home

WPService.exe

WebProtect

China Merchants Bank

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘CMB webProtect’.
Publisher:
China Merchants Bank  (signed and verified)

Product:
WebProtect

Version:
1, 0, 0, 1

MD5:
68cbe4a287b7d67580b6d9968f5336a3

SHA-1:
b6bde9b30508da697a3b9870ff560c8162cb3a02

SHA-256:
40ffea680c9ac3464d60b7370c9318ef450a00ab5a6aa01bee052b4ca214b0af

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/25/2024 2:55:04 AM UTC  (today)

File size:
227.4 KB (232,848 bytes)

Product version:
1, 0, 0, 1

Copyright:
Copyright © 2007 China Merchants Bank, all rights reserved

Original file name:
WPService.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\cmbchina\webprotect\wpservice.exe

Digital Signature
Signed by:
China Merchants Bank

Authority:
VeriSign, Inc.

Valid from:
5/30/2007 8:00:00 AM

Valid to:
5/30/2008 7:59:59 AM

Subject:
CN=China Merchants Bank, OU=Head Office, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=China Merchants Bank, L=Shenzhen, S=Guangdong, C=CN

Issuer:
CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa (c)04, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
4AD0B3527050AC414F06C500F44608F7

File PE Metadata
Compilation timestamp:
8/27/2007 4:12:08 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
6144:W1hEn+7iRdg33QjjbT4maoy6ozJWTBWaf:san+eRdeSjaozolWTd

Entry address:
0x14D3B

Entry point:
E8, 76, 85, 00, 00, E9, 17, FE, FF, FF, 55, 8B, EC, 83, EC, 10, FF, 75, 0C, 8D, 4D, F0, E8, 90, F9, FF, FF, 8B, 45, F0, 83, B8, AC, 00, 00, 00, 01, 7E, 13, 8D, 45, F0, 50, 6A, 04, FF, 75, 08, E8, DA, 85, 00, 00, 83, C4, 0C, EB, 10, 8B, 80, C8, 00, 00, 00, 8B, 4D, 08, 0F, B6, 04, 48, 83, E0, 04, 80, 7D, FC, 00, 74, 07, 8B, 4D, F8, 83, 61, 70, FD, C9, C3, 83, 3D, 2C, 8C, 43, 00, 00, 75, 12, 8B, 44, 24, 04, 8B, 0D, 68, 74, 43, 00, 0F, B6, 04, 41, 83, E0, 04, C3, 6A, 00, FF, 74, 24, 08, E8, 8B, FF, FF, FF, 59...
 
[+]

Entropy:
6.6298

Code size:
170 KB (174,080 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
CMB webProtect

Command:
C:\Program Files\cmbchina\webprotect\wpservice.exe \alone


Scan WPService.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.