popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

svc.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 9, 2024, 4:12 p.m. Aug. 9, 2024, 4:16 p.m.
Size 318.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 53d19fb9a95e384638e297557ebf523d
SHA256 2894a9a2513b1d9651617763fc172ee5e0b41f68050582a5d6b5133cad6d7fdc
CRC32 5EC6BBFB
ssdeep 3072:KGJTr7Pa4UiWANcuZSoweaHpoEMgxKYsw/5zkHu2pNVhrRYCRTT:xXPL/NcOZweaHQKijHuMhrSCRT
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .roh
section .hunuhop
section .yos
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1940
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 86016
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029d0000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1940
region_size: 45056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00320000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x0002b600', u'virtual_address': u'0x00001000', u'entropy': 7.253880327808379, u'name': u'.text', u'virtual_size': u'0x0002b454'} entropy 7.25388032781 description A section with a high entropy has been found
entropy 0.547318611987 description Overall entropy of this PE file is high
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.SmokeLoader.m!c
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
CAT-QuickHeal Backdoor.Convagent
Skyhigh BehavesLike.Win32.Lockbit.fm
ALYac Gen:Variant.Zusy.557213
Cylance Unsafe
VIPRE Gen:Variant.Zusy.557213
Sangfor Ransom.Win32.Save.a
K7AntiVirus Trojan ( 005579741 )
BitDefender Gen:Variant.Zusy.557213
K7GW Trojan ( 005579741 )
Symantec ML.Attribute.HighConfidence
tehtris Generic.Malware
ESET-NOD32 a variant of Win32/Kryptik.HXRG
APEX Malicious
McAfee Artemis!53D19FB9A95E
Avast Win32:BotX-gen [Trj]
ClamAV Win.Packer.pkr_ce1a-9980177-0
Kaspersky HEUR:Backdoor.Win32.Agent.gen
Alibaba Backdoor:Win32/Smokeloader.588fa537
MicroWorld-eScan Gen:Variant.Zusy.557213
Rising Trojan.Kryptik@AI.84 (RDML:euB57Ui8Y3keriB1osjdmg)
Emsisoft Gen:Variant.Zusy.557213 (B)
F-Secure Dropper.DR/AVI.SmokeLoader.wsjlh
DrWeb Trojan.DownLoader47.19461
TrendMicro Trojan.Win32.SMOKELOADER.YXEHGZ
McAfeeD ti!2894A9A2513B
Trapmine malicious.high.ml.score
FireEye Generic.mg.53d19fb9a95e3846
Sophos Troj/Krypt-VK
SentinelOne Static AI - Malicious PE
Google Detected
Avira DR/AVI.SmokeLoader.wsjlh
MAX malware (ai score=82)
Antiy-AVL Trojan/Win32.Kryptik
Kingsoft malware.kb.a.1000
Gridinsoft Ransom.Win32.Wacatac.sa
Microsoft Trojan:Win32/Smokeloader.NZE!MTB
ZoneAlarm HEUR:Backdoor.Win32.Agent.gen
GData Win32.Trojan.PSE.67HP18
Varist W32/Kryptik.MOF.gen!Eldorado
AhnLab-V3 Trojan/Win.LokiBot.R660378
DeepInstinct MALICIOUS
VBA32 Backdoor.Convagent
Malwarebytes Trojan.MalPack.GS
Ikarus Trojan-Spy.Agent
TrendMicro-HouseCall Trojan.Win32.SMOKELOADER.YXEHGZ
Tencent Trojan.Win32.Obfuscated.gen