Gridinsoft Logo
File Icon

Svchost.exe Trojan Packed Analysis

Updated 1 year ago
Checked by Malware Check
svchost.exe

Technical Analysis

File Name svchost.exe
File Type
PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Scanner Version 1.0.172.174
Database Version 2024-04-18 18:00:28 UTC
⚠

Trojan.Win64.Packed.cl

Malware family: Packed

Packed malware uses compression, encryption, or obfuscation techniques to alter code appearance and evade security detection. These methods modify the original malware structure to bypass signature-based detection systems and complicate analysis efforts.
N/A
Detection Rate
40,284,672
File Size (bytes)
2024-04-18
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
255850326fc8149ad7e635403c2de2bf
SHA1
0a4e6c76b7dab7ba445c1c0644c66f8579876200
SHA256
a761634b9327e17ea3330bb3ea6977f4d95e3c972f46d972a90b33d49739f5c4
SHA512
15e262bb018e56e0d65f1271263e612a85783d7f820d29379f5c1bdede59aacd76a119de61220be500ac60319b7f45abaaae917970aad86f1a0784b2df91ecec
ImpHash
4d8a465943edbfae7c3166b9af900360

PE Analysis

Basic Information

▼
Icon
Hash: f976ca290892cdb98cba4f6b0ff69089
Fuzzy: be3977b5a702e9c4f9fcc82194460771
dHash: 2c9cb83cbcd8f472
Image Base 0x140000000
Entry Point 0x144b63144
Compilation Time 2023-06-25 21:41:03
Checksum 0x03d5ef3d (Actual: 0x02671212)
OS Version 4.0
PEiD Signatures PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Digital Signature The PE file does not contain a certificate table.
Imports 13 libraries
Exports 41 functions
Resources 5 Resources
Sections 16 Sections

Version Information

▼
CompanyName D0kt0r Solutions
FileDescription SRBMiner-MULTI
FileVersion 2.3.0
LegalCopyright 2023 D0kt0r
ProductName SRBMiner-MULTI
ProductVersion 2.3.0
Translation 0x0000 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
0x00001000 13,209,600 bytes 3,462,656 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D2A21419993C8453DCD61505A49E4A7D
0x00c9a000 45,056 bytes 4,096 bytes 7.60 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 32C74BC41B6BD9D484D771EF0342CE46
0x00ca5000 48,615,424 bytes 31,250,432 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 4515BFC5430B04DF463065C6E7F757AD
0x03b02000 1,691,648 bytes 493,056 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 6ABA2902EC2BFE5139946009389636D0
0x03c9f000 159,744 bytes 97,280 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 14D32C690BEEABD2460208D849701F70
0x03cc6000 561,152 bytes 126,976 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 91F02DB02DE36BD447CCB3C38858A1B2
0x03d4f000 81,920 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_64BYTES D41D8CD98F00B204E9800998ECF8427E
0x03d63000 4,096 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
0x03d64000 24,576 bytes 512 bytes 3.01 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE ECD01ACF1F6931E81CBEC79DB5D22EC8
0x03d6a000 4,096 bytes 512 bytes 0.76 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 087E0BF61EDF0720F5812AFDC3B0F7FF
0x03d6b000 4,096 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
0x03d6c000 8,192 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
0x03d6e000 20,480 bytes 5,632 bytes 7.67 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 192475E5B80632748E02354745D9AE58
.rsrc 0x03d73000 8,192 bytes 6,144 bytes 4.43 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE DEEBDAA8FE2AE069C537D68AE3A194AA
0x03d75000 11,677,696 bytes 1,887,232 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 248DE35446412BEA163FCF0D9465300D
0x04898000 2,949,120 bytes 2,948,608 bytes 7.96 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE A802D56649BAB5170A8C861B037E7448
Entropy Analysis Alert

9 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼
Total Resources: 5 (5,377 bytes)
Resource Type Count Total Size Percentage
RT_ICON 2 3,600 bytes
67%
RT_GROUP_ICON 1 34 bytes
0.6%
RT_VERSION 1 576 bytes
10.7%
RT_MANIFEST 1 1,167 bytes
21.7%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Win64.Packed.cl Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win64.Packed.cl without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware