Report - twapcdhuj20shds2WOP90sdhy.exe

Process Kill Generic Malware Suspicious_Script_Bin Malicious Library FindFirstVolume CryptGenKey UPX Device_File_Check PE32 PE File OS Processor Check
ScreenShot
Created 2024.06.12 07:33 Machine s1_win7_x6401
Filename twapcdhuj20shds2WOP90sdhy.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
5
Behavior Score
5.0
ZERO API file : mailcious
VT API (file) 27 detected (AIDetectMalware, AutoIt, malicious, high confidence, TrojanAitInject, Unsafe, V52e, Artemis, Strab, Outbreak, Detected, AgentTesla, DorkBot, Eldorado, NetWiredRC, susgen, confidence)
md5 49771fd313935046468ff48e9a97f287
sha256 e8e6da55699185b283b2b263a21db9a0a457a4b623ff668fdedbe7fcdb2d91d0
ssdeep 24576:nAHnh+eWsN3skA4RV1Hom2KXMmHapYTn90rF9t5:ah+ZkldoPK8Yapw90rH
imphash afcdf79be1557326c854b6e20cb900a7
impfuzzy 192:XBEtaJYnRmkI3OOaHbK1WA8UcS6cnwVDvhlONVVfD:XBSamnRmkIT+6DjnwVjhlOJD
  Network IP location

Signature (12cnts)

Level Description
warning File has been identified by 27 AntiVirus engines on VirusTotal as malicious
watch Harvests credentials from local email clients
watch Harvests credentials from local FTP client softwares
watch Used NtSetContextThread to modify a thread in a remote process indicative of process injection
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Steals private information from local Internet browsers
notice The binary likely contains encrypted or compressed data indicative of a packer
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info One or more processes crashed
info Queries for the computername

Rules (11cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (upload)
warning Process_Snapshot_Kill_Zero Process Kill Zero binaries (upload)
warning Suspicious_Obfuscation_Script_2 Suspicious obfuscation script (e.g. executable files) binaries (download)
watch CryptGenKey_Zero CryptGenKey Zero binaries (upload)
watch FindFirstVolume_Zero FindFirstVolume Zero binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info Device_Check_Zero Device Check Zero binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

WSOCK32.dll
 0x48f7c8 WSACleanup
 0x48f7cc socket
 0x48f7d0 inet_ntoa
 0x48f7d4 setsockopt
 0x48f7d8 ntohs
 0x48f7dc recvfrom
 0x48f7e0 ioctlsocket
 0x48f7e4 htons
 0x48f7e8 WSAStartup
 0x48f7ec __WSAFDIsSet
 0x48f7f0 select
 0x48f7f4 accept
 0x48f7f8 listen
 0x48f7fc ind
 0x48f800 closesocket
 0x48f804 WSAGetLastError
 0x48f808 recv
 0x48f80c sendto
 0x48f810 send
 0x48f814 inet_addr
 0x48f818 gethostbyname
 0x48f81c gethostname
 0x48f820 connect
VERSION.dll
 0x48f76c GetFileVersionInfoW
 0x48f770 GetFileVersionInfoSizeW
 0x48f774 VerQueryValueW
WINMM.dll
 0x48f7b8 timeGetTime
 0x48f7bc waveOutSetVolume
 0x48f7c0 mciSendStringW
COMCTL32.dll
 0x48f088 ImageList_ReplaceIcon
 0x48f08c ImageList_Destroy
 0x48f090 ImageList_Remove
 0x48f094 ImageList_SetDragCursorImage
 0x48f098 ImageList_BeginDrag
 0x48f09c ImageList_DragEnter
 0x48f0a0 ImageList_DragLeave
 0x48f0a4 ImageList_EndDrag
 0x48f0a8 ImageList_DragMove
 0x48f0ac InitCommonControlsEx
 0x48f0b0 ImageList_Create
MPR.dll
 0x48f3f8 WNetUseConnectionW
 0x48f3fc WNetCancelConnection2W
 0x48f400 WNetGetConnectionW
 0x48f404 WNetAddConnection2W
WININET.dll
 0x48f77c InternetQueryDataAvailable
 0x48f780 InternetCloseHandle
 0x48f784 InternetOpenW
 0x48f788 InternetSetOptionW
 0x48f78c InternetCrackUrlW
 0x48f790 HttpQueryInfoW
 0x48f794 InternetQueryOptionW
 0x48f798 HttpOpenRequestW
 0x48f79c HttpSendRequestW
 0x48f7a0 FtpOpenFileW
 0x48f7a4 FtpGetFileSize
 0x48f7a8 InternetOpenUrlW
 0x48f7ac InternetReadFile
 0x48f7b0 InternetConnectW
PSAPI.DLL
 0x48f484 GetProcessMemoryInfo
IPHLPAPI.DLL
 0x48f154 IcmpCreateFile
 0x48f158 IcmpCloseHandle
 0x48f15c IcmpSendEcho
USERENV.dll
 0x48f750 DestroyEnvironmentBlock
 0x48f754 UnloadUserProfile
 0x48f758 CreateEnvironmentBlock
 0x48f75c LoadUserProfileW
UxTheme.dll
 0x48f764 IsThemeActive
KERNEL32.dll
 0x48f164 DuplicateHandle
 0x48f168 CreateThread
 0x48f16c WaitForSingleObject
 0x48f170 HeapAlloc
 0x48f174 GetProcessHeap
 0x48f178 HeapFree
 0x48f17c Sleep
 0x48f180 GetCurrentThreadId
 0x48f184 MultiByteToWideChar
 0x48f188 MulDiv
 0x48f18c GetVersionExW
 0x48f190 IsWow64Process
 0x48f194 GetSystemInfo
 0x48f198 FreeLibrary
 0x48f19c LoadLibraryA
 0x48f1a0 GetProcAddress
 0x48f1a4 SetErrorMode
 0x48f1a8 GetModuleFileNameW
 0x48f1ac WideCharToMultiByte
 0x48f1b0 lstrcpyW
 0x48f1b4 lstrlenW
 0x48f1b8 GetModuleHandleW
 0x48f1bc QueryPerformanceCounter
 0x48f1c0 VirtualFreeEx
 0x48f1c4 OpenProcess
 0x48f1c8 VirtualAllocEx
 0x48f1cc WriteProcessMemory
 0x48f1d0 ReadProcessMemory
 0x48f1d4 CreateFileW
 0x48f1d8 SetFilePointerEx
 0x48f1dc SetEndOfFile
 0x48f1e0 ReadFile
 0x48f1e4 WriteFile
 0x48f1e8 FlushFileBuffers
 0x48f1ec TerminateProcess
 0x48f1f0 CreateToolhelp32Snapshot
 0x48f1f4 Process32FirstW
 0x48f1f8 Process32NextW
 0x48f1fc SetFileTime
 0x48f200 GetFileAttributesW
 0x48f204 FindFirstFileW
 0x48f208 SetCurrentDirectoryW
 0x48f20c GetLongPathNameW
 0x48f210 GetShortPathNameW
 0x48f214 DeleteFileW
 0x48f218 FindNextFileW
 0x48f21c CopyFileExW
 0x48f220 MoveFileW
 0x48f224 CreateDirectoryW
 0x48f228 RemoveDirectoryW
 0x48f22c SetSystemPowerState
 0x48f230 QueryPerformanceFrequency
 0x48f234 FindResourceW
 0x48f238 LoadResource
 0x48f23c LockResource
 0x48f240 SizeofResource
 0x48f244 EnumResourceNamesW
 0x48f248 OutputDebugStringW
 0x48f24c GetTempPathW
 0x48f250 GetTempFileNameW
 0x48f254 DeviceIoControl
 0x48f258 GetLocalTime
 0x48f25c CompareStringW
 0x48f260 GetCurrentProcess
 0x48f264 EnterCriticalSection
 0x48f268 LeaveCriticalSection
 0x48f26c GetStdHandle
 0x48f270 CreatePipe
 0x48f274 InterlockedExchange
 0x48f278 TerminateThread
 0x48f27c LoadLibraryExW
 0x48f280 FindResourceExW
 0x48f284 CopyFileW
 0x48f288 VirtualFree
 0x48f28c FormatMessageW
 0x48f290 GetExitCodeProcess
 0x48f294 GetPrivateProfileStringW
 0x48f298 WritePrivateProfileStringW
 0x48f29c GetPrivateProfileSectionW
 0x48f2a0 WritePrivateProfileSectionW
 0x48f2a4 GetPrivateProfileSectionNamesW
 0x48f2a8 FileTimeToLocalFileTime
 0x48f2ac FileTimeToSystemTime
 0x48f2b0 SystemTimeToFileTime
 0x48f2b4 LocalFileTimeToFileTime
 0x48f2b8 GetDriveTypeW
 0x48f2bc GetDiskFreeSpaceExW
 0x48f2c0 GetDiskFreeSpaceW
 0x48f2c4 GetVolumeInformationW
 0x48f2c8 SetVolumeLabelW
 0x48f2cc CreateHardLinkW
 0x48f2d0 SetFileAttributesW
 0x48f2d4 CreateEventW
 0x48f2d8 SetEvent
 0x48f2dc GetEnvironmentVariableW
 0x48f2e0 SetEnvironmentVariableW
 0x48f2e4 GlobalLock
 0x48f2e8 GlobalUnlock
 0x48f2ec GlobalAlloc
 0x48f2f0 GetFileSize
 0x48f2f4 GlobalFree
 0x48f2f8 GlobalMemoryStatusEx
 0x48f2fc Beep
 0x48f300 GetSystemDirectoryW
 0x48f304 HeapReAlloc
 0x48f308 HeapSize
 0x48f30c GetComputerNameW
 0x48f310 GetWindowsDirectoryW
 0x48f314 GetCurrentProcessId
 0x48f318 GetProcessIoCounters
 0x48f31c CreateProcessW
 0x48f320 GetProcessId
 0x48f324 SetPriorityClass
 0x48f328 LoadLibraryW
 0x48f32c VirtualAlloc
 0x48f330 IsDebuggerPresent
 0x48f334 GetCurrentDirectoryW
 0x48f338 lstrcmpiW
 0x48f33c DecodePointer
 0x48f340 GetLastError
 0x48f344 RaiseException
 0x48f348 InitializeCriticalSectionAndSpinCount
 0x48f34c DeleteCriticalSection
 0x48f350 InterlockedDecrement
 0x48f354 InterlockedIncrement
 0x48f358 GetCurrentThread
 0x48f35c CloseHandle
 0x48f360 GetFullPathNameW
 0x48f364 EncodePointer
 0x48f368 ExitProcess
 0x48f36c GetModuleHandleExW
 0x48f370 ExitThread
 0x48f374 GetSystemTimeAsFileTime
 0x48f378 ResumeThread
 0x48f37c GetCommandLineW
 0x48f380 IsProcessorFeaturePresent
 0x48f384 IsValidCodePage
 0x48f388 GetACP
 0x48f38c GetOEMCP
 0x48f390 GetCPInfo
 0x48f394 SetLastError
 0x48f398 UnhandledExceptionFilter
 0x48f39c SetUnhandledExceptionFilter
 0x48f3a0 TlsAlloc
 0x48f3a4 TlsGetValue
 0x48f3a8 TlsSetValue
 0x48f3ac TlsFree
 0x48f3b0 GetStartupInfoW
 0x48f3b4 GetStringTypeW
 0x48f3b8 SetStdHandle
 0x48f3bc GetFileType
 0x48f3c0 GetConsoleCP
 0x48f3c4 GetConsoleMode
 0x48f3c8 RtlUnwind
 0x48f3cc ReadConsoleW
 0x48f3d0 GetTimeZoneInformation
 0x48f3d4 GetDateFormatW
 0x48f3d8 GetTimeFormatW
 0x48f3dc LCMapStringW
 0x48f3e0 GetEnvironmentStringsW
 0x48f3e4 FreeEnvironmentStringsW
 0x48f3e8 WriteConsoleW
 0x48f3ec FindClose
 0x48f3f0 SetEnvironmentVariableA
USER32.dll
 0x48f4cc AdjustWindowRectEx
 0x48f4d0 CopyImage
 0x48f4d4 SetWindowPos
 0x48f4d8 GetCursorInfo
 0x48f4dc RegisterHotKey
 0x48f4e0 ClientToScreen
 0x48f4e4 GetKeyboardLayoutNameW
 0x48f4e8 IsCharAlphaW
 0x48f4ec IsCharAlphaNumericW
 0x48f4f0 IsCharLowerW
 0x48f4f4 IsCharUpperW
 0x48f4f8 GetMenuStringW
 0x48f4fc GetSubMenu
 0x48f500 GetCaretPos
 0x48f504 IsZoomed
 0x48f508 MonitorFromPoint
 0x48f50c GetMonitorInfoW
 0x48f510 SetWindowLongW
 0x48f514 SetLayeredWindowAttributes
 0x48f518 FlashWindow
 0x48f51c GetClassLongW
 0x48f520 TranslateAcceleratorW
 0x48f524 IsDialogMessageW
 0x48f528 GetSysColor
 0x48f52c InflateRect
 0x48f530 DrawFocusRect
 0x48f534 DrawTextW
 0x48f538 FrameRect
 0x48f53c DrawFrameControl
 0x48f540 FillRect
 0x48f544 PtInRect
 0x48f548 DestroyAcceleratorTable
 0x48f54c CreateAcceleratorTableW
 0x48f550 SetCursor
 0x48f554 GetWindowDC
 0x48f558 GetSystemMetrics
 0x48f55c GetActiveWindow
 0x48f560 CharNextW
 0x48f564 wsprintfW
 0x48f568 RedrawWindow
 0x48f56c DrawMenuBar
 0x48f570 DestroyMenu
 0x48f574 SetMenu
 0x48f578 GetWindowTextLengthW
 0x48f57c CreateMenu
 0x48f580 IsDlgButtonChecked
 0x48f584 DefDlgProcW
 0x48f588 CallWindowProcW
 0x48f58c ReleaseCapture
 0x48f590 SetCapture
 0x48f594 CreateIconFromResourceEx
 0x48f598 mouse_event
 0x48f59c ExitWindowsEx
 0x48f5a0 SetActiveWindow
 0x48f5a4 FindWindowExW
 0x48f5a8 EnumThreadWindows
 0x48f5ac SetMenuDefaultItem
 0x48f5b0 InsertMenuItemW
 0x48f5b4 IsMenu
 0x48f5b8 TrackPopupMenuEx
 0x48f5bc GetCursorPos
 0x48f5c0 DeleteMenu
 0x48f5c4 SetRect
 0x48f5c8 GetMenuItemID
 0x48f5cc GetMenuItemCount
 0x48f5d0 SetMenuItemInfoW
 0x48f5d4 GetMenuItemInfoW
 0x48f5d8 SetForegroundWindow
 0x48f5dc IsIconic
 0x48f5e0 FindWindowW
 0x48f5e4 MonitorFromRect
 0x48f5e8 keybd_event
 0x48f5ec SendInput
 0x48f5f0 GetAsyncKeyState
 0x48f5f4 SetKeyboardState
 0x48f5f8 GetKeyboardState
 0x48f5fc GetKeyState
 0x48f600 VkKeyScanW
 0x48f604 LoadStringW
 0x48f608 DialogBoxParamW
 0x48f60c MessageBeep
 0x48f610 EndDialog
 0x48f614 SendDlgItemMessageW
 0x48f618 GetDlgItem
 0x48f61c SetWindowTextW
 0x48f620 CopyRect
 0x48f624 ReleaseDC
 0x48f628 GetDC
 0x48f62c EndPaint
 0x48f630 BeginPaint
 0x48f634 GetClientRect
 0x48f638 GetMenu
 0x48f63c DestroyWindow
 0x48f640 EnumWindows
 0x48f644 GetDesktopWindow
 0x48f648 IsWindow
 0x48f64c IsWindowEnabled
 0x48f650 IsWindowVisible
 0x48f654 EnableWindow
 0x48f658 InvalidateRect
 0x48f65c GetWindowLongW
 0x48f660 GetWindowThreadProcessId
 0x48f664 AttachThreadInput
 0x48f668 GetFocus
 0x48f66c GetWindowTextW
 0x48f670 ScreenToClient
 0x48f674 SendMessageTimeoutW
 0x48f678 EnumChildWindows
 0x48f67c CharUpperBuffW
 0x48f680 GetParent
 0x48f684 GetDlgCtrlID
 0x48f688 SendMessageW
 0x48f68c MapVirtualKeyW
 0x48f690 PostMessageW
 0x48f694 GetWindowRect
 0x48f698 SetUserObjectSecurity
 0x48f69c CloseDesktop
 0x48f6a0 CloseWindowStation
 0x48f6a4 OpenDesktopW
 0x48f6a8 SetProcessWindowStation
 0x48f6ac GetProcessWindowStation
 0x48f6b0 OpenWindowStationW
 0x48f6b4 GetUserObjectSecurity
 0x48f6b8 MessageBoxW
 0x48f6bc DefWindowProcW
 0x48f6c0 SetClipboardData
 0x48f6c4 EmptyClipboard
 0x48f6c8 CountClipboardFormats
 0x48f6cc CloseClipboard
 0x48f6d0 GetClipboardData
 0x48f6d4 IsClipboardFormatAvailable
 0x48f6d8 OpenClipboard
 0x48f6dc BlockInput
 0x48f6e0 GetMessageW
 0x48f6e4 LockWindowUpdate
 0x48f6e8 DispatchMessageW
 0x48f6ec TranslateMessage
 0x48f6f0 PeekMessageW
 0x48f6f4 UnregisterHotKey
 0x48f6f8 CheckMenuRadioItem
 0x48f6fc CharLowerBuffW
 0x48f700 MoveWindow
 0x48f704 SetFocus
 0x48f708 PostQuitMessage
 0x48f70c KillTimer
 0x48f710 CreatePopupMenu
 0x48f714 RegisterWindowMessageW
 0x48f718 SetTimer
 0x48f71c ShowWindow
 0x48f720 CreateWindowExW
 0x48f724 RegisterClassExW
 0x48f728 LoadIconW
 0x48f72c LoadCursorW
 0x48f730 GetSysColorBrush
 0x48f734 GetForegroundWindow
 0x48f738 MessageBoxA
 0x48f73c DestroyIcon
 0x48f740 SystemParametersInfoW
 0x48f744 LoadImageW
 0x48f748 GetClassNameW
GDI32.dll
 0x48f0c4 StrokePath
 0x48f0c8 DeleteObject
 0x48f0cc GetTextExtentPoint32W
 0x48f0d0 ExtCreatePen
 0x48f0d4 GetDeviceCaps
 0x48f0d8 EndPath
 0x48f0dc SetPixel
 0x48f0e0 CloseFigure
 0x48f0e4 CreateCompatibleBitmap
 0x48f0e8 CreateCompatibleDC
 0x48f0ec SelectObject
 0x48f0f0 StretchBlt
 0x48f0f4 GetDIBits
 0x48f0f8 LineTo
 0x48f0fc AngleArc
 0x48f100 MoveToEx
 0x48f104 Ellipse
 0x48f108 DeleteDC
 0x48f10c GetPixel
 0x48f110 CreateDCW
 0x48f114 GetStockObject
 0x48f118 GetTextFaceW
 0x48f11c CreateFontW
 0x48f120 SetTextColor
 0x48f124 PolyDraw
 0x48f128 BeginPath
 0x48f12c Rectangle
 0x48f130 SetViewportOrgEx
 0x48f134 GetObjectW
 0x48f138 SetBkMode
 0x48f13c RoundRect
 0x48f140 SetBkColor
 0x48f144 CreatePen
 0x48f148 CreateSolidBrush
 0x48f14c StrokeAndFillPath
COMDLG32.dll
 0x48f0b8 GetOpenFileNameW
 0x48f0bc GetSaveFileNameW
ADVAPI32.dll
 0x48f000 GetAce
 0x48f004 RegEnumValueW
 0x48f008 RegDeleteValueW
 0x48f00c RegDeleteKeyW
 0x48f010 RegEnumKeyExW
 0x48f014 RegSetValueExW
 0x48f018 RegOpenKeyExW
 0x48f01c RegCloseKey
 0x48f020 RegQueryValueExW
 0x48f024 RegConnectRegistryW
 0x48f028 InitializeSecurityDescriptor
 0x48f02c InitializeAcl
 0x48f030 AdjustTokenPrivileges
 0x48f034 OpenThreadToken
 0x48f038 OpenProcessToken
 0x48f03c LookupPrivilegeValueW
 0x48f040 DuplicateTokenEx
 0x48f044 CreateProcessAsUserW
 0x48f048 CreateProcessWithLogonW
 0x48f04c GetLengthSid
 0x48f050 CopySid
 0x48f054 LogonUserW
 0x48f058 AllocateAndInitializeSid
 0x48f05c CheckTokenMembership
 0x48f060 RegCreateKeyExW
 0x48f064 FreeSid
 0x48f068 GetTokenInformation
 0x48f06c GetSecurityDescriptorDacl
 0x48f070 GetAclInformation
 0x48f074 AddAce
 0x48f078 SetSecurityDescriptorDacl
 0x48f07c GetUserNameW
 0x48f080 InitiateSystemShutdownExW
SHELL32.dll
 0x48f48c DragQueryPoint
 0x48f490 ShellExecuteExW
 0x48f494 DragQueryFileW
 0x48f498 SHEmptyRecycleBinW
 0x48f49c SHGetPathFromIDListW
 0x48f4a0 SHBrowseForFolderW
 0x48f4a4 SHCreateShellItem
 0x48f4a8 SHGetDesktopFolder
 0x48f4ac SHGetSpecialFolderLocation
 0x48f4b0 SHGetFolderPathW
 0x48f4b4 SHFileOperationW
 0x48f4b8 ExtractIconExW
 0x48f4bc Shell_NotifyIconW
 0x48f4c0 ShellExecuteW
 0x48f4c4 DragFinish
ole32.dll
 0x48f828 CoTaskMemAlloc
 0x48f82c CoTaskMemFree
 0x48f830 CLSIDFromString
 0x48f834 ProgIDFromCLSID
 0x48f838 CLSIDFromProgID
 0x48f83c OleSetMenuDescriptor
 0x48f840 MkParseDisplayName
 0x48f844 OleSetContainedObject
 0x48f848 CoCreateInstance
 0x48f84c IIDFromString
 0x48f850 StringFromGUID2
 0x48f854 CreateStreamOnHGlobal
 0x48f858 OleInitialize
 0x48f85c OleUninitialize
 0x48f860 CoInitialize
 0x48f864 CoUninitialize
 0x48f868 GetRunningObjectTable
 0x48f86c CoGetInstanceFromFile
 0x48f870 CoGetObject
 0x48f874 CoSetProxyBlanket
 0x48f878 CoCreateInstanceEx
 0x48f87c CoInitializeSecurity
OLEAUT32.dll
 0x48f40c LoadTypeLibEx
 0x48f410 VariantCopyInd
 0x48f414 SysReAllocString
 0x48f418 SysFreeString
 0x48f41c SafeArrayDestroyDescriptor
 0x48f420 SafeArrayDestroyData
 0x48f424 SafeArrayUnaccessData
 0x48f428 SafeArrayAccessData
 0x48f42c SafeArrayAllocData
 0x48f430 SafeArrayAllocDescriptorEx
 0x48f434 SafeArrayCreateVector
 0x48f438 RegisterTypeLib
 0x48f43c CreateStdDispatch
 0x48f440 DispCallFunc
 0x48f444 VariantChangeType
 0x48f448 SysStringLen
 0x48f44c VariantTimeToSystemTime
 0x48f450 VarR8FromDec
 0x48f454 SafeArrayGetVartype
 0x48f458 VariantCopy
 0x48f45c VariantClear
 0x48f460 OleLoadPicture
 0x48f464 QueryPathOfRegTypeLib
 0x48f468 RegisterTypeLibForUser
 0x48f46c UnRegisterTypeLibForUser
 0x48f470 UnRegisterTypeLib
 0x48f474 CreateDispTypeInfo
 0x48f478 SysAllocString
 0x48f47c VariantInit

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure