» cktSvc.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)
Network (24)

cktSvc.exe

Uncheckit Module

Weiwei He

The application cktSvc.exe by Weiwei He has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a scheduled task under the Windows Task Scheduler named UncheckitTaskMN triggered daily at a specified time. This file is typically installed with the program Uncheckit by EVANGEL TECHNOLOGY (HK) LIMITED. While running, it connects to the Internet address server-54-230-216-227.mrs50.r.cloudfront.net on port 80 using the HTTP protocol.

File name:

cktSvc.exe

Publisher:

EVANGEL TECHNOLOGY (HK) LIMITED (signed by Weiwei He)

Product:

Uncheckit Module

Description:

uncheckit svc

Version:

2.1.2.25888

MD5:

d83541346e4652095d4297d2eb6a75ab

SHA-1:

9066f4b87411333f36b4d88e1631b70eb416b10b

SHA-256:

2bf256cbc854c6a2758c6d897deff87acc08953ae0bbb27542d49e761972de46

Scanner detections:

1 / 68

Status:

Potentially unwanted

Analysis date:

2/25/2025 3:50:45 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.Evangel (M)

16.8.4.1

File size:

267.7 KB (274,152 bytes)

Product version:

2.1.2.25888

Original file name:

cktSvc.exe

File type:

Executable application (Win32 EXE)

Language:

English (United Kingdom)

Common path:

C:\Program Files\uncheckit\cktsvc.exe

Digital Signature

Signed by:

Weiwei He

Authority:

thawte, Inc.

Valid from:

7/7/2016 5:00:00 PM

Valid to:

7/8/2017 4:59:59 PM

Subject:

CN=Weiwei He, OU=Individual Developer, O=No Organization Affiliation, L=Beijing, S=Beijing, C=CN

Issuer:

CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:

503914F201F00A07842EDF540EB89BF5

File PE Metadata

Compilation timestamp:

7/31/2016 11:38:30 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

3072:WJ/Eg4RN3PRQ18AipATNNY5Yk60ToD1Fw+lEHzgq4dv65CmwHfxBnnTlI/:u/gf3P+CdARsYk60TENlQ58jH5F5o

Entry address:

0x22925

Entry point:

E8, E7, 04, 00, 00, E9, 4C, FE, FF, FF, CC, FF, 25, 54, 73, 42, 00, 55, 8B, EC, FF, 15, 2C, 71, 42, 00, 6A, 01, A3, 64, BE, 43, 00, E8, D3, 05, 00, 00, FF, 75, 08, E8, D1, 05, 00, 00, 83, 3D, 64, BE, 43, 00, 00, 59, 59, 75, 08, 6A, 01, E8, B9, 05, 00, 00, 59, 68, 09, 04, 00, C0, E8, BA, 05, 00, 00, 59, 5D, C3, 55, 8B, EC, 81, EC, 24, 03, 00, 00, 6A, 17, E8, 3D, 19, 00, 00, 85, C0, 74, 05, 6A, 02, 59, CD, 29, A3, 48, BC, 43, 00, 89, 0D, 44, BC, 43, 00, 89, 15, 40, BC, 43, 00, 89, 1D, 3C, BC, 43, 00, 89, 35... 
[+]

Entropy:

5.7062

Code size:

152 KB (155,648 bytes)

Scheduled Task

Task name:

UncheckitTaskMN

Trigger:

Daily (Runs daily at 6:02 PM)

Description:

Uncheckit Update Task

The file cktSvc.exe has been discovered within the following program.

Uncheckit by EVANGEL TECHNOLOGY (HK) LIMITED

About 5% of users remove it

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to server-54-192-230-25.waw50.r.cloudfront.net (54.192.230.25:80)

TCP (HTTP):

Connects to server-54-230-216-82.mrs50.r.cloudfront.net (54.230.216.82:80)

TCP (HTTP):

Connects to server-54-230-216-227.mrs50.r.cloudfront.net (54.230.216.227:80)

TCP (HTTP):

Connects to server-52-85-74-249.lhr3.r.cloudfront.net (52.85.74.249:80)

TCP (HTTP):

Connects to server-52-85-221-80.cdg50.r.cloudfront.net (52.85.221.80:80)

TCP (HTTP):

Connects to server-54-230-81-162.mia50.r.cloudfront.net (54.230.81.162:80)

TCP (HTTP):

Connects to server-54-230-216-115.mrs50.r.cloudfront.net (54.230.216.115:80)

TCP (HTTP):

Connects to server-54-230-206-51.atl50.r.cloudfront.net (54.230.206.51:80)

TCP (HTTP):

Connects to server-54-230-141-86.sfo5.r.cloudfront.net (54.230.141.86:80)

TCP (HTTP):

Connects to server-54-192-19-140.iad12.r.cloudfront.net (54.192.19.140:80)

TCP (HTTP):

Connects to server-54-240-186-66.mad50.r.cloudfront.net (54.240.186.66:80)

TCP (HTTP):

Connects to server-54-240-186-212.mad50.r.cloudfront.net (54.240.186.212:80)

TCP (HTTP):

Connects to server-54-230-81-237.mia50.r.cloudfront.net (54.230.81.237:80)

TCP (HTTP):

Connects to server-54-230-81-192.mia50.r.cloudfront.net (54.230.81.192:80)

TCP (HTTP):

Connects to server-54-230-81-10.mia50.r.cloudfront.net (54.230.81.10:80)

TCP (HTTP):

Connects to server-54-230-216-158.mrs50.r.cloudfront.net (54.230.216.158:80)

TCP (HTTP):

Connects to server-54-230-206-164.atl50.r.cloudfront.net (54.230.206.164:80)

TCP (HTTP):

Connects to server-54-230-0-169.lhr5.r.cloudfront.net (54.230.0.169:80)

TCP (HTTP):

Connects to server-54-192-203-174.fra50.r.cloudfront.net (54.192.203.174:80)

TCP (HTTP):

Connects to server-54-192-130-70.ams50.r.cloudfront.net (54.192.130.70:80)

Remove cktSvc.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.