abce9c1f2212e5eb9792c9fa7e82c9feeff7ec3328984f1aa4b36a1201fd7b63

HOSTILE

abce9c1f2212e5eb9792c9fa7e82c9feeff7ec3328984f1aa4b36a1201fd7b63 · 92%

AI Masquerading PE loader with evasion

Mal-ecule

O(Er₂)H₂(F₃Mg)Md₃(Bi₄PaPt)

Size 131.5 KB download

First seen 21 hours ago

Analyzed 10 hours ago

Ecosystem windows

Source abuse.ch

Also detected by 2 sources

Unsigned PE masquerades as svchost while validating another image: 1111.exe:0x0

Unsigned PE uses TLS startup and opaque inline image loading: 1111.exe:0x0

References svchost executable name: 1111.exe:0x1e1cf

1111.exe pe

0x0	4d5a90000300000004000000ffff0000	MZ..............Unsigned PE masquerades as svchost while validating another image
0x10	b8000000000000004000000000000000	........@.......
0x20	00000000000000000000000000000000	................
0x30	00000000000000000000000080000000	................
0x40	0e1fba0e00b409cd21b8014ccd215468	........!..L.!Th
0x50	69732070726f6772616d2063616e6e6f	is program canno
0x60	742062652072756e2069	t be run i

0x5c5	f00100c70001000000488b05cbef0100	.........H......
0x5d5	6681384d5a75444863503c4801d08138	f.8MZuDHcP<H...8Unsigned PE masquerades as svchost while validating another image
0x5e5	5045000075350fb750186681fa0b010f	PE..u5..P.f.....
0x5f5	84df0100006681fa0b	.....f...

0x2ac9	c0c30f1f440000488b05c9ca010031d2	....D..H......1.
0x2ad9	6681384d5a750f4863483c4801c18139	f.8MZu.HcH<H...9Unsigned PE masquerades as svchost while validating another image
0x2ae9	5045000074094889d0c30f1f44000066	PE..t.H.....D..f
0x2af9	8179180b02480f44d0	.y...H.D.

0x33f0	00000000000000000000000000000000	................
0x3400	7cbaa77b6b671ca694c4cd66c27a9cc3	\|..{kg.....f.z..Unsigned PE uses TLS startup and opaque inline image loading
0x3410	fc97c1fabf900d2d105603954ded1952	.......-.V..M..R
0x3420	344a7425b07cd40c997ad07a6b2f9436	4Jt%.\|...z.zk/.6
0x3430	5fd1a5371c192cc05e5041a46aff8c93	_..7..,.^PA.j...
0x3440	baf1998ec85544de14cb71b4bf6e2616	.....UD...q..n&.
0x3450	c844d993394f25ab28442cbaba915ee0	.D..9O%.(D,...^.
0x3460	b8cfc54de9635ef03133bfeb869d6722	...M.c^.13....g"
0x3470	71174e340fa060289092b11458f6c00f	q.N4..`(....X...
0x3480	b35577f92b2cd0c0b839b6f584062e45	.Uw.+,...9.....E
0x3490	7eafeb90e08c0405188b49046d05cbd2	~.........I.m...
0x34a0	426fe2bbcc6204a2476afbef7791b355	Bo...b..Gj..w..U
0x34b0	0570c47036a7dcd491b386d895090398	.p.p6...........
0x34c0	844e64dc47783743d0e22cb9f916a86a	.Nd.Gx7C..,....j
0x34d0	efa8fecea7b5f4a1edab126a0758db50	...........j.X.P
0x34e0	26f14fa383ea3f96ce7dd9015d112b77	&.O...?..}..].+w
0x34f0	88b983b682fbc436ee6e04a379dfe360	.......6.n..y..`
0x3500	db749ff87d7d4f4527f5383938efc441	.t..}}OE'.898..A
0x3510	c51fb2200acdb8b967d1be4f18450a70	... ....g..O.E.p
0x3520	5a22c0f4a982cd54bb55713dbf537b60	Z".....T.Uq=.S{`
0x3530	a2caa78be48fe2266b422eb46f802d62	.......&kB..o.-b
0x3540	76e849213fef15a6e415085b3cd1f9d5	v.I!?......[<...
0x3550	a5a7d2e95e308e62a17c3c5f1cf64bbf	....^0.b.\|<_..K.
0x3560	216774bdbde2bd9c8c6d022b3b757a06	!gt......m.+;uz.
0x3570	c024a6d98fd63a11157a7f030ecd9cf8	.$....:..z......
0x3580	bc4d97caf6f76ff1c2bd7d221630316b	.M....o...}".01k
0x3590	c5cb3b8bb2b32c7ad46aafb768d0ccb4	..;...,z.j..h...
0x35a0	028d8307e1911e50f22540a0469eb4f9	.......P.%@.F...
0x35b0	1b6dacd75f0f267955c523c20701699e	.m.._.&yU.#...i.
0x35c0	425955a51e1118fee662c712d3cd1bd0	BYU......b......
0x35d0	03c4f9575bdb979c018bbe1d0ea4587b	...W[.........X{
0x35e0	da84adf9002c5e4404ef4f524d31857b	.....,^D..ORM1.{
0x35f0	69bbeccaf15a65e614188187aefbbb6b	i....Ze........k
0x3600	86567bb6d730a74ef669db2b3211bc67	.V{..0.N.i.+2..g
0x3610	064c900f0c55b3bfa8214e7d3e8abdf8	.L...U...!N}>...

0x1e1b4	00000000153e4f611b370e3d503f5163	.....>Oa.7.=P?Qc
0x1e1c4	433a5c57696e646f77735c737663686f	C:\Windows\svchoUnsigned PE masquerades as svchost while validating another image
0x1e1d4	73742e65786500000000000000000000	st.exe..........
0x1e1e4	00000000000000000000000000000000	................
0x1e1f4	000000000000	......

Objectives

0x0	4d5a90000300000004000000ffff0000	MZ..............
0x10	b8000000000000004000000000000000	........@.......
0x20	00000000000000000000000000000000	................
0x30	00000000000000000000000080000000	................
0x40	0e1fba0e00b409cd21b8014ccd215468	........!..L.!Th
0x50	69732070726f6772616d2063616e6e6f	is program canno
0x60	742062652072756e2069	t be run i

0x5c5	f00100c70001000000488b05cbef0100	.........H......
0x5d5	6681384d5a75444863503c4801d08138	f.8MZuDHcP<H...8
0x5e5	5045000075350fb750186681fa0b010f	PE..u5..P.f.....
0x5f5	84df0100006681fa0b	.....f...

0x2ac9	c0c30f1f440000488b05c9ca010031d2	....D..H......1.
0x2ad9	6681384d5a750f4863483c4801c18139	f.8MZu.HcH<H...9
0x2ae9	5045000074094889d0c30f1f44000066	PE..t.H.....D..f
0x2af9	8179180b02480f44d0	.y...H.D.

0x1e1b4	00000000153e4f611b370e3d503f5163	.....>Oa.7.=P?Qc
0x1e1c4	433a5c57696e646f77735c737663686f	C:\Windows\svcho
0x1e1d4	73742e65786500000000000000000000	st.exe..........
0x1e1e4	00000000000000000000000000000000	................
0x1e1f4	000000000000	......

0x0	4d5a90000300000004000000ffff0000	MZ..............
0x10	b8000000000000004000000000000000	........@.......
0x20	00000000000000000000000000000000	................
0x30	00000000000000000000000080000000	................
0x40	0e1fba0e00b409cd21b8014ccd215468	........!..L.!Th
0x50	69732070726f6772616d2063616e6e6f	is program canno
0x60	742062652072756e2069	t be run i

0x5c5	f00100c70001000000488b05cbef0100	.........H......
0x5d5	6681384d5a75444863503c4801d08138	f.8MZuDHcP<H...8
0x5e5	5045000075350fb750186681fa0b010f	PE..u5..P.f.....
0x5f5	84df0100006681fa0b	.....f...

0x2ac9	c0c30f1f440000488b05c9ca010031d2	....D..H......1.
0x2ad9	6681384d5a750f4863483c4801c18139	f.8MZu.HcH<H...9
0x2ae9	5045000074094889d0c30f1f44000066	PE..t.H.....D..f
0x2af9	8179180b02480f44d0	.y...H.D.

0x33f0	00000000000000000000000000000000	................
0x3400	7cbaa77b6b671ca694c4cd66c27a9cc3	\|..{kg.....f.z..
0x3410	fc97c1fabf900d2d105603954ded1952	.......-.V..M..R
0x3420	344a7425b07cd40c997ad07a6b2f9436	4Jt%.\|...z.zk/.6
0x3430	5fd1a5371c192cc05e5041a46aff8c93	_..7..,.^PA.j...
0x3440	baf1998ec85544de14cb71b4bf6e2616	.....UD...q..n&.
0x3450	c844d993394f25ab28442cbaba915ee0	.D..9O%.(D,...^.
0x3460	b8cfc54de9635ef03133bfeb869d6722	...M.c^.13....g"
0x3470	71174e340fa060289092b11458f6c00f	q.N4..`(....X...
0x3480	b35577f92b2cd0c0b839b6f584062e45	.Uw.+,...9.....E
0x3490	7eafeb90e08c0405188b49046d05cbd2	~.........I.m...
0x34a0	426fe2bbcc6204a2476afbef7791b355	Bo...b..Gj..w..U
0x34b0	0570c47036a7dcd491b386d895090398	.p.p6...........
0x34c0	844e64dc47783743d0e22cb9f916a86a	.Nd.Gx7C..,....j
0x34d0	efa8fecea7b5f4a1edab126a0758db50	...........j.X.P
0x34e0	26f14fa383ea3f96ce7dd9015d112b77	&.O...?..}..].+w
0x34f0	88b983b682fbc436ee6e04a379dfe360	.......6.n..y..`
0x3500	db749ff87d7d4f4527f5383938efc441	.t..}}OE'.898..A
0x3510	c51fb2200acdb8b967d1be4f18450a70	... ....g..O.E.p
0x3520	5a22c0f4a982cd54bb55713dbf537b60	Z".....T.Uq=.S{`
0x3530	a2caa78be48fe2266b422eb46f802d62	.......&kB..o.-b
0x3540	76e849213fef15a6e415085b3cd1f9d5	v.I!?......[<...
0x3550	a5a7d2e95e308e62a17c3c5f1cf64bbf	....^0.b.\|<_..K.
0x3560	216774bdbde2bd9c8c6d022b3b757a06	!gt......m.+;uz.
0x3570	c024a6d98fd63a11157a7f030ecd9cf8	.$....:..z......
0x3580	bc4d97caf6f76ff1c2bd7d221630316b	.M....o...}".01k
0x3590	c5cb3b8bb2b32c7ad46aafb768d0ccb4	..;...,z.j..h...
0x35a0	028d8307e1911e50f22540a0469eb4f9	.......P.%@.F...
0x35b0	1b6dacd75f0f267955c523c20701699e	.m.._.&yU.#...i.
0x35c0	425955a51e1118fee662c712d3cd1bd0	BYU......b......
0x35d0	03c4f9575bdb979c018bbe1d0ea4587b	...W[.........X{
0x35e0	da84adf9002c5e4404ef4f524d31857b	.....,^D..ORM1.{
0x35f0	69bbeccaf15a65e614188187aefbbb6b	i....Ze........k
0x3600	86567bb6d730a74ef669db2b3211bc67	.V{..0.N.i.+2..g
0x3610	064c900f0c55b3bfa8214e7d3e8abdf8	.L...U...!N}>...

Micro-behaviors

Metadata

0x33f0	00000000000000000000000000000000	................
0x3400	7cbaa77b6b671ca694c4cd66c27a9cc3	\|..{kg.....f.z..
0x3410	fc97c1fabf900d2d105603954ded1952	.......-.V..M..R
0x3420	344a7425b07cd40c997ad07a6b2f9436	4Jt%.\|...z.zk/.6
0x3430	5fd1a5371c192cc05e5041a46aff8c93	_..7..,.^PA.j...
0x3440	baf1998ec85544de14cb71b4bf6e2616	.....UD...q..n&.
0x3450	c844d993394f25ab28442cbaba915ee0	.D..9O%.(D,...^.
0x3460	b8cfc54de9635ef03133bfeb869d6722	...M.c^.13....g"
0x3470	71174e340fa060289092b11458f6c00f	q.N4..`(....X...
0x3480	b35577f92b2cd0c0b839b6f584062e45	.Uw.+,...9.....E
0x3490	7eafeb90e08c0405188b49046d05cbd2	~.........I.m...
0x34a0	426fe2bbcc6204a2476afbef7791b355	Bo...b..Gj..w..U
0x34b0	0570c47036a7dcd491b386d895090398	.p.p6...........
0x34c0	844e64dc47783743d0e22cb9f916a86a	.Nd.Gx7C..,....j
0x34d0	efa8fecea7b5f4a1edab126a0758db50	...........j.X.P
0x34e0	26f14fa383ea3f96ce7dd9015d112b77	&.O...?..}..].+w
0x34f0	88b983b682fbc436ee6e04a379dfe360	.......6.n..y..`
0x3500	db749ff87d7d4f4527f5383938efc441	.t..}}OE'.898..A
0x3510	c51fb2200acdb8b967d1be4f18450a70	... ....g..O.E.p
0x3520	5a22c0f4a982cd54bb55713dbf537b60	Z".....T.Uq=.S{`
0x3530	a2caa78be48fe2266b422eb46f802d62	.......&kB..o.-b
0x3540	76e849213fef15a6e415085b3cd1f9d5	v.I!?......[<...
0x3550	a5a7d2e95e308e62a17c3c5f1cf64bbf	....^0.b.\|<_..K.
0x3560	216774bdbde2bd9c8c6d022b3b757a06	!gt......m.+;uz.
0x3570	c024a6d98fd63a11157a7f030ecd9cf8	.$....:..z......
0x3580	bc4d97caf6f76ff1c2bd7d221630316b	.M....o...}".01k
0x3590	c5cb3b8bb2b32c7ad46aafb768d0ccb4	..;...,z.j..h...
0x35a0	028d8307e1911e50f22540a0469eb4f9	.......P.%@.F...
0x35b0	1b6dacd75f0f267955c523c20701699e	.m.._.&yU.#...i.
0x35c0	425955a51e1118fee662c712d3cd1bd0	BYU......b......
0x35d0	03c4f9575bdb979c018bbe1d0ea4587b	...W[.........X{
0x35e0	da84adf9002c5e4404ef4f524d31857b	.....,^D..ORM1.{
0x35f0	69bbeccaf15a65e614188187aefbbb6b	i....Ze........k
0x3600	86567bb6d730a74ef669db2b3211bc67	.V{..0.N.i.+2..g
0x3610	064c900f0c55b3bfa8214e7d3e8abdf8	.L...U...!N}>...

0x33f0	00000000000000000000000000000000	................
0x3400	7cbaa77b6b671ca694c4cd66c27a9cc3	\|..{kg.....f.z..
0x3410	fc97c1fabf900d2d105603954ded1952	.......-.V..M..R
0x3420	344a7425b07cd40c997ad07a6b2f9436	4Jt%.\|...z.zk/.6
0x3430	5fd1a5371c192cc05e5041a46aff8c93	_..7..,.^PA.j...
0x3440	baf1998ec85544de14cb71b4bf6e2616	.....UD...q..n&.
0x3450	c844d993394f25ab28442cbaba915ee0	.D..9O%.(D,...^.
0x3460	b8cfc54de9635ef03133bfeb869d6722	...M.c^.13....g"
0x3470	71174e340fa060289092b11458f6c00f	q.N4..`(....X...
0x3480	b35577f92b2cd0c0b839b6f584062e45	.Uw.+,...9.....E
0x3490	7eafeb90e08c0405188b49046d05cbd2	~.........I.m...
0x34a0	426fe2bbcc6204a2476afbef7791b355	Bo...b..Gj..w..U
0x34b0	0570c47036a7dcd491b386d895090398	.p.p6...........
0x34c0	844e64dc47783743d0e22cb9f916a86a	.Nd.Gx7C..,....j
0x34d0	efa8fecea7b5f4a1edab126a0758db50	...........j.X.P
0x34e0	26f14fa383ea3f96ce7dd9015d112b77	&.O...?..}..].+w
0x34f0	88b983b682fbc436ee6e04a379dfe360	.......6.n..y..`
0x3500	db749ff87d7d4f4527f5383938efc441	.t..}}OE'.898..A
0x3510	c51fb2200acdb8b967d1be4f18450a70	... ....g..O.E.p
0x3520	5a22c0f4a982cd54bb55713dbf537b60	Z".....T.Uq=.S{`
0x3530	a2caa78be48fe2266b422eb46f802d62	.......&kB..o.-b
0x3540	76e849213fef15a6e415085b3cd1f9d5	v.I!?......[<...
0x3550	a5a7d2e95e308e62a17c3c5f1cf64bbf	....^0.b.\|<_..K.
0x3560	216774bdbde2bd9c8c6d022b3b757a06	!gt......m.+;uz.
0x3570	c024a6d98fd63a11157a7f030ecd9cf8	.$....:..z......
0x3580	bc4d97caf6f76ff1c2bd7d221630316b	.M....o...}".01k
0x3590	c5cb3b8bb2b32c7ad46aafb768d0ccb4	..;...,z.j..h...
0x35a0	028d8307e1911e50f22540a0469eb4f9	.......P.%@.F...
0x35b0	1b6dacd75f0f267955c523c20701699e	.m.._.&yU.#...i.
0x35c0	425955a51e1118fee662c712d3cd1bd0	BYU......b......
0x35d0	03c4f9575bdb979c018bbe1d0ea4587b	...W[.........X{
0x35e0	da84adf9002c5e4404ef4f524d31857b	.....,^D..ORM1.{
0x35f0	69bbeccaf15a65e614188187aefbbb6b	i....Ze........k
0x3600	86567bb6d730a74ef669db2b3211bc67	.V{..0.N.i.+2..g
0x3610	064c900f0c55b3bfa8214e7d3e8abdf8	.L...U...!N}>...

0x2094c	630074004e0061006d00650000000000	c.t.N.a.m.e.....
0x2095c	43006f006e0066006900670075007200	C.o.n.f.i.g.u.r.
0x2096c	6100740069006f006e0020004d006100	a.t.i.o.n. .M.a.
0x2097c	6e00610067006500720000003e000d00	n.a.g.e.r...>...
0x2098c	0100500072006f006400750063007400	..P.r.o.d.u.c.t.
0x2099c	560065007200730069006f006e000000	V.e.r.s.i.o.n...
0x209ac	310030002e0030002e00310039003000	1.0...0...1.9.0.

0x207ae	300034004200300000003e000f000100	0.4.B.0...>.....
0x207be	43006f006d00700061006e0079004e00	C.o.m.p.a.n.y.N.
0x207ce	61006d0065000000000057006f006f00	a.m.e.....W.o.o.
0x207de	6400670072006f007600650020004200	d.g.r.o.v.e. .B.
0x207ee	61006e006b0000000000540016000100	a.n.k.....T.....
0x207fe	460069006c0065004400650073006300	F.i.l.e.D.e.s.c.
0x2080e	720069007000740069006f006e000000	r.i.p.t.i.o.n...
0x2081e	000043006f006e006600690067007500	..C.o.n.f.i.g.u.
0x2082e	72006100740069006f006e0020005500	r.a.t.i.o.n. .U.
0x2083e	740069006c0069007400790000003a00	t.i.l.i.t.y...:.
0x2084e	0d000100460069006c00650056006500	....F.i.l.e.V.e.
0x2085e	7200730069006f006e00000000003100	r.s.i.o.n.....1.
0x2086e	30002e0030002e003100390030003400	0...0...1.9.0.4.
0x2087e	31002e00310000000000300008000100	1...1.....0.....
0x2088e	49006e007400650072006e0061006c00	I.n.t.e.r.n.a.l.
0x2089e	4e0061006d0065000000630066006700	N.a.m.e...c.f.g.
0x208ae	7500740069006c0000004200	u.t.i.l...B.

0x20716	6c793e0a000000000000ec0234000000	ly>.........4...
0x20726	560053005f0056004500520053004900	V.S._.V.E.R.S.I.
0x20736	4f004e005f0049004e0046004f000000	O.N._.I.N.F.O...
0x20746	0000bd04effe0000010000000a0001	...............

0x208cc	70007900720069006700680074000000	p.y.r.i.g.h.t...
0x208dc	57006f006f006400670072006f007600	W.o.o.d.g.r.o.v.
0x208ec	65002000420061006e006b0000000000	e. .B.a.n.k.....
0x208fc	40000c0001004f007200690067006900	@.....O.r.i.g.i.
0x2090c	6e0061006c00460069006c0065006e00	n.a.l.F.i.l.e.n.
0x2091c	61006d00650000006300660067007500	a.m.e...c.f.g.u.
0x2092c	740069006c00	t.i.l.

Identity

SHA-256	abce9c1f2212e5eb9792c9fa7e82c9feeff7ec3328984f1aa4b36a1201fd7b63
Filename	1111.exe
Package	abce9c1f2212e5eb9792c9fa7e82c9feeff7ec3328984f1aa4b36a1201fd7b63

Origin

Source	harvest
Feed	malwarebazaar
Ecosystem	windows
Domain	abuse.ch

Timeline

First seen	24 Jul 2026 07:24 UTC
First analyzed	24 Jul 2026 17:22 UTC
Last analyzed	24 Jul 2026 18:48 UTC
Last updated	24 Jul 2026 18:46 UTC

Labeling

Label	bad
Label source	cyclotron:good
Traits version	294eb

Not seeing what you expected? Let us know

0x1e700	60300240010000000000000000000000	`0.@............
0x1e710	4743433a2028474e55292031352e322e	GCC: (GNU) 15.2.
0x1e720	30000000000000000000000000000000	0...............
0x1e730	4743433a2028474e5529	GCC: (GNU)