home

PService.exe

PService

Daniele Gentile

The application PService.exe by Daniele Gentile has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘pservice’. While running, it connects to the Internet address dc.c3.564a.ip4.static.sl-reverse.com on port 80 using the HTTP protocol.
Publisher:
Daniele Gentile  (signed and verified)

Product:
PService

Version:
1.0.0.0

MD5:
50b5f755c058806458fd4ff40606bf5a

SHA-1:
db425eecfc846a8020caf297c28349e920f40693

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/5/2024 8:24:32 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Yontoo.DanieleG (M)
16.6.8.23

File size:
70.8 KB (72,480 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2016

Original file name:
PService.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Documents and Settings\{user}\Application data\adservice\pservice.exe

Digital Signature
Signed by:
Daniele Gentile

Authority:
Symantec Corporation

Valid from:
11/11/2015 1:00:00 AM

Valid to:
11/11/2016 12:59:59 AM

Subject:
CN=Daniele Gentile, OU=Individual Developer, O=No Organization Affiliation, L=San Antonio Escazu, S=San Jose, C=CR

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
4CB02417B45C2A56731C8C04E29E02C4

File PE Metadata
Compilation timestamp:
6/8/2016 11:09:48 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
1536:naJJOSXOqkPxcSdt7bfzWLHEyR4CS6rhRYBKH7LwXuHcCGfCOQ0sgUi1+JlwdMBN:5S+9aI/Es9vFuf8H6

Entry address:
0x1238E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
65 KB (66,560 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
pservice

Command:
"C:\Documents and Settings\{user}\Application data\adservice\pservice.exe"


The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to dc.c3.564a.ip4.static.sl-reverse.com  (74.86.195.220:80)

Remove PService.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.