home

LiveUpdate.exe

LiveUpdate

Wuhan Jiduo Information Technology Co.,Ltd.

The application LiveUpdate.exe by Wuhan Jiduo Information Technology Co.,Ltd has been detected as a potentially unwanted program by 3 anti-malware scanners. This file is typically installed with the program Driver Genius Professional Edition by Driver-Soft Inc. which is a potentially unwanted software program. While running, it connects to the Internet address f8.a9.e443.ip4.static.sl-reverse.com on port 80 using the HTTP protocol.
Publisher:
Driver-Soft Inc.  (signed by Wuhan Jiduo Information Technology Co.,Ltd.)

Product:
LiveUpdate

Version:
8.00.0316

MD5:
dbfc0f932891b01c88aec8be3cd71df5

SHA-1:
97aa0e3a10e076fe59b8265b9107205fb13e49c2

SHA-256:
7905c72c6664dbfcc25f9ac394b2838d487e0fa3bb4bc71f071a07313c50718b

Scanner detections:
3 / 68

Status:
Potentially unwanted

Analysis date:
11/27/2024 6:33:23 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Optional.WuhanJiduoInformationTechnologyCoLtd.K
14.10.15.6

Rising Antivirus
Trojan.Win32.Generic.12CBB584
23.00.65.141013

Vba32 AntiVirus
Backdoor.Win32.Hupigon.jnxe
3.12.12.1

File size:
278.1 KB (284,752 bytes)

Product version:
8.00.0316

Copyright:
Copyright (C) 2002-2008 Driver-Soft Inc.

Original file name:
LiveUpdate.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\driver-soft\drivergenius\liveupdate.exe

Digital Signature
Signed by:
Wuhan Jiduo Information Technology Co.,Ltd.

Authority:
WoSign, Inc.

Valid from:
5/22/2008 2:00:00 AM

Valid to:
5/23/2010 1:59:59 AM

Subject:
CN=Driver-Soft.com, OU=Class 3 - for Microsoft Authenticode Signing, O="Wuhan Jiduo Information Technology Co.,Ltd.", L=Wuhan, S=Hubei, C=CN

Issuer:
CN=WoSign Code Signing Authority, O="WoSign, Inc.", C=US

Serial number:
79E59F0AC0FF47090A57C16B38B1BD

File PE Metadata
Compilation timestamp:
8/2/2008 4:05:57 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
3072:rz7JjkV41bW1UgSwLOh5rz7iNfcw+Yn5pNj5lWwnEh8CAgWevycwEkXDxLin:lNbUc9YndjKqdwycHkNW

Entry address:
0x337C

Entry point:
68, 3C, 36, 40, 00, E8, F0, FF, FF, FF, 00, 00, 00, 00, 00, 00, 30, 00, 00, 00, 40, 00, 00, 00, 00, 00, 00, 00, A7, CC, D9, 26, F0, 83, 7F, 46, B1, 37, 5D, D1, 33, CD, F5, 2E, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 41, 00, 06, 50, 93, 02, 4C, 69, 76, 65, 55, 70, 64, 61, 74, 65, 00, 00, E4, AC, 1F, 05, 00, 00, 00, 00, 01, 00, 0A, 00, 20, 62, 40, 00, 00, 00, 00, 00, FF, FF, FF, FF, FF, FF, FF, FF, 00, 00, 00, 00, 54, 64, 40, 00, FC, AA, 43, 00, 00, 00, 00, 00, 58, B9, C4, 06, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual Basic v5.0

Code size:
228 KB (233,472 bytes)

The file LiveUpdate.exe has been discovered within the following program.

Driver Genius Professional Edition  by Driver-Soft Inc.
This is an application designed to check the computer's installed drivers against a database of available drivers for a number of software and device hardware applications.
www.driver-soft.com
65% remove it
 
Powered by Should I Remove It?

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to f8.a9.e443.ip4.static.sl-reverse.com  (67.228.169.248:80)

Remove LiveUpdate.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.