home

kavsetups_66_131263.exe

Kingsoft Internet Security

Beijing Kingsoft Security software Co.,Ltd

This is a setup program which is used to install the application. The file has been seen being downloaded from dl.union.ijinshan.com and multiple other hosts.
Publisher:
Kingsoft Corporation  (signed by Beijing Kingsoft Security software Co.,Ltd)

Product:
Kingsoft Internet Security

Description:
新毒霸安装程序

Version:
2013,08,29,6718

MD5:
f9cc47847f4316da5401ace1155d7b21

SHA-1:
466213f5a73b829408850bf09f389e96c67d408f

SHA-256:
cd882aa1af846415aab373324fa454a1a3fa8b68a7d3515af5ce78ed8bc29d33

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/24/2024 12:52:05 AM UTC  (today)

File size:
21.8 MB (22,899,256 bytes)

Product version:
9,1,120291,6718

Copyright:
Copyright (C) 1998-2013 Kingsoft Corporation

Original file name:
kpacket.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\kavsetups_66_131263.exe

Digital Signature
Signed by:
Beijing Kingsoft Security software Co.,Ltd

Authority:
VeriSign, Inc.

Valid from:
12/26/2011 8:00:00 AM

Valid to:
12/26/2014 7:59:59 AM

Subject:
CN="Beijing Kingsoft Security software Co.,Ltd", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Beijing Kingsoft Security software Co.,Ltd", L=beijing, S=beijing, C=CN

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
07BC3A51B589E5AF43291DF84EA4C571

File PE Metadata
OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
393216:pD2ekJrRwEqruiieoDyUN1lqrRtuwiwgGYlbXnVH81UMFRrcdDjM:h4tcFoD1otQwiNJ7VnMFRAd4

Entry address:
0x1185C0

Entry point:
60, BE, 00, D0, 4A, 00, 8D, BE, 00, 40, F5, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89...
 
[+]

Entropy:
7.9998

Packer / compiler:
UPX 2.90LZMA]

Code size:
432 KB (442,368 bytes)

The file kavsetups_66_131263.exe has been seen being distributed by the following 16 URLs.

http://dl.union.ijinshan.com/duba/.../fgtKAVSETUPS_66_64428.exe

http://www.baidu.com/cb.php?c=IgF_pyfqnHRsnWm4njf0IZ0qnfK9ujYknHc4PH630Aw-5HDsPHTzrHT0TAq15HTLnHckP6K15ynzuHf4P1FhPv79nAPBnAn0uZfqnHn3nHmvPjDzr0KdThsqpZwYTjCEQvC8Iy4GUv38pyGGUMPCmy38mvqVQvGdUg08TA9s5LNxpvN45Hn4Pj64P0KzujYL0AFV5H00TZcqn0KdpyfqPHTdnH0Ln6KEpyfqnH6zPjbd0APGujY1njf1PW60ULI85HDLPjDdrfKWThnqnHT3PHn

http://j.union.ijinshan.com/jump.php?u_key=259700

http://www.baidu.com/cb.php?c=IgF_pyfqnHDzn1czn1m0IZ0qnfK9ujYknjfdnW630Aw-5HbLnjTLPsKsULnqP1cLPj640ZnqPynvrj7WmyuhPWu9mWFWP0KbIjYkn16vPWmkPH0L0ZNzUjdCIZwsrBtEpB4dUh-EUB4Gph-8Tv99UB4WUvYEpMNVTa4spZ0OINqougbqn1mkrHTd0ZFb5Hb4rfKBUHYs0ZKz5H00Iy-b5HR3PWRkrj00Uv-b5HDLP1bLP6KWpyfqnWRzPjD10AqLUWYkPWb4PWD0mLFW5HDzrHTk

http://222.216.188.71/dl.union.ijinshan.com/duba/.../dsgKAVSETUPS_66_83076.exe

http://dl.union.ijinshan.com/duba/.../dsgKAVSETUPS_66_83076.exe

http://222.216.188.73/dl.union.ijinshan.com/.../download.php?T=S&cid=66&sid=83076&n=dsg

http://dl.union.ijinshan.com/.../download.php?T=S&cid=66&sid=83076&n=dsg

http://j.union.ijinshan.com/jump.php?u_key=353363

http://www.baidu.com/cb.php?c=IgF_pyfqrHRzrHnsnfKYTjYk0A7b5HDsnWT4PHc0uARqrHRzrHbv0ZKET1YLnjb4nj60T1dBrHm1PANBrj64nW03njwW0AwY5HD1rjcdPjcYPHR0IgF_5y9YIZ0lQzqJQMN8pyq8Qh-Jpy41pA78QhPEUiqJIydsQMKCTjqdgvV-XHY1PHn1PWn0ThfqPsKBUHYs0ZKz5H00Iy-b5HmkP1bzP1D0Uv-b5HcsnW61n6KWpyfqnW64nWDL0AqLUWYkrHD4rjm0mLFW5HnkPWb1

http://dl.union.ijinshan.com/duba/.../dsfgKAVSETUPS_66_83093.exe

http://dl.union.ijinshan.com/.../download.php?T=S&cid=66&sid=83093&n=dsfg

http://j.union.ijinshan.com/jump.php?u_key=361975

http://www.baidu.com/cb.php?c=IgF_pyfqnHDzn1czn1m0IZ0qnfK9ujYknjfdnW630Aw-5HbLnjTLPsKsULnqP1cLPj640ZnquyuWuHR3mW-9PHczPW-Bm6KbIjYkn16LnHcsPWf10ZNzUjdCIZwsrBtEpB4dUh-EUB4Gph-8Tv99UB4WUvYEpMNVTa4spZ0OINqougbqn1mkrHTd0ZFb5HT0mhYqn0KsTWYs0ZNGujYdrjmdnH6s0AqGujYkP1T4P1m0mv-b5HcdnWfknsKEIv3qnHm4rHmk0APzm1YkrH6L

http://d.union.ijinshan.com/duba/.../KAVSETUPS_66_101105.exe

http://d.union.ijinshan.com/duba/.../KAVSETUPS_66_7477.exe

Scan kavsetups_66_131263.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.