home

winsvcsa.exe

Viatlio Corporation

The executable winsvcsa.exe has been detected as malware by 6 anti-virus scanners. It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘Microsoft Windows Servicef’.
Publisher:
Viatlio Corporation  (signed and verified)

Version:
0.0.0.0

MD5:
79ba263bbc97c2c4837c86511d846b69

SHA-1:
af0e144fc7f55f6a1b6613e8c2d2ca939ad06432

SHA-256:
8454d7537b341161c683a0c908e1cc0b0d96dfb315549f36cd7ec8ce6de156c0

Scanner detections:
6 / 68

Status:
Malware

Analysis date:
11/27/2024 5:53:38 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Malware-gen
160518-2

Dr.Web
Win32.HLLW.Phorpiex.54
9.0.1.05190

ESET NOD32
MSIL/Injector.OVC trojan
8.0.319.0

F-Secure
Trojan.GenericKD.3201005
5.15.96

Microsoft Security Essentials
Threat.Undefined
1.223.2495.0

Norman
Trojan.GenericKD.3201005
22.05.2016 07:18:28

File size:
1.2 MB (1,208,840 bytes)

Product version:
0.0.0.0

Original file name:
iURXgWaV08FNUGLrnnNo1ZKou5shfFqAuHucGHx.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\windows\m-50502425506457483030076277654202405\winsvcsa.exe

Digital Signature
Signed by:
Viatlio Corporation

Authority:
Viatlio Corporation

Valid from:
4/2/2016 6:02:53 PM

Valid to:
4/3/2017 6:02:53 PM

Subject:
E=viat@lio.com, CN=Viat Lio, OU=NAS Dept., O=Viatlio Corporation, L=Sydney, S=New South Wales, C=AU

Issuer:
E=viat@lio.com, CN=Viat Lio, OU=NAS Dept., O=Viatlio Corporation, L=Sydney, S=New South Wales, C=AU

Serial number:
00F2C8FB738509EF37

File PE Metadata
Compilation timestamp:
4/13/2016 10:37:24 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
3072:xsXqoNMqPl6iZ+oQyc8IPIEeMEe3pRHylS5:mnl6iLT3IPQMAS

Entry address:
0x1727E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
0.8841

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
85 KB (87,040 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Microsoft Windows Servicef

Command:
C:\windows\m-50502425506457483030076277654202405\winsvcsa.exe


Remove winsvcsa.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.