» cktSvc.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)
Network (38)

cktSvc.exe

Uncheckit Module

Weiwei He

The application cktSvc.exe by Weiwei He has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a scheduled task under the Windows Task Scheduler named UncheckitTaskMN triggered daily at a specified time. This file is typically installed with the program Uncheckit by EVANGEL TECHNOLOGY (HK) LIMITED. While running, it connects to the Internet address server-52-84-246-143.sfo20.r.cloudfront.net on port 80 using the HTTP protocol.

File name:

cktSvc.exe

Publisher:

EVANGEL TECHNOLOGY (HK) LIMITED (signed by Weiwei He)

Product:

Uncheckit Module

Description:

uncheckit svc

Version:

2.1.2.25888

MD5:

10544fc8a59103240b7a529c68c9936a

SHA-1:

ced9423e13fadaf8477de3d6929187a9c0b07835

SHA-256:

bd67b0048c7ce47bb3947daaca5e52fab6c1ea8e9b158a63211e272f085f448c

Scanner detections:

1 / 68

Status:

Potentially unwanted

Analysis date:

4/26/2024 8:47:00 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.Evangel (M)

16.8.24.10

File size:

267.7 KB (274,152 bytes)

Product version:

2.1.2.25888

Original file name:

cktSvc.exe

File type:

Executable application (Win32 EXE)

Language:

English (United Kingdom)

Common path:

C:\Program Files\uncheckit\cktsvc.exe

Digital Signature

Signed by:

Weiwei He

Authority:

thawte, Inc.

Valid from:

8/23/2016 5:30:00 AM

Valid to:

7/9/2017 5:29:59 AM

Subject:

CN=Weiwei He, OU=Individual Developer, O=No Organization Affiliation, L=Beijing, S=Beijing, C=CN

Issuer:

CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:

55B29DAD74F8C8240FBD08D0CA65D4B4

File PE Metadata

Compilation timestamp:

8/24/2016 10:47:25 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

3072:sJ/Eg4RN3PRQ18AipATNNY5Yk60ToD1Fw+lEHzgqAda65CtwHfxBnnTlyT:I/gf3P+CdARsYk60TENlQ5EPH5F5+

Entry address:

0x22925

Entry point:

E8, E7, 04, 00, 00, E9, 4C, FE, FF, FF, CC, FF, 25, 54, 73, 42, 00, 55, 8B, EC, FF, 15, 2C, 71, 42, 00, 6A, 01, A3, 64, BE, 43, 00, E8, D3, 05, 00, 00, FF, 75, 08, E8, D1, 05, 00, 00, 83, 3D, 64, BE, 43, 00, 00, 59, 59, 75, 08, 6A, 01, E8, B9, 05, 00, 00, 59, 68, 09, 04, 00, C0, E8, BA, 05, 00, 00, 59, 5D, C3, 55, 8B, EC, 81, EC, 24, 03, 00, 00, 6A, 17, E8, 3D, 19, 00, 00, 85, C0, 74, 05, 6A, 02, 59, CD, 29, A3, 48, BC, 43, 00, 89, 0D, 44, BC, 43, 00, 89, 15, 40, BC, 43, 00, 89, 1D, 3C, BC, 43, 00, 89, 35... 
[+]

Entropy:

5.7060

Code size:

152 KB (155,648 bytes)

Scheduled Task

Task name:

UncheckitTaskMN

Trigger:

Daily (Runs daily at 5:57 PM)

Description:

Uncheckit Update Task

The file cktSvc.exe has been discovered within the following program.

Uncheckit by EVANGEL TECHNOLOGY (HK) LIMITED

About 5% of users remove it

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to server-54-230-187-85.cdg51.r.cloudfront.net (54.230.187.85:80)

TCP (HTTP):

Connects to server-54-192-3-170.lhr5.r.cloudfront.net (54.192.3.170:80)

TCP (HTTP):

Connects to server-54-240-186-248.mad50.r.cloudfront.net (54.240.186.248:80)

TCP (HTTP):

Connects to server-54-230-216-27.mrs50.r.cloudfront.net (54.230.216.27:80)

TCP (HTTP):

Connects to server-54-230-163-222.jax1.r.cloudfront.net (54.230.163.222:80)

TCP (HTTP):

Connects to server-52-85-83-196.lax1.r.cloudfront.net (52.85.83.196:80)

TCP (HTTP):

Connects to server-52-84-246-245.sfo20.r.cloudfront.net (52.84.246.245:80)

TCP (HTTP):

Connects to server-54-240-186-250.mad50.r.cloudfront.net (54.240.186.250:80)

TCP (HTTP):

Connects to server-54-240-186-22.mad50.r.cloudfront.net (54.240.186.22:80)

TCP (HTTP):

Connects to server-54-240-186-151.mad50.r.cloudfront.net (54.240.186.151:80)

TCP (HTTP):

Connects to server-54-239-132-204.sfo9.r.cloudfront.net (54.239.132.204:80)

TCP (HTTP):

Connects to server-54-230-81-253.mia50.r.cloudfront.net (54.230.81.253:80)

TCP (HTTP):

Connects to server-54-230-216-52.mrs50.r.cloudfront.net (54.230.216.52:80)

TCP (HTTP):

Connects to server-54-230-216-38.mrs50.r.cloudfront.net (54.230.216.38:80)

TCP (HTTP):

Connects to server-54-230-216-121.mrs50.r.cloudfront.net (54.230.216.121:80)

TCP (HTTP):

Connects to server-54-230-163-29.jax1.r.cloudfront.net (54.230.163.29:80)

TCP (HTTP):

Connects to server-54-230-163-15.jax1.r.cloudfront.net (54.230.163.15:80)

TCP (HTTP):

Connects to server-54-230-163-145.jax1.r.cloudfront.net (54.230.163.145:80)

TCP (HTTP):

Connects to server-54-230-141-241.sfo5.r.cloudfront.net (54.230.141.241:80)

TCP (HTTP):

Connects to server-54-230-141-101.sfo5.r.cloudfront.net (54.230.141.101:80)

Remove cktSvc.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.