home

checkchipversion_v1006.exe

PL2303 checkChip AP

Prolific

This is a setup program which is used to install the application. The file has been seen being downloaded from doc-08-c4-docs.googleusercontent.com and multiple other hosts.
Publisher:
Prolific

Product:
PL2303 checkChip AP

Description:
For Customer test chip version

Version:
1.0.0.6

MD5:
7ca5c3e079fc7ed8d64bf53908ecfe0c

SHA-1:
c8b3337dee449537db3412f458f5753ff82a13cc

SHA-256:
c6a97348ceeb69bf694af5c2b051ae7cefc8f3f7dbef508e8afa23fbdef79722

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/24/2024 1:27:09 PM UTC  (today)

File size:
208 KB (212,992 bytes)

Product version:
1.0.0.6

Copyright:
Prolific Technology Inc. All rights reserved.

Original file name:
PL2303 checkChipVersion.exe

File type:
Executable application (Win32 EXE)

Language:
Taiwanese

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\checkchipversion_v1006.exe

File PE Metadata
Compilation timestamp:
1/15/2013 10:20:49 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
3072:fzzHguJi+86Su6SXy7j33mFq/KoTbXQXgYj1ZlXbwr736X2bsVotLA8MD1wTaN:HAIi+86L6SXo3BtTbgVjvhBXks78Ml

Entry address:
0xF613

Entry point:
E8, 95, 45, 00, 00, E9, 17, FE, FF, FF, 3B, 0D, A8, CD, 42, 00, 75, 02, F3, C3, E9, 15, 46, 00, 00, 51, C7, 01, 3C, 50, 42, 00, E8, 0D, 47, 00, 00, 59, C3, 56, 8B, F1, E8, EA, FF, FF, FF, F6, 44, 24, 08, 01, 74, 07, 56, E8, 5A, 29, FF, FF, 59, 8B, C6, 5E, C2, 04, 00, 8B, 44, 24, 04, 83, C1, 09, 51, 83, C0, 09, 50, E8, 59, 47, 00, 00, F7, D8, 59, 1B, C0, 59, 40, C2, 04, 00, 51, 53, 55, 56, 57, FF, 35, 28, 1E, 43, 00, E8, 9E, 3F, 00, 00, FF, 35, 24, 1E, 43, 00, 8B, F0, 89, 74, 24, 18, E8, 8D, 3F, 00, 00, 8B...
 
[+]

Code size:
136 KB (139,264 bytes)

The file checkchipversion_v1006.exe has been seen being distributed by the following 4 URLs.

https://doc-08-c4-docs.googleusercontent.com/docs/securesc/8tm4bjhoq6kb470ipglk440j1ko9mph1/m1itrd5fjl883clskktvpea49hmcspab/1467698400000/.../14823838947269063938/0B2Aw0vqOvastM0ZDWDRQZ3dVdGc?e=download

http://rs232.malditonerd.com/checkChipVersion.exe

http://www.doorway.co.uk/prolific_checkchipversion_v1006.exe

https://drive.google.com/a/.../uc?id=0B8HHXEMrS_b2WElORnpRQ0dDRTg&export=download

Scan checkchipversion_v1006.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.