home

service.exe

InfoSpace Sales LLC

The application service.exe by InfoSpace Sales has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘chatzum’.
Publisher:
InfoSpace Sales LLC  (signed and verified)

MD5:
ea7eecdf4827ce4a41b990dba0540171

SHA-1:
d9ed603669931efaba5e1a684095fbedb0b8586a

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
4/27/2024 2:35:57 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InfoSpace.InfoSpaceSales.Installer (M)
16.2.8.3

File size:
338.6 KB (346,712 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\Program Files\wrapper_inst\service.exe

Digital Signature
Signed by:
InfoSpace Sales LLC

Authority:
Symantec Corporation

Valid from:
5/6/2013 7:00:00 PM

Valid to:
5/7/2014 6:59:59 PM

Subject:
CN=InfoSpace Sales LLC, OU=Systems, O=InfoSpace Sales LLC, L=Bellevue, S=Washington, C=US, SERIALNUMBER=3305495, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US

Issuer:
CN=Symantec Class 3 Extended Validation Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
5FFD216358B0FFE8AF4A6CECCA806958

File PE Metadata
Compilation timestamp:
12/5/2009 5:52:12 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6144:VFJ0/onZ1KIqfF5edUJb1tg5pIWnALVO6S3xEgfyaomfMCp3TPOUEX:YoZ1KIKp9Jg60Lf7omfj4U2

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, 1C, 45, 00, E8, F1, 2B, 00, 00, A3, 64, 1B, 45, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 37, 43, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, DB, 44, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, A0, 47, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
chatzum

Command:
C:\Program Files\wrapper_inst\service.exe


Remove service.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.