» LiveUpdate.exe
Overview
Analysis
File Details
Programs (1)
Network (1)

LiveUpdate.exe

LiveUpdate

Wuhan Jiduo Information Technology Co.,Ltd.

The application LiveUpdate.exe by Wuhan Jiduo Information Technology Co.,Ltd has been detected as a potentially unwanted program by 5 anti-malware scanners. This file is typically installed with the program Driver Genius Professional Edition by Driver-Soft Inc. which is a potentially unwanted software program. While running, it connects to the Internet address f8.a9.e443.ip4.static.sl-reverse.com on port 80 using the HTTP protocol.

File name:

LiveUpdate.exe

Publisher:

Driver-Soft Inc. (signed by Wuhan Jiduo Information Technology Co.,Ltd.)

Product:

LiveUpdate

Version:

9.00.0182

MD5:

a7d62946a8de6da6899413ba1efc3c9a

SHA-1:

2bb656525d9664c4d63cb66052c0ebfdc262a0ff

SHA-256:

e4eee39a6f3f5f02db811713afba875b5920b3f5d860fc782acc262b379088c0

Scanner detections:

5 / 68

Status:

Potentially unwanted

Analysis date:

11/30/2024 10:00:59 AM UTC (today)

Scan engine

Detection

Engine version

Clam AntiVirus

PUA.Packed.ASPack

0.98/18011

Quick Heal

(Suspicious) - DNAScan

4.15.11.00

Reason Heuristics

Threat.WuhanJiduoInformationTechnology

15.4.16.16

Rising Antivirus

Trojan.Win32.Generic.12CBB584

23.00.65.15414

Vba32 AntiVirus

Backdoor.Win32.Hupigon.jnxe

3.12.12.1

File size:

539.1 KB (552,016 bytes)

Product version:

9.00.0182

Original file name:

LiveUpdate.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\driver-soft\drivergenius\liveupdate.exe

Digital Signature

Signed by:

Wuhan Jiduo Information Technology Co.,Ltd.

Authority:

WoSign, Inc.

Valid from:

5/22/2008 1:00:00 AM

Valid to:

5/23/2010 12:59:59 AM

Subject:

CN=Driver-Soft.com, OU=Class 3 - for Microsoft Authenticode Signing, O="Wuhan Jiduo Information Technology Co.,Ltd.", L=Wuhan, S=Hubei, C=CN

Issuer:

CN=WoSign Code Signing Authority, O="WoSign, Inc.", C=US

Serial number:

79E59F0AC0FF47090A57C16B38B1BD

File PE Metadata

Compilation timestamp:

10/19/2009 9:40:43 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

12288:1fyCBJznDjkq6nehw0jTC85FokZXXHHBDMdwDGMaSVWz:bHjb6efjTC89VnBiMtcz

Entry address:

0x1000

Entry point:

68, 01, 80, 45, 00, E8, 01, 00, 00, 00, C3, C3, E3, 8E, CE, 2A, 5B, 2C, DD, 14, 13, 4F, D2, 53, C1, 5B, 7C, FC, 64, B4, 1A, DB, F8, C0, AA, 12, 1A, A1, A5, 6D, 1F, 39, E7, C8, 76, 67, 0E, 81, FF, C0, 64, 66, CA, 1F, 51, 64, 6A, 1A, ED, 89, AB, 5A, 59, 4E, 3E, 8B, 18, CA, BF, A0, E7, C0, DE, 6B, E5, 73, 22, 4B, 23, 77, E5, 2D, FB, B5, 65, A2, A5, 8C, DC, 28, 38, 29, B0, 22, 6E, 5E, 7D, 2E, 45, 31, 20, AA, B5, 8F, B2, CD, 98, 82, 99, DA, 0C, FA, 09, 1C, B4, 01, 4D, 61, 7F, 03, 18, 20, 79, 09, 37, EE, 61, 54... 
[+]

Entropy:

7.9104

Packer / compiler:

ASProtect v1.2x (New Strain)

Code size:

312 KB (319,488 bytes)

The file LiveUpdate.exe has been discovered within the following program.

Driver Genius Professional Edition by Driver-Soft Inc.

This is an application designed to check the computer's installed drivers against a database of available drivers for a number of software and device hardware applications.

www.driver-soft.com

65% remove it

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):

Connects to f8.a9.e443.ip4.static.sl-reverse.com (67.228.169.248:80)

Remove LiveUpdate.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.