home

cxplauncher-0.9.9.9.4.2-x32-setup.exe

cXPLauncher-x32

CaveXP

This is a setup and installation application. The file has been seen being downloaded from cloclo3.cldmail.ru and multiple other hosts.
Publisher:
CaveXP

Product:
cXPLauncher-x32

Description:
Эта база данных установщика содержит логику и данные, необходимые для установки [|[ProductName].

Version:
0.9.9.42

MD5:
d680dceff4ba639612f9e13b74a1f270

SHA-1:
da667aa3314f570c461fc268204a5317343fe04c

SHA-256:
e748e2c09593973d9398c39fc5df5748e40cdd268aaec9c2b803e7f5ca03a501

Scanner detections:
2 / 68

Status:
Clean  (2 probable false positive detections)

Explanation:
These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:
11/27/2024 12:16:18 AM UTC  (today)

Scan engine
Detection
Engine version

Vba32 AntiVirus
Downloader.Agent
3.12.26.4

Zillya! Antivirus
Trojan.Agent.Win32.491146
2.0.0.2426

File size:
62.8 MB (65,836,797 bytes)

Product version:
0.9.9.42

Copyright:
Copyright (C) 2015 CaveXP

Original file name:
cXPLauncher-x32-setup.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\cxplauncher-0.9.9.9.4.2-x32-setup.exe

File PE Metadata
Compilation timestamp:
6/17/2014 3:05:48 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
1572864:iLtMiB91WT/94ICHHSwFiO+bDJHd+F6TD2f/s+fWI1/W7i50DJBL2:iLtp38F4ICHFiDJHdPyM++Iwi50D2

Entry address:
0xC831C

Entry point:
E8, 41, CC, 00, 00, E9, 79, FE, FF, FF, 8B, FF, 55, 8B, EC, 51, 53, 56, 8B, F0, 33, DB, 3B, F3, 75, 1E, E8, 5D, 4E, 00, 00, 6A, 16, 5E, 53, 53, 53, 53, 53, 89, 30, E8, C5, D5, FF, FF, 83, C4, 14, 8B, C6, E9, C2, 00, 00, 00, 57, 39, 5D, 0C, 77, 1E, E8, 39, 4E, 00, 00, 6A, 16, 5E, 53, 53, 53, 53, 53, 89, 30, E8, A1, D5, FF, FF, 83, C4, 14, 8B, C6, E9, 9D, 00, 00, 00, 33, C0, 39, 5D, 14, 66, 89, 06, 0F, 95, C0, 40, 39, 45, 0C, 77, 09, E8, 0A, 4E, 00, 00, 6A, 22, EB, CF, 8B, 45, 10, 83, C0, FE, 83, F8, 22, 77...
 
[+]

Code size:
1020.5 KB (1,044,992 bytes)

The file cxplauncher-0.9.9.9.4.2-x32-setup.exe has been seen being distributed by the following 5 URLs.

https://cloclo3.cldmail.ru/j8u8nbatmavAS8YzAVe/G/.../H8mHuZuiy?key=b6a1267102d64d830f049d0bc74b72f15683d37e

https://cloclo14.cldmail.ru/2r42BBzgxRkbPCTY8ADB/G/.../H8mHuZuiy?key=3120101d2785dc3216e234a812a7fd074efceac6

https://cloclo26.datacloudmail.ru/weblink/get/.../H8mHuZuiy?key=6e7a874505de79487295f95d5f452110e8bc2939

https://cloclo26.datacloudmail.ru/weblink/get/.../H8mHuZuiy?key=0f9cdeeab95e57889b3bf52d4d0cd51bc6cad172

https://cloclo111.datacloudmail.ru/weblink/get/.../H8mHuZuiy?key=8a359b94dc7ff95e2f58da5483d143a033d3a0c2

Scan cxplauncher-0.9.9.9.4.2-x32-setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.