home

smss.exe

ToxicProcess

Tera information Technology co.Ltd

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘winsxstf’.
Publisher:
Tera information Technology co.Ltd  (signed and verified)

Product:
ToxicProcess

Version:
1.00

MD5:
a9f69af2505d2b3aaeccd17961e732e4

SHA-1:
5637fa2cd57f15c67af69fe574ca9567eda5d5d7

SHA-256:
821906d975e97374118f2cf74e6333c1ebe3c34e1816c7e3920f7dbd2d85ee4d

Scanner detections:
1 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
4/29/2024 5:24:06 PM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
BACKDOOR.Trojan
9.0.1.0183

File size:
162.9 KB (166,776 bytes)

Product version:
1.00

Original file name:
tfProcess.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\toxicfree\smss.exe

Digital Signature
Signed by:
Tera information Technology co.Ltd

Authority:
thawte, Inc.

Valid from:
12/27/2014 9:00:00 AM

Valid to:
2/26/2016 8:59:59 AM

Subject:
CN=Tera information Technology co.Ltd, O=Tera information Technology co.Ltd, L=Pohang-si, S=Gyeongsangbuk-do, C=KR

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
03A26DC2EB062E6237FCA48CCA93A67A

File PE Metadata
Compilation timestamp:
6/25/2015 10:17:39 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
3072:uX9sV64XpJukrPvV9JKMMbEnknMJeZb54c5rIGEufdL71fQNHQHyLyXBszOe2xp:uk64XpJukrPvV9JKMMbEnknYrufdL7pJ

Entry address:
0x2C58

Entry point:
68, 5C, 34, 40, 00, E8, EE, FF, FF, FF, 00, 00, 00, 00, 00, 00, 30, 00, 00, 00, 38, 00, 00, 00, 00, 00, 00, 00, 52, D2, 05, 75, F8, 86, B5, 4A, A0, 6E, 7A, FF, 53, D5, 61, 21, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 00, 00, 00, 00, 00, 50, 72, 6F, 6A, 65, 63, 74, 00, 00, 00, 00, 00, FF, CC, 31, 00, 05, 46, AA, 10, 6A, 73, CE, 87, 46, 82, CB, 25, EF, AA, 06, FA, 22, 73, 72, 97, D2, 3F, 4E, 98, 4A, A1, 87, C4, 4F, B9, 20, 06, 4A, 3A, 4F, AD, 33, 99, 66, CF, 11, B7, 0C, 00, AA, 00, 60, D3, 93, 00, 00, 00...
 
[+]

Entropy:
5.1826

Developed / compiled with:
Microsoft Visual Basic v5.0/v6.0

Code size:
144 KB (147,456 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
winsxstf

Command:
C:\Program Files\toxicfree\smss.exe


Scan smss.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.