popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

svcyr.exe

UPX OS Processor Check PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 13, 2024, 1:57 p.m. Nov. 13, 2024, 2:19 p.m.
Size 45.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5 61fe809e805e74c4d6fc33b0e5a3305e
SHA256 466682a767a27edcb28e3d2ae0ed221836db7d7dcb73fa88879c4b5944ba829d
CRC32 BC441DEB
ssdeep 768:fI0+FNeQT1ok/ILtq2FV5AY6t+ayph/bAUn26wriTJogrIyP85P85jaZV9VYnsxx:fI0eMCoHFVet+phX7lBF85EAa0GDit3
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
v8.ter.tf 199.59.243.227
souhu.ydns.eu 202.181.25.108
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

packer UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser
Time & API Arguments Status Return Repeated

CreateServiceA

 service_start_name:
start_type: 2
password:
display_name: Pqrstu Bcdefgh Jklmnop Rstu
filepath: C:\Windows\wseoky.exe
service_name: Pqrstua Cdefgh
filepath_r: C:\Windows\wseoky.exe
desired_access: 983551
service_handle: 0x005931b0
error_control: 1
service_type: 272
service_manager_handle: 0x00593250
1 5845424 0
section {u'size_of_data': u'0x0000a800', u'virtual_address': u'0x00012000', u'entropy': 7.914333663839953, u'name': u'UPX1', u'virtual_size': u'0x0000b000'} entropy 7.91433366384 description A section with a high entropy has been found
entropy 0.943820224719 description Overall entropy of this PE file is high
section UPX0 description Section name indicates UPX
section UPX1 description Section name indicates UPX
service_name Pqrstua Cdefgh service_path C:\Windows\wseoky.exe
Bkav W32.Common.339390D0
Lionic Trojan.Win32.ServStart.4!c
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Generic.pc
ALYac Generic.ServStart.A.A23BB552
Cylance Unsafe
VIPRE Generic.ServStart.A.A23BB552
Sangfor Suspicious.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Generic.ServStart.A.A23BB552
K7GW Trojan ( 000170ae1 )
K7AntiVirus Trojan ( 000170ae1 )
Arcabit Generic.ServStart.A.A23BB552
VirIT Trojan.Win32.Dnldr25.PNR
Symantec SMG.Heur!gen
Elastic Windows.Generic.Threat
ESET-NOD32 a variant of Win32/Agent.RTQ
APEX Malicious
Avast Win32:TrojanX-gen [Trj]
ClamAV Win.Malware.Nitol-6802818-0
Kaspersky HEUR:Trojan.Win32.Generic
Alibaba Worm:Win32/AutoRun.ad23b205
NANO-Antivirus Trojan.Win32.Ric.etbkiz
MicroWorld-eScan Generic.ServStart.A.A23BB552
Rising Trojan.Agent!8.B1E (TFE:5:87fVyGeA1oT)
Emsisoft Generic.ServStart.A.A23BB552 (B)
F-Secure Trojan.TR/Downloader.Gen
DrWeb Trojan.DownLoader25.10495
Zillya Trojan.Agent.Win32.799880
TrendMicro DDoS.Win32.NITOL.SMG
McAfeeD Real Protect-LS!61FE809E805E
Trapmine malicious.high.ml.score
CTX exe.trojan.generic
Sophos Mal/Generic-S
Ikarus Trojan.Win32.Agent
FireEye Generic.mg.61fe809e805e74c4
Jiangmin Trojan.Generic.bjpij
Webroot W32.Trojan.Gen
Google Detected
Avira TR/Downloader.Gen
Antiy-AVL Trojan/Win32.AGeneric
Kingsoft malware.kb.b.998
Gridinsoft Trojan.Win32.Gen.vl!i
Microsoft Worm:Win32/AutoRun!pz
ZoneAlarm HEUR:Trojan.Win32.Generic
GData Generic.ServStart.A.A23BB552
Varist W32/Trojan.CZR.gen!Eldorado
AhnLab-V3 Trojan/Win32.Nitol.R215641
McAfee GenericRXAA-AA!61FE809E805E
DeepInstinct MALICIOUS