home

iskysoft video editor(电影视频剪辑器)@5_323112.exe

不乐下载器

Guangxun Yingke (Beijing) Technology Co.,Ltd.

The application iskysoft video editor(电影视频剪辑器)@5_323112.exe by Guangxun Yingke (Beijing) Technology Co.,Ltd has been detected as a potentially unwanted program by 5 anti-malware scanners.
Publisher:
Guangxun Yingke (Beijing) Technology Co.,Ltd.  (signed and verified)

Product:
不乐下载器

Version:
1.0.0.6882

MD5:
ba0f8f02138f9cc50bbb2ef5d57bf569

SHA-1:
cf52d66247a9c54958b895344573321be59d90b2

SHA-256:
a21198464a7ff937992b809b34390e669e7f08c63994e1d6fc92ee64afd6ac33

Scanner detections:
5 / 68

Status:
Potentially unwanted

Analysis date:
1/15/2025 5:24:57 AM UTC  (today)

Scan engine
Detection
Engine version

AegisLab AV Signature
Troj.W32.Gen.m8sf
2.1.4+

Baidu Antivirus
Win32.Adware.kuaiba
4.0.3.16415

Dr.Web
Trojan.DownLoader21.16206
9.0.1.0106

ESET NOD32
Win32/AdWare.Kuaiba (variant)
10.13331

IKARUS anti.virus
PUA.Kuaiba
t3scan.2.0.9.0

File size:
1.5 MB (1,553,600 bytes)

Product version:
1.0.0.6882

Original file name:
Downloader.exe

File type:
Executable application (Win32 EXE)

Language:
Chinese (Simplified, PRC)

Common path:
C:\users\{user}\downloads\iskysoft video editor(电影视频剪辑器)@5_323112.exe

Digital Signature
Signed by:
Guangxun Yingke (Beijing) Technology Co.,Ltd.

Authority:
WoSign CA Limited

Valid from:
10/30/2015 3:52:17 PM

Valid to:
11/30/2016 3:52:17 PM

Subject:
CN="Guangxun Yingke (Beijing) Technology Co.,Ltd.", E=support@gxykbj.com, O="Guangxun Yingke (Beijing) Technology Co.,Ltd.", L=Beijing, S=Beijing, C=CN

Issuer:
CN=WoSign Class 3 Code Signing CA, O=WoSign CA Limited, C=CN

Serial number:
47B09732F9D60FF32CD8FCB34C21EEC9

File PE Metadata
Compilation timestamp:
2/29/2016 6:05:42 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
24576:jjuvHjieqTu0nClWh8wibEoHmnh4oNawKM6/mq7gzhdMD8vuZALKeLKCdcFIY0xZ:HiDd0/3Nan/GdMD8vuZALKeLKCdcvCz

Entry address:
0xB7FF4

Entry point:
E8, 45, DD, 00, 00, E9, 17, FE, FF, FF, 55, 8B, EC, B8, FF, FF, 00, 00, 83, EC, 14, 66, 39, 45, 08, 0F, 84, 97, 00, 00, 00, 53, FF, 75, 0C, 8D, 4D, EC, E8, 00, E4, FF, FF, 8B, 45, EC, 8B, 48, 14, 33, DB, 3B, CB, 75, 14, 8B, 45, 08, 8D, 48, 9F, 66, 83, F9, 19, 77, 03, 83, C0, E0, 0F, B7, C0, EB, 5E, 66, 81, 7D, 08, 00, 01, 73, 29, 8D, 45, EC, 50, 6A, 02, FF, 75, 08, E8, 7D, DD, 00, 00, 83, C4, 0C, 85, C0, 0F, B7, 45, 08, 74, 3D, 8B, 4D, EC, 8B, 89, D0, 00, 00, 00, 66, 0F, B6, 04, 01, EB, CA, FF, 70, 04, 8D...
 
[+]

Entropy:
6.8921

Code size:
996 KB (1,019,904 bytes)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.