home

chrlike.exe

Sice Xing

The application chrlike.exe by Sice Xing has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat.
Publisher:
Sice Xing  (signed and verified)

MD5:
17c10cb47e4103e92d189cf218d72236

SHA-1:
5753e20c8188fb3c64c112266a0e4f253d9bdf14

SHA-256:
dbfadf37796a57de2fec26cb3cdefd83aee1d8d6dec1cdb97b2c9066cea4ecbb

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/16/2024 2:36:36 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Elex (M)
16.11.6.4

File size:
477.4 KB (488,832 bytes)

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\tools\chrlike.exe

Digital Signature
Signed by:
Sice Xing

Authority:
thawte, Inc.

Valid from:
6/27/2016 3:00:00 AM

Valid to:
4/2/2017 2:59:59 AM

Subject:
CN=Sice Xing, OU=Individual Developer, O=No Organization Affiliation, L=Beijing, S=Beijing, C=CN

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
1ED032BEEC009922FC8C2EE527491299

File PE Metadata
Compilation timestamp:
6/28/2016 4:23:25 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
14.0

CTPH (ssdeep):
6144:3LIFKxNeKVxbXOUaQUlS+6IuYIRB8ZcPx6VHUjpUIf/4oTCjqnln2nB:3Lcw5eULUl8YW8j01UU5THsnB

Entry address:
0x37DE8

Entry point:
8E, 1A, 72, 00, 00, BD, D1, A7, 99, AB, 85, 57, F8, C7, 14, 00, ED, 19, 8E, 16, D5, 59, 00, 00, 00, 00, 23, 2D, 03, 0A, 0A, D2, 83, 09, 2B, 80, 9F, DF, 1C, A9, 55, 99, 88, 9A, 01, AC, AE, A6, 94, BD, A0, 8D, A3, AB, DA, 14, 8A, 67, B7, 80, B4, 18, A9, A6, 99, A6, 93, BB, A3, AB, AE, 09, 02, AB, 4F, 00, 00, 00, 00, D4, 22, 70, 76, 59, 38, 70, 5D, 0A, 30, 03, F3, 5A, D7, BC, F0, E5, 77, 13, 00, 41, 99, 04, AE, 2C, 9A, 93, 3F, 8E, A3, AB, AE, A6, EB, 11, 8E, 16, FF, 00, 00, 00, 00, A6, B9, 22, 38, AB, 64, 00...
 
[+]

Entropy:
6.9776

Code size:
351.5 KB (359,936 bytes)

Remove chrlike.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.