| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2104-Nov-12 20:36:41 |
| Detected languages |
English - United States
|
| Debug artifacts |
svchost.pdb
|
| CompanyName | Microsoft Corporation |
| FileDescription | Host Process for Windows Services |
| FileVersion | 10.0.26100.1150 (WinBuild.160101.0800) |
| InternalName | svchost.exe |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | svchost.exe |
| ProductName | Microsoft® Windows® Operating System |
| ProductVersion | 10.0.26100.1150 |
| Info | Matching compiler(s): | Microsoft Visual C++ 8.0 |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
May have dropper capabilities:
|
| Suspicious | The PE is possibly packed. | Unusual section name found: fothk |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Info | The PE is digitally signed. |
Signer: Microsoft Windows Publisher
Issuer: Microsoft Windows Production PCA 2011 |
| Safe | VirusTotal score: 0/73 (Scanned on 2024-10-13 15:55:48) | All the AVs think this file is safe. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x108 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 8 |
| TimeDateStamp | 2104-Nov-12 20:36:41 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x8000 |
| SizeOfInitializedData | 0xa000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000004FE0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x1000 |
| OperatingSystemVersion | A.0 |
| ImageVersion | A.0 |
| SubsystemVersion | A.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x13000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0x19466 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x80000 |
| SizeofStackCommit | 0x4000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| api-ms-win-crt-runtime-l1-1-0.dll |
_c_exit
_register_thread_local_exe_atexit_callback _initterm_e _initterm |
|---|---|
| api-ms-win-crt-private-l1-1-0.dll |
_o__configthreadlocale
_o__configure_wide_argv _o__crt_atexit _o__exit _o__get_initial_wide_environment _o__initialize_onexit_table _o__initialize_wide_environment _o__register_onexit_function _o__seh_filter_exe _o__set_app_type _o__set_fmode _o__set_new_mode _o__cexit memcpy _o__wcsicmp _o_bsearch_s _o_exit _o_qsort_s _o_terminate __C_specific_handler __current_exception __current_exception_context _o___stdio_common_vswprintf _o___p__commode _o___p___wargv _o___p___argc |
| api-ms-win-crt-string-l1-1-0.dll |
memset
|
| api-ms-win-core-profile-l1-1-0.dll |
QueryPerformanceCounter
|
| api-ms-win-core-processthreads-l1-1-0.dll |
SetProcessAffinityUpdateMode
GetCurrentProcessId GetCurrentThreadId OpenProcessToken ExitProcess TerminateProcess GetCurrentProcess |
| api-ms-win-core-sysinfo-l1-1-0.dll |
GetSystemTimeAsFileTime
GetTickCount64 |
| api-ms-win-core-interlocked-l1-1-0.dll |
InitializeSListHead
|
| api-ms-win-core-rtlsupport-l1-1-0.dll |
RtlCaptureContext
RtlVirtualUnwind RtlLookupFunctionEntry |
| api-ms-win-core-debug-l1-1-0.dll |
DebugBreak
IsDebuggerPresent |
| api-ms-win-core-errorhandling-l1-1-0.dll |
SetErrorMode
SetUnhandledExceptionFilter UnhandledExceptionFilter GetLastError |
| api-ms-win-core-processthreads-l1-1-1.dll |
IsProcessorFeaturePresent
SetProcessMitigationPolicy |
| api-ms-win-core-libraryloader-l1-2-0.dll |
GetProcAddress
FreeLibrary GetModuleHandleW LoadLibraryExW |
| api-ms-win-eventing-provider-l1-1-0.dll |
EventRegister
EventWriteTransfer EventSetInformation |
| api-ms-win-core-heap-l1-1-0.dll |
HeapFree
GetProcessHeap HeapAlloc HeapSetInformation |
| api-ms-win-core-synch-l1-1-0.dll |
ReleaseSRWLockExclusive
AcquireSRWLockShared InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection |
| api-ms-win-core-string-l1-1-0.dll |
CompareStringOrdinal
WideCharToMultiByte MultiByteToWideChar |
| api-ms-win-core-registry-l1-1-0.dll |
RegEnumKeyExW
RegQueryValueExW RegCloseKey RegDisablePredefinedCacheEx RegOpenKeyExW RegGetValueW |
| api-ms-win-core-processenvironment-l1-1-0.dll |
GetCommandLineW
ExpandEnvironmentStringsW |
| api-ms-win-core-processthreads-l1-1-2.dll |
SetProtectedPolicy
|
| api-ms-win-core-synch-l1-2-0.dll |
SleepConditionVariableSRW
WakeAllConditionVariable InitializeConditionVariable |
| api-ms-win-core-localization-l1-2-0.dll |
LCMapStringW
|
| api-ms-win-security-base-l1-1-0.dll |
GetTokenInformation
SetSecurityDescriptorDacl SetSecurityDescriptorOwner InitializeSecurityDescriptor InitializeAcl GetLengthSid AddAccessAllowedAce MakeAbsoluteSD SetSecurityDescriptorGroup |
| api-ms-win-core-handle-l1-1-0.dll |
CloseHandle
|
| api-ms-win-core-delayload-l1-1-1.dll |
ResolveDelayLoadedAPI
|
| api-ms-win-core-delayload-l1-1-0.dll |
DelayLoadFailureHook
|
| api-ms-win-core-sidebyside-l1-1-0.dll |
ReleaseActCtx
DeactivateActCtx ActivateActCtx CreateActCtxW |
| api-ms-win-core-threadpool-private-l1-1-0.dll |
RegisterWaitForSingleObjectEx
|
| ntdll.dll |
TpAllocWait
TpSetWait RtlNtStatusToDosErrorNoTeb TpReleaseWait EtwEventEnabled EtwEventWrite RtlAllocateHeap RtlFreeHeap TpSetTimerEx TpWaitForTimer TpReleaseTimer TpSetTimer RtlUnhandledExceptionFilter RtlQueryHeapInformation NtSetInformationProcess RtlSetProcessIsCritical RtlImageNtHeader NtQueryInformationProcess RtlValidSecurityDescriptor RtlRunOnceExecuteOnce EtwEventRegister NtQuerySystemInformation RtlNtStatusToDosError RtlInitializeCriticalSection RtlInitializeSid RtlSubAuthoritySid RtlGetDeviceFamilyInfoEnum RtlReleaseSRWLockExclusive RtlSubAuthorityCountSid RtlAcquireSRWLockExclusive RtlLengthRequiredSid RtlDeriveCapabilitySidsFromName RtlCopySid TpAllocTimer |
| api-ms-win-core-heap-l2-1-0.dll |
LocalAlloc
LocalFree |
| api-ms-win-service-private-l1-1-3.dll (delay-loaded) |
I_RegisterSvchostNotificationCallback
|
| Attributes | 0x1 |
|---|---|
| Name | api-ms-win-service-private-l1-1-3.dll |
| ModuleHandle | 0xe6b8 |
| DelayImportAddressTable | 0x100a0 |
| DelayImportNameTable | 0xb8f8 |
| BoundDelayImportTable | 0xbaf8 |
| UnloadDelayImportTable | 0 |
| TimeStamp | 1970-Jan-01 00:00:00 |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 10.0.26100.1150 |
| ProductVersion | 10.0.26100.1150 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Microsoft Corporation |
| FileDescription | Host Process for Windows Services |
| FileVersion (#2) | 10.0.26100.1150 (WinBuild.160101.0800) |
| InternalName | svchost.exe |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | svchost.exe |
| ProductName | Microsoft® Windows® Operating System |
| ProductVersion (#2) | 10.0.26100.1150 |
| Resource LangID | English - United States |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2104-Nov-12 20:36:41 |
| Version | 0.0 |
| SizeofData | 36 |
| AddressOfRawData | 0xaaa0 |
| PointerToRawData | 0xaaa0 |
| Referenced File | svchost.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2104-Nov-12 20:36:41 |
| Version | 0.0 |
| SizeofData | 1028 |
| AddressOfRawData | 0xaac4 |
| PointerToRawData | 0xaac4 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2104-Nov-12 20:36:41 |
| Version | 0.0 |
| SizeofData | 36 |
| AddressOfRawData | 0xaef0 |
| PointerToRawData | 0xaef0 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2104-Nov-12 20:36:41 |
| Version | 0.0 |
| SizeofData | 4 |
| AddressOfRawData | 0xaf14 |
| PointerToRawData | 0xaf14 |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x14000e040 |
| GuardCFCheckFunctionPointer | 5368748264 |
| GuardCFDispatchFunctionPointer | 0 |
| GuardCFFunctionTable | 0 |
| GuardCFFunctionCount | 0 |
| GuardFlags | (EMPTY) |
| CodeIntegrity.Flags | 0 |
| CodeIntegrity.Catalog | 0 |
| CodeIntegrity.CatalogOffset | 0 |
| CodeIntegrity.Reserved | 0 |
| GuardAddressTakenIatEntryTable | 0 |
| GuardAddressTakenIatEntryCount | 0 |
| GuardLongJumpTargetTable | 0 |
| GuardLongJumpTargetCount | 0 |
| XOR Key | 0xa211860e |
|---|---|
| Unmarked objects | 0 |
| Imports (33138) | 2 |
| Imports (VS2008 SP1 build 30729) | 59 |
| Total imports | 1218 |
| Unmarked objects (#2) | 1 |
| C objects (33138) | 13 |
| ASM objects (33138) | 4 |
| C++ objects (33138) | 20 |
| C objects (LTCG) (33138) | 13 |
| 253 (33138) | 1 |
| Resource objects (33138) | 1 |
| Linker (33138) | 1 |