popup

Report - svc.exe

Generic Malware Malicious Library UPX PE File PE32 OS Processor Check
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2024.08.09 16:17 Machine s1_win7_x6403
Filename svc.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
4
 Behavior Score
2.2
ZERO API file : malware
VT API (file) 56 detected (AIDetectMalware, SmokeLoader, malicious, high confidence, score, Convagent, Lockbit, Zusy, Unsafe, Save, Attribute, HighConfidence, Kryptik, HXRG, Artemis, BotX, Kryptik@AI, RDML, euB57Ui8Y3keriB1osjdmg, wsjlh, DownLoader47, YXEHGZ, high, Krypt, Static AI, Malicious PE, Detected, ai score=82, Wacatac, 67HP18, Eldorado, LokiBot, R660378, Obfuscated, WriteMBR, susgen, PossibleThreat, confidence, 100%)
md5 53d19fb9a95e384638e297557ebf523d
sha256 2894a9a2513b1d9651617763fc172ee5e0b41f68050582a5d6b5133cad6d7fdc
ssdeep 3072:KGJTr7Pa4UiWANcuZSoweaHpoEMgxKYsw/5zkHu2pNVhrRYCRTT:xXPL/NcOZweaHQKijHuMhrSCRT
imphash 42b9ff7c49af3020989d2bd49c20164f
impfuzzy 48:gyGNBXqdlg45edm42tlcHK9MhtbMyGA+74z/JAQhYza:tItmlg45estlcHQMhtbMNOaa
  Network IP location

Signature (4cnts)

Level Description
danger File has been identified by 56 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice The binary likely contains encrypted or compressed data indicative of a packer
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (6cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x401018 CreateNamedPipeW
 0x40101c GetConsoleAliasesA
 0x401020 EnumTimeFormatsA
 0x401024 GetConsoleCP
 0x401028 GlobalAlloc
 0x40102c GetSystemDirectoryW
 0x401030 SetFileShortNameW
 0x401034 LoadLibraryW
 0x401038 CreateEventA
 0x40103c GetConsoleAliasW
 0x401040 HeapValidate
 0x401044 GetModuleFileNameW
 0x401048 ReplaceFileA
 0x40104c LCMapStringA
 0x401050 GetLastError
 0x401054 SetLastError
 0x401058 GetProcAddress
 0x40105c FindVolumeMountPointClose
 0x401060 PeekConsoleInputW
 0x401064 IsBadHugeWritePtr
 0x401068 CreateJobSet
 0x40106c GlobalFree
 0x401070 LoadLibraryA
 0x401074 InterlockedExchangeAdd
 0x401078 CreateFileMappingA
 0x40107c GetTickCount
 0x401080 GetNumberFormatW
 0x401084 AddAtomW
 0x401088 QueryDosDeviceW
 0x40108c HeapWalk
 0x401090 FoldStringA
 0x401094 SetEnvironmentVariableA
 0x401098 GetOEMCP
 0x40109c GetModuleHandleA
 0x4010a0 GetProcessShutdownParameters
 0x4010a4 RequestWakeupLatency
 0x4010a8 EnumDateFormatsW
 0x4010ac FatalAppExitA
 0x4010b0 GetDiskFreeSpaceExA
 0x4010b4 GetCurrentProcessId
 0x4010b8 GetProcessHeap
 0x4010bc SetEndOfFile
 0x4010c0 GetStringTypeW
 0x4010c4 LCMapStringW
 0x4010c8 MultiByteToWideChar
 0x4010cc WriteConsoleW
 0x4010d0 CreateJobObjectW
 0x4010d4 CommConfigDialogA
 0x4010d8 GetConsoleAliasesLengthW
 0x4010dc CreateFileA
 0x4010e0 SetConsoleCtrlHandler
 0x4010e4 EnumResourceNamesW
 0x4010e8 HeapSize
 0x4010ec FlushFileBuffers
 0x4010f0 CreateFileW
 0x4010f4 SetStdHandle
 0x4010f8 HeapReAlloc
 0x4010fc GetCommandLineA
 0x401100 HeapSetInformation
 0x401104 GetStartupInfoW
 0x401108 UnhandledExceptionFilter
 0x40110c SetUnhandledExceptionFilter
 0x401110 IsDebuggerPresent
 0x401114 EncodePointer
 0x401118 DecodePointer
 0x40111c TerminateProcess
 0x401120 GetCurrentProcess
 0x401124 HeapAlloc
 0x401128 HeapFree
 0x40112c IsProcessorFeaturePresent
 0x401130 EnterCriticalSection
 0x401134 LeaveCriticalSection
 0x401138 SetHandleCount
 0x40113c GetStdHandle
 0x401140 InitializeCriticalSectionAndSpinCount
 0x401144 GetFileType
 0x401148 DeleteCriticalSection
 0x40114c RtlUnwind
 0x401150 SetFilePointer
 0x401154 HeapCreate
 0x401158 CloseHandle
 0x40115c RaiseException
 0x401160 GetModuleHandleW
 0x401164 ExitProcess
 0x401168 WriteFile
 0x40116c GetModuleFileNameA
 0x401170 FreeEnvironmentStringsW
 0x401174 WideCharToMultiByte
 0x401178 GetEnvironmentStringsW
 0x40117c TlsAlloc
 0x401180 TlsGetValue
 0x401184 TlsSetValue
 0x401188 TlsFree
 0x40118c InterlockedIncrement
 0x401190 GetCurrentThreadId
 0x401194 InterlockedDecrement
 0x401198 QueryPerformanceCounter
 0x40119c GetSystemTimeAsFileTime
 0x4011a0 Sleep
 0x4011a4 GetConsoleMode
 0x4011a8 GetCPInfo
 0x4011ac GetACP
 0x4011b0 IsValidCodePage
 0x4011b4 ReadFile
USER32.dll
 0x4011c4 GetSysColorBrush
 0x4011c8 GetComboBoxInfo
 0x4011cc SetClipboardViewer
 0x4011d0 GetDC
 0x4011d4 ChangeMenuA
 0x4011d8 GetMenuState
 0x4011dc DrawStateA
 0x4011e0 CharUpperBuffA
 0x4011e4 GetCaretPos
GDI32.dll
 0x401000 GetCharWidthI
 0x401004 CreateDCA
 0x401008 CreateDCW
 0x40100c GetCharWidthA
 0x401010 GetCharWidthW
SHELL32.dll
 0x4011bc FindExecutableA
ole32.dll
 0x4011f4 StringFromIID
 0x4011f8 CoSuspendClassObjects
WINHTTP.dll
 0x4011ec WinHttpCheckPlatform

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure