| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2089-May-03 22:54:57 |
| Detected languages |
English - United States
|
| FileDescription | Background Service |
| FileVersion | 8.1.0.0 |
| InternalName | svc |
| OriginalFilename | svc.exe |
| ProductName | Background Service |
| ProductVersion | 8.1.0.0 |
| Info | Matching compiler(s): | MASM/TASM - sig1(h) |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: | Uses known Mersenne Twister constants |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Suspicious | VirusTotal score: 1/68 (Scanned on 2026-07-20 15:42:33) | Microsoft: Trojan:Win32/Wacatac.B!ml |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf8 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2089-May-03 22:54:57 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x63c00 |
| SizeOfInitializedData | 0xc8e00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000061D40 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x131000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| d3d11.dll |
D3D11CreateDevice
|
|---|---|
| dxgi.dll |
CreateDXGIFactory1
|
| USER32.dll |
GetSystemMetrics
MessageBoxA GetDC TranslateMessage MsgWaitForMultipleObjectsEx ReleaseDC MessageBoxW GetGuiResources UpdateWindow PeekMessageW GetWindowTextLengthW GetMessageW DefWindowProcW AdjustWindowRectEx GetKeyState CallWindowProcW GetWindowRect DestroyWindow SetWindowPos MonitorFromRect SetActiveWindow SetWindowLongPtrW CreateWindowExW ScreenToClient SendMessageW MessageBeep CreatePopupMenu GetWindowLongPtrW RegisterClassExW TrackPopupMenu ShowWindow OpenClipboard GetCapture SetTimer ClientToScreen CloseClipboard EmptyClipboard TrackMouseEvent AdjustWindowRect DestroyMenu SetFocus BringWindowToTop GetClipboardData LoadCursorW SetCapture SetClipboardData SetCursor AppendMenuW KillTimer PostQuitMessage PtInRect DispatchMessageW ReleaseCapture SetForegroundWindow InvalidateRect BeginPaint EndPaint GetWindowTextW MonitorFromWindow IsWindow GetMonitorInfoW GetClientRect |
| GDI32.dll |
CreateCompatibleBitmap
CreateFontW SetTextColor SetBkColor CreateSolidBrush BitBlt SelectObject CreateDIBSection CreateCompatibleDC DeleteDC DeleteObject |
| SHELL32.dll |
CommandLineToArgvW
ShellExecuteW |
| KERNEL32.dll |
GetFileInformationByHandleEx
ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry GetFileAttributesExW UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead MulDiv GlobalUnlock CreateWaitableTimerExW WideCharToMultiByte FreeLibrary GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar WaitForMultipleObjects GetLastError SetLastError ResetEvent SetEvent GetTickCount64 Sleep CreateEventW CancelWaitableTimer WaitForSingleObject CreateWaitableTimerW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA RtlVirtualUnwind SetWaitableTimer GetProcessTimes GetProcessHandleCount WriteFile GetModuleFileNameW GetEnvironmentVariableW CreateFileW GetCurrentThreadId DeleteFileW CloseHandle LoadLibraryW GetProcAddress MoveFileExW ExitProcess GetCurrentProcessId GetModuleHandleW SetUnhandledExceptionFilter FlushFileBuffers GetCommandLineW OutputDebugStringW QueryPerformanceFrequency LocalFree QueryPerformanceCounter GetTickCount GetCurrentProcess SetThreadPriority K32GetProcessMemoryInfo GetCurrentThread QueryProcessCycleTime SetFileInformationByHandle |
| gdiplus.dll |
GdiplusStartup
GdipDrawRectangleI GdipResetClip GdipAddPathArcI GdipCreateFontFamilyFromName GdipSaveGraphics GdipCreateLineBrushI GdipCloneImage GdipDeleteBrush GdipDrawEllipseI GdipAlloc GdipDrawImageRectI GdipDeletePath GdipDisposeImage GdipSetSmoothingMode GdipCreatePath GdipSetStringFormatLineAlign GdipFillPolygon GdipCreateFont GdipSetInterpolationMode GdipCreateSolidFill GdipSetStringFormatTrimming GdipFillPath GdiplusShutdown GdipSetClipRectI GdipClosePathFigure GdipGetGenericFontFamilySansSerif GdipFree GdipDrawLinesI GdipDrawPath GdipDrawString GdipSetTextContrast GdipCreateFromHDC GdipFillEllipseI GdipSetTextRenderingHint GdipRestoreGraphics GdipCloneBrush GdipMeasureString GdipFillRectangleI GdipDeleteGraphics GdipDeleteStringFormat GdipDeleteFont GdipTranslateWorldTransform GdipDeletePen GdipCreateBitmapFromScan0 GdipCreatePen1 GdipSetStringFormatAlign GdipDrawLineI GdipSetStringFormatFlags GdipScaleWorldTransform GdipCreateStringFormat GdipDeleteFontFamily |
| ADVAPI32.dll |
RegCloseKey
RegOpenKeyExW RegQueryValueExW |
| MSVCP140.dll |
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z _Cnd_signal _Cnd_do_broadcast_at_thread_exit _Cnd_wait _Thrd_id _Thrd_join _Cnd_broadcast _Mtx_trylock ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z _Xtime_get_ticks ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?fail@ios_base@std@@QEBA_NXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?eof@ios_base@std@@QEBA_NXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Query_perf_counter _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ |
| VCRUNTIME140_1.dll |
__CxxFrameHandler4
|
| VCRUNTIME140.dll |
__C_specific_handler
__current_exception_context memmove _CxxThrowException memcmp wcsrchr __std_terminate __current_exception memcpy memset __std_exception_copy __std_exception_destroy |
| api-ms-win-crt-stdio-l1-1-0.dll |
fputc
fflush fclose __p__commode setvbuf fgetc ungetc fsetpos _set_fmode fwrite fread _fseeki64 __stdio_common_vswprintf_s __stdio_common_vsnprintf_s _get_stream_buffer_pointers __stdio_common_vsprintf fgetpos |
| api-ms-win-crt-heap-l1-1-0.dll |
free
_set_new_mode _callnewh malloc |
| api-ms-win-crt-runtime-l1-1-0.dll |
_register_thread_local_exe_atexit_callback
_c_exit _exit exit _initterm_e _beginthreadex _initterm _errno _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe terminate _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _invoke_watson abort |
| api-ms-win-crt-convert-l1-1-0.dll |
strtod
wcstod strtol wcstol |
| api-ms-win-crt-filesystem-l1-1-0.dll |
_unlock_file
_lock_file |
| api-ms-win-crt-math-l1-1-0.dll |
exp
_dclass log fmodf sinf lroundf ilogb scalbn __setusermatherr |
| api-ms-win-crt-string-l1-1-0.dll |
towlower
iswspace wcscpy_s iswalpha iswalnum towupper isdigit |
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 8.1.0.0 |
| ProductVersion | 8.1.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| FileDescription | Background Service |
| FileVersion (#2) | 8.1.0.0 |
| InternalName | svc |
| OriginalFilename | svc.exe |
| ProductName | Background Service |
| ProductVersion (#2) | 8.1.0.0 |
| Resource LangID | English - United States |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2089-May-03 22:54:57 |
| Version | 0.0 |
| SizeofData | 928 |
| AddressOfRawData | 0x769f0 |
| PointerToRawData | 0x759f0 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2089-May-03 22:54:57 |
| Version | 0.0 |
| SizeofData | 36 |
| AddressOfRawData | 0x76d90 |
| PointerToRawData | 0x75d90 |
| StartAddressOfRawData | 0x140076de0 |
|---|---|
| EndAddressOfRawData | 0x140078188 |
| AddressOfIndex | 0x140089d40 |
| AddressOfCallbacks | 0x140065c70 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_16BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140082040 |
| GuardCFCheckFunctionPointer | 5369125824 |
| GuardCFDispatchFunctionPointer | 0 |
| GuardCFFunctionTable | 0 |
| GuardCFFunctionCount | 0 |
| GuardFlags | (EMPTY) |
| CodeIntegrity.Flags | 0 |
| CodeIntegrity.Catalog | 0 |
| CodeIntegrity.CatalogOffset | 0 |
| CodeIntegrity.Reserved | 0 |
| GuardAddressTakenIatEntryTable | 0 |
| GuardAddressTakenIatEntryCount | 0 |
| GuardLongJumpTargetTable | 0 |
| GuardLongJumpTargetCount | 0 |
| XOR Key | 0xdde8fb59 |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 16 |
| ASM objects (34918) | 4 |
| C objects (34918) | 10 |
| C++ objects (34918) | 36 |
| Imports (34918) | 6 |
| Imports (33140) | 17 |
| Total imports | 413 |
| C++ objects (LTCG) (35207) | 14 |
| Resource objects (35207) | 1 |
| 151 | 1 |
| Linker (35207) | 1 |
No comments yet.