home

ApplicationService.exe

Application Service

App Services

The executable ApplicationService.exe, “Application Layer Service” has been detected as malware by 52 anti-virus scanners. It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘Application Service’. While running, it connects to the Internet address 209-99-40-224.fwd.datafoundry.com on port 80 using the HTTP protocol.
Publisher:
App Services

Product:
Application Service

Description:
Application Layer Service

Version:
2.2.2.2

MD5:
db2e1b6871e13ca4daa818c6c00c1b00

SHA-1:
53ad50ed5f50aeb8d413946aa5bd0232d2e60b46

SHA-256:
fd7852e96a3d10c51ca46583d1ac10c19b2f794d9202b60be06b27180fdcdefa

Scanner detections:
52 / 68

Status:
Malware

Analysis date:
4/26/2024 2:49:06 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Worm.Generic.470677
1011

Agnitum Outpost
Worm.Agent
7.1.1

Avira AntiVirus
TR/Agent.cada.23735
7.11.145.108

avast!
Win32:Dropper-gen [Drp]
2014.9-140429

AVG
MSIL2
2015.0.3489

Baidu Antivirus
Trojan.MSIL.Agent
4.0.3.14429

Bitdefender
Worm.Generic.470677
1.0.20.595

Comodo Security
UnclassifiedMalware
18173

Emsisoft Anti-Malware
Worm.Generic.470677
8.14.04.29.03

ESET NOD32
MSIL/Agent.FQ
8.9728

Fortinet FortiGate
W32/Agent.FQ!tr
4/29/2014

F-Secure
Worm.Generic.470677
11.2014-29-04_3

G Data
Worm.Generic.470677
14.4.24

IKARUS anti.virus
Trojan.MSIL2
t3scan.1.6.1.0

K7 AntiVirus
Trojan
13.176.11896

Kaspersky
Trojan.MSIL.Agent
14.0.0.3942

McAfee
RDN/Generic.dx!cvv
5600.7145

MicroWorld eScan
Worm.Generic.470677
15.0.0.357

NANO AntiVirus
Trojan.Win32.Agent.cwrkap
0.28.0.59492

Norman
Suspicious_Gen4.FPXFA
11.20140429

nProtect
Worm.Generic.470677
14.04.27.01

Panda Antivirus
Generic Malware
14.04.29.03

Quick Heal
Trojan.Agent.djs
4.14.14.00

Sophos
Mal/Generic-S
4.98

Trend Micro House Call
TROJ_AGENT.BIHB
7.2.119

Trend Micro
TROJ_AGENT.BIHB
10.465.29

Vba32 AntiVirus
Trojan.MSIL.Agent
3.12.26.0

VIPRE Antivirus
Trojan.Win32.Generic
28622

File size:
49.5 KB (50,688 bytes)

Product version:
2.2.2.2

Copyright:
Copyright © Application Layer Service 2010

Original file name:
ApplicationService.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\ProgramData\application\applicationservice.exe

File PE Metadata
Compilation timestamp:
6/29/2012 1:43:58 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
768:1hRa8Kf6S03T+i1a3H+X0oAUvQZkwayOwHcNZvthZ+82BlHLizYcHeIm:fRa8I6/3T+i1aX+EoF0qwHcNZ7ZQ3vI

Entry address:
0x671E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
5.8987

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
18 KB (18,432 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Application Service

Command:
C:\ProgramData\application\applicationservice.exe


The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to 209-99-40-224.fwd.datafoundry.com  (209.99.40.224:80)

TCP (HTTP):
Connects to mail.techbuilderhub.com  (64.71.180.17:80)

TCP (HTTP):
Connects to host-milton-134.dns247.com  (72.52.82.134:80)

TCP (HTTP SSL):
Connects to ghs-vip-any-c789.ghs-ssl.googlehosted.com  (72.14.248.27:443)

TCP (HTTP SSL):
Connects to e6.f9.5177.ip4.static.sl-reverse.com  (119.81.249.230:443)

TCP (HTTP SSL):
Connects to da.22.caa1.ip4.static.sl-reverse.com  (161.202.34.218:443)

TCP (HTTP SSL):
Connects to d3.22.caa1.ip4.static.sl-reverse.com  (161.202.34.211:443)

TCP (HTTP SSL):
Connects to f8.b2.5177.ip4.static.sl-reverse.com  (119.81.178.248:443)

TCP (HTTP):
Connects to a23-35-91-27.deploy.static.akamaitechnologies.com  (23.35.91.27:80)

TCP (HTTP):
Connects to a23-35-85-163.deploy.static.akamaitechnologies.com  (23.35.85.163:80)

TCP (HTTP SSL):
Connects to server-204-246-164-148.sin2.r.cloudfront.net  (204.246.164.148:443)

TCP (HTTP SSL):
Connects to c4.22.caa1.ip4.static.sl-reverse.com  (161.202.34.196:443)

TCP (HTTP SSL):
Connects to 5a.2d.caa1.ip4.static.sl-reverse.com  (161.202.45.90:443)

TCP (HTTP SSL):
Connects to 4a.2d.caa1.ip4.static.sl-reverse.com  (161.202.45.74:443)

TCP (HTTP SSL):
Connects to e2.f9.5177.ip4.static.sl-reverse.com  (119.81.249.226:443)

TCP (HTTP):
Connects to a23-50-91-27.deploy.static.akamaitechnologies.com  (23.50.91.27:80)

TCP (HTTP):
Connects to a23-50-85-163.deploy.static.akamaitechnologies.com  (23.50.85.163:80)

TCP (HTTP):
Connects to host-119.2.100.223.ggc.druknet.bt  (119.2.100.223:80)

TCP (HTTP SSL):
Connects to fb.f9.5177.ip4.static.sl-reverse.com  (119.81.249.251:443)

TCP (HTTP SSL):
Connects to f6.f9.5177.ip4.static.sl-reverse.com  (119.81.249.246:443)

Remove ApplicationService.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.