popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

svrhost.exe

UPX OS Processor Check PE64 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 19, 2024, 7:01 p.m. June 19, 2024, 7:01 p.m.
Size 90.5MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 f5ccac795e79c40d64e7e5a73c741785
SHA256 1b427974d38f8f1e5ae399050bd3fc23bc7fa6561e4dfacf73dc1eb52b5ef7f5
CRC32 ADE4B791
ssdeep 6144:mc4qS758j2We/mvvp8oQNbmZf1fw7srC7CCo3PISSP13Y/M3TmOcr9TfLn5AS2d3:f4qS7S5pvpQmZdMZply6TsYS2dhd
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2660
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 1052672
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076d31000
process_handle: 0xffffffffffffffff
1 0 0
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
Symantec Trojan.Gen.MBT
ESET-NOD32 a variant of Win64/GenKryptik.GETL
Rising Trojan.Kryptik!8.8 (TFE:5:rQA1B2MPqWU)
F-Secure Trojan.TR/AD.AsynRatSH.xdwes
McAfeeD ti!1B427974D38F
FireEye Generic.mg.f5ccac795e79c40d
Sophos Mal/Generic-S
Avira TR/AD.AsynRatSH.xdwes
DeepInstinct MALICIOUS
Fortinet W64/GenKryptik.GETL!tr
Paloalto generic.ml