home

kuping_s_50718.exe

安装程序 - 酷屏v4

重庆话语科技有限公司

This is a setup program which is used to install the application. The file has been seen being downloaded from cnrdn.com and multiple other hosts.
Publisher:
话语科技  (signed by 重庆话语科技有限公司)

Product:
安装程序 - 酷屏v4

Version:
1, 0, 0, 1

MD5:
133d1f3154b170997b534799e6f323f8

SHA-1:
443cd5eed8e5b9f7f4b06950aba3a338b95dcf65

SHA-256:
f6f01dd101dd6342043cae6b67f037aaa0f2341a88af0e975cb2c42d9c4171cc

Scanner detections:
2 / 68

Status:
Clean  (2 probable false positive detections)

Explanation:
These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:
11/27/2024 10:24:07 PM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/Kuping (variant)
8.9308

IKARUS anti.virus
Trojan.SuspectCRC
t3scan.2.2.29

File size:
5.7 MB (5,956,552 bytes)

Product version:
1, 0, 0, 1

Copyright:
版权所有 (C) 2012

Original file name:
Installer.EXE

File type:
Executable application (Win32 EXE)

Language:
Chinese

Common path:
C:\users\{user}\appdata\local\temp\kuping_s_50718.exe

Digital Signature
Signed by:
重庆话语科技有限公司

Authority:
Thawte, Inc.

Valid from:
6/12/2012 1:00:00 AM

Valid to:
8/9/2013 12:59:59 AM

Subject:
CN=重庆话语科技有限公司, OU=Provided by TrustAsia, O=重庆话语科技有限公司, L=重庆, S=重庆, C=CN

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
03866DEB183ABFBF4FF458D4DE7BD73A

File PE Metadata
Compilation timestamp:
1/7/2013 10:36:20 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
98304:0T37e0N1sAECKdyU/8UrR6zSDeH86tg9LT9gt6zgYVogpKvlVewLFV2x:UjN1OCGyUkUt65pg9LPHbQeIc

Entry address:
0x4F001

Entry point:
60, E8, 03, 00, 00, 00, E9, EB, 04, 5D, 45, 55, C3, E8, 01, 00, 00, 00, EB, 5D, BB, ED, FF, FF, FF, 03, DD, 81, EB, 00, F0, 04, 00, 83, BD, 22, 04, 00, 00, 00, 89, 9D, 22, 04, 00, 00, 0F, 85, 65, 03, 00, 00, 8D, 85, 2E, 04, 00, 00, 50, FF, 95, 4D, 0F, 00, 00, 89, 85, 26, 04, 00, 00, 8B, F8, 8D, 5D, 5E, 53, 50, FF, 95, 49, 0F, 00, 00, 89, 85, 4D, 05, 00, 00, 8D, 5D, 6B, 53, 57, FF, 95, 49, 0F, 00, 00, 89, 85, 51, 05, 00, 00, 8D, 45, 77, FF, E0, 56, 69, 72, 74, 75, 61, 6C, 41, 6C, 6C, 6F, 63, 00, 56, 69, 72...
 
[+]

Packer / compiler:
ASPack v2.12

Code size:
148 KB (151,552 bytes)

The file kuping_s_50718.exe has been seen being distributed by the following 19 URLs.

http://cnrdn.com/aD06

http://www.baidu.com/cb.php?c=IgF_pyfqrHfdnHn4P6KYTjYk0A7b5HDsnHnYnHT0uARqrHn3PHmk0ZKET1YLnjn3n1f0T1d9nhR1myF-uAfkrH6zPWKb0AwY5HD1P16kPH0sn1R0IgF_5y9YIZ0lQzqbULI8UAq9ua4Lmyk_mhD8mvqVQvwEIv4_Uv7bQMKCTaqoIgKGUhIxu-t1n1czri4-XAR0ThfqrHb40AFV5H00TZcqn0Kdpyfqn1RvrHT1PsKEpyfqrHcLPHT0mv-b5HDzrHn3r0KEIv3qrH0knj60mLFW5Hm1Pjcz

http://www.baidu.com/cb.php?c=IgF_pyfqrHc4n16sn6KYTjYk0A7b5H63nWmknfKbuHY4njc3nHf0TAq15Hm1n1DzPsK15HIBn1TsnW7BnAfYnj7-uH60uZfqnHnLPWb4P1RLnsKdThsqpZwYTjCEQvP8Thw8QhPEUiq3Ngmd0ZFb5HT0mhYqn0KsTWYs0ZNGujYvnjT3P1f10AqGujYkrHmdn1c0mv-b5HcLP1c1PfKEIv3qnH6vPjfz0APzm1YdPWn1P6

http://www.baidu.com/cb.php?c=IgF_pyfqrHc4n16sn6KYTjYk0A7b5H63nWmknfKbuHY4njc3nHf0TAq15Hm1n1DzPsK15HcvrHmznju-uHPWPHfYPjc0uZfqnHnLPWcLP1m1PsKdThsqpZwYTjCEQvP8Thw8QhPEUiq3Ngmd0ZFb5Hb4rfKBUHYs0ZKz5H00Iy-b5HmsP16LPjn0Uv-b5HD4PWR1n6KWpyfqnWTLnWnd0AqLUWYkrjmYPjc0mLFW5HT1PjR

http://www.baidu.com/cb.php?c=IgF_pyfqnHcdPHRznjD0IZ0qnfK9ujYknj61nHDd0Aw-5HDsnjRLPW60TAq15HTYPWcdPsK15H7Bmvfdn101nWK9mWbsn1f0uZfqnHnLP1Rkn1Dsn0KdThsqpZwYTjCEQvwEIv4_Uv7bQMI9UAkBmi4WUvYEuAqLUhkEmyf8TA9sQvVdTA-8udq1g1n4PWbsQhN3ufKzujY4rHb0mhYqn0KsTWYs0ZNGujYvPjRkPH0s0AqGujYznHbzP1n0mv-b5HnsP16YPfKEIv3qnW0vn1Dv0APzm1YdnWnYn6

http://www.baidu.com/cb.php?c=IgF_pyfqrHfdnHc4PfKYTjYk0A7b5HDsnHn1rHc0uARqrHn3PHn10ZKET1YLnjn3n1c0T1dBnj04PH0YPWbzPWnLmHbs0AwY5HD1P16zPHmLn1T0IgF_5y9YIZ0lQzqWUMFbUB4WUvYEIh93PfKzujYL0AFV5H00TZcqn0Kdpyfqn10sn1c4PfKEpyfqP1R3nW00mv-b5Hc4rjm4rfKEIv3qP1nLrHn0mLFW5HD3njmY

http://cnrdn.com/vhx5

http://download.wallba.com/.../kuping_f_35280.exe

http://www.baidu.com/cb.php?c=IgF_pyfqnHcdPHRznjD0IZ0qnfK9ujYknj61nHDd0Aw-5HDsnjRLPW60TAq15HTYPWcdPsK15H63nAc3mHFbmyckPywBmyf0uZfqnHnLrjfLnHnsPsKdThsqpZwYTjCEQvwEIv4_Uv7bQMI9UAkBmi4WUvYEuAqLUhkEmyf8TA9sQvVdTA-8udq1g1n4PWbsQhN3ufKzujYL0AFV5H00TZcqn0KdpyfqPWfdnHRsn0KEpyfqnWD4nWT10APGujY1njT3PjR0ULI85HcsPWnkP6KWThnqPjnsPHm

http://download.wallba.com/.../kuping_s_39690.exe

http://cnrdn.com/B2z5

http://download.wallba.com/.../kuping_f_39759.exe

http://cnrdn.com/H1z5

http://download.wallba.com/.../kuping_f_39738.exe

http://www.baidu.com/cb.php?c=IgF_pyfqrHc1nWb4r0KYTjYk0A7b5H6sPHmvPsKbuHYLn16snHD0TAq15HR3PjfknsK15HRsnyRvrjmLnAf1nWnYPhf0uZfqnHnLP103PHRkrfKdThsqpZwYTjCEQvP8Thw8QhPEUiquiLmd0ZFb5Hm0mhYqn0KsTWYs0ZNGujY1nj01nWbd0AqGujYLPH6zn0KWpyfqnH0vrHTs0AqLUWYLn1T4nsKWThnqn1c3njR

http://cnrdn.com/YKv5

http://download.wallba.com/.../kuping_f_29939.exe

http://www.baidu.com/cb.php?c=IgF_pyfqrHc1nWb4r0KYTjYk0A7b5H6sPHmvPsKbuHYLn16snHD0TAq15HR3PjfknsK15H6zrjc1uj7-rAf4n1N9Phm0uZfqnHnLP103PHmzP6KdThsqpZwYTjCEQvP8Thw8QhPEUiquiLmd0ZFb5Hm0mhYqn0KsTWYs0ZNGujY1nj01nWbd0AqGujYLPH6zn0KWpyfqnH0vrHTs0AqLUWYLn1T4nsKWThnqnHm4njf

http://www.baidu.com/cb.php?c=IgF_pyfqrHc4n16sn6KYTjYk0A7b5H63nWmknfKbuHY4njc3nHf0TAq15Hm1n1DzPsK15H7WPH-hPh7Wn10znW99n1b0uZfqnHnLPWDznWDLP6KdThsqpZwYTjCEQvP8Thw8QhPEUiq3Ngmd0ZFb5HT0mhYqn0KsTWYs0ZNGujYvnjT3P1f10AqGujYkrHmdn1c0mv-b5HcLP1c1PfKEIv3qnH6vPjfz0APzm1YYnW6sP0

Scan kuping_s_50718.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.