 13 (WH_KEYBOARD_LL)
module_address: 0x00000000
1 3080607 0
Bkav W32.CautusL.Trojan
Elastic malicious (high confidence)
DrWeb Trojan.Siggen14.19963
ClamAV Win.Malware.Mikey-9819889-0
FireEye Generic.mg.fc8ce0eb1a60a03e
CAT-QuickHeal Trojan.GenericRI.S20702303
ALYac Gen:Variant.Graftor.833606
Cylance Unsafe
Zillya Trojan.Solmyr.Win32.229
K7AntiVirus Trojan ( 00569d2a1 )
K7GW Trojan ( 00569d2a1 )
Cybereason malicious.b1a60a
Arcabit Trojan.Graftor.DCB846
BitDefenderTheta AI:Packer.66D6A3481E
Cyren W32/Injector.A.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Agent.ACBZ
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan-Spy.Win32.Solmyr.vho
BitDefender Gen:Variant.Graftor.833606
NANO-Antivirus Trojan.Win32.Solmyr.ixdyob
MicroWorld-eScan Gen:Variant.Graftor.833606
Avast Win32:RATX-gen [Trj]
Ad-Aware Gen:Variant.Graftor.833606
Sophos Mal/Generic-S
McAfee-GW-Edition BehavesLike.Win32.Generic.tc
Emsisoft Gen:Variant.Graftor.833606 (B)
Ikarus Trojan.MalPack
Jiangmin TrojanSpy.Solmyr.cg
eGambit Unsafe.AI_Score_96%
Avira TR/Crypt.ULPM.Gen
Antiy-AVL Trojan/Generic.ASMalwS.33CD62C
Microsoft Backdoor:Win32/ParalaxRat.STD
GData Win32.Trojan.PSE.13NZCK2
TACHYON Trojan-Spy/W32.Solmyr.3943424
AhnLab-V3 Backdoor/Win.Reputation.R436666
McAfee GenericRXAA-FA!FC8CE0EB1A60
MAX malware (ai score=89)
VBA32 TrojanSpy.Solmyr
Malwarebytes Trojan.MalPack
Tencent Malware.Win32.Gencirc.10ce6d4b
Yandex Trojan.Agent!mpJSPmzsnqA
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Agent.ACBZ!tr
AVG Win32:RATX-gen [Trj]
Panda Trj/GdSda.A
dead_host 65.21.3.192:1234
dead_host 192.168.56.101:49203
dead_host 192.168.56.101:49201
dead_host 192.168.56.101:49197
dead_host 192.168.56.101:49210
dead_host 192.168.56.101:49207
dead_host 192.168.56.101:49209
dead_host 192.168.56.101:49208
dead_host 192.168.56.101:49205