home

cxplauncher-0.9.9.9.4.2-x64-setup.exe

cXPLauncher-x64

CaveXP

This is a setup and installation application. The file has been seen being downloaded from cloclo22.cldmail.ru and multiple other hosts.
Publisher:
CaveXP

Product:
cXPLauncher-x64

Description:
Эта база данных установщика содержит логику и данные, необходимые для установки [|[ProductName].

Version:
0.9.9.42

MD5:
cf1b2d0af3775c8bedf8a50ccdfda59b

SHA-1:
63314a8d18877ebaf6c2f4cdf5b6f6ae0773beae

SHA-256:
279c860073c9edc35003b7d889b1ff12926b70354a1e6d545aa59dc538f30d66

Scanner detections:
2 / 68

Status:
Clean  (2 probable false positive detections)

Explanation:
These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:
12/26/2024 2:39:41 PM UTC  (today)

Scan engine
Detection
Engine version

Vba32 AntiVirus
Downloader.Agent
3.12.26.4

Zillya! Antivirus
Trojan.Agent.Win32.491146
2.0.0.2425

File size:
72.9 MB (76,451,954 bytes)

Product version:
0.9.9.42

Copyright:
Copyright (C) 2015 CaveXP

Original file name:
cXPLauncher-x64-setup.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\cxplauncher-0.9.9.9.4.2-x64-setup.exe

File PE Metadata
Compilation timestamp:
6/17/2014 5:05:48 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
1572864:bNwdh2QXb3yv0mw8sp4hNoaWTDFI8G1KKPKZYwcUQjJBLc:bNwnVXNmwFKoe7TPKqwcUyc

Entry address:
0xC831C

Entry point:
E8, 41, CC, 00, 00, E9, 79, FE, FF, FF, 8B, FF, 55, 8B, EC, 51, 53, 56, 8B, F0, 33, DB, 3B, F3, 75, 1E, E8, 5D, 4E, 00, 00, 6A, 16, 5E, 53, 53, 53, 53, 53, 89, 30, E8, C5, D5, FF, FF, 83, C4, 14, 8B, C6, E9, C2, 00, 00, 00, 57, 39, 5D, 0C, 77, 1E, E8, 39, 4E, 00, 00, 6A, 16, 5E, 53, 53, 53, 53, 53, 89, 30, E8, A1, D5, FF, FF, 83, C4, 14, 8B, C6, E9, 9D, 00, 00, 00, 33, C0, 39, 5D, 14, 66, 89, 06, 0F, 95, C0, 40, 39, 45, 0C, 77, 09, E8, 0A, 4E, 00, 00, 6A, 22, EB, CF, 8B, 45, 10, 83, C0, FE, 83, F8, 22, 77...
 
[+]

Code size:
1020.5 KB (1,044,992 bytes)

The file cxplauncher-0.9.9.9.4.2-x64-setup.exe has been seen being distributed by the following 5 URLs.

https://cloclo22.cldmail.ru/dB41RxUohDSL5igdUbV/G/.../TUPtdwWRT?key=cd062845348ce6df09fe99a393d7f4189b814080

https://cloclo10.datacloudmail.ru/weblink/get/.../TUPtdwWRT?key=2c1e14baf046ec075155095e584d3fe4a6d400ba

https://cloclo18.cldmail.ru/2ocYtDiv5tHDTkRa3NXf/G/.../TUPtdwWRT?key=05cc1d940c3bc678ece8f82cd842ca019df9cae8

https://cloclo28.cldmail.ru/2ew5JkPueJ74invbL9DE/G/.../TUPtdwWRT?key=e0ed1e73b4cc7dd34ccf53ff25c18a6c42c05947

https://cloclo11.datacloudmail.ru/weblink/get/.../TUPtdwWRT?key=bfed175199857a227bee4b02cd0ca8ca40aec639

Scan cxplauncher-0.9.9.9.4.2-x64-setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.