home

baofeng_jf.exe

暴风影音2014安装程序

Beijing Baofeng Technology Co., Ltd.

This is a setup program which is used to install the application. The file has been seen being downloaded from g.pc6.com and multiple other hosts.
Publisher:
北京暴风科技股份有限公司  (signed by Beijing Baofeng Technology Co., Ltd.)

Product:
暴风影音2014安装程序

Version:
5.41.0925.1231

MD5:
05033abd0b0b02d36f8324f04333bdaa

SHA-1:
72f8f612908b5c4df2368f161e4ac9349771f8ea

SHA-256:
b51634ab71d095ed5e9680b453c9d5333c703477f810496f20feb6efcacc5cdf

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
12/27/2024 9:08:15 PM UTC  (today)

Scan engine
Detection
Engine version

NANO AntiVirus
Trojan.Win32.AVKill.cqzonb
0.28.6.63850

File size:
40.1 MB (42,045,312 bytes)

Product version:
5.41.0925.1231

Copyright:
Copyright (C) 2007-2014 北京暴风科技股份有限公司

File type:
Executable application (Win32 EXE)

Language:
Chinese (Simplified, China)

Common path:
C:\users\{user}\downloads\baofeng_jf.exe

Digital Signature
Signed by:
Beijing Baofeng Technology Co., Ltd.

Authority:
VeriSign, Inc.

Valid from:
2/22/2012 12:00:00 AM

Valid to:
2/21/2015 11:59:59 PM

Subject:
CN="Beijing Baofeng Technology Co., Ltd.", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Beijing Baofeng Technology Co., Ltd.", L=Beijing, S=Beijing, C=CN

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
1183EF096F14D7BCF9F0699CEA156B7F

File PE Metadata
Compilation timestamp:
9/25/2014 9:43:49 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
786432:Vcf9zW8+fWRXVUG2OP5nnSq9uEmx4g8BvyrFZP7tD+H/zXtmrUx5J:eTFWKnSq6x78Bmp7tczdmrk

Entry address:
0x9A250

Entry point:
E8, 4C, DA, 00, 00, E9, 89, FE, FF, FF, FF, 35, A4, 60, 4F, 00, FF, 15, 50, B3, 4B, 00, 85, C0, 74, 02, FF, D0, 6A, 19, E8, 94, 1C, 00, 00, 6A, 01, 6A, 00, E8, 66, 18, 00, 00, 83, C4, 0C, E9, 2B, 18, 00, 00, 8B, FF, 55, 8B, EC, 83, EC, 10, 53, 8B, 5D, 08, 56, 85, DB, 74, 11, 83, 7D, 0C, 00, 76, 11, 85, DB, 75, 23, 33, C0, E9, BC, 00, 00, 00, 83, 7D, 0C, 00, 74, EF, E8, 09, 12, 00, 00, 6A, 16, 5E, 89, 30, E8, 71, 38, 00, 00, 8B, C6, E9, A0, 00, 00, 00, FF, 75, 0C, 53, E8, 3C, FD, FF, FF, 59, 59, 3B, 45, 0C...
 
[+]

Entropy:
7.9918  (probably packed)

Code size:
741.5 KB (759,296 bytes)

The file baofeng_jf.exe has been seen being distributed by the following 2 URLs.

https://g.pc6.com/.../Baofeng_jf.exe

http://www.pc6.com/down.asp?id=8069

Scan baofeng_jf.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.