» locaweb softphone.exe
Overview
Analysis
File Details
Behaviors (1)

locaweb softphone.exe

Locaweb Softphone

InWise Internet Company do Brasil S.A.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘.IAP{0070.0000.00E8.0004}’.

File name:

Publisher:

Locaweb iDC Ltda (signed by InWise Internet Company do Brasil S.A.)

Product:

Locaweb Softphone

Version:

4.5.0000.0000 pt-BR RELEASE

MD5:

6fbb4479be99be736b938d979e587e64

SHA-1:

8c48b0bea9cd648556f5e5a7071dbc51e34e0ab1

SHA-256:

2da9f798078f40b5503f9879ae4b3d6ea5cb43ee7491e58cbae58148f2561954

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

11/15/2024 9:17:32 AM UTC (today)

File size:

6.5 MB (6,828,176 bytes)

Product version:

4.5.0000.0000 pt-BR RELEASE

File type:

Executable application (Win32 EXE)

Language:

Language Neutral

Common path:

C:\Program Files\locaweb\locaweb softphone\locaweb softphone.exe

Digital Signature

Signed by:

InWise Internet Company do Brasil S.A.

Authority:

TrustSign Certificadora Digital

Valid from:

6/27/2012 9:00:00 PM

Valid to:

6/28/2013 8:59:59 PM

Subject:

CN=InWise Internet Company do Brasil S.A., O=InWise Internet Company do Brasil S.A., STREET="Av Tancredo Neves, 1283, Edf Ômega, Sala 201, Caminho das Árvores", L=Salvador, S=BA, PostalCode=41820021, C=BR

Issuer:

CN=TrustSign BR Certification Authority (Code Signing), OU=Security Dept., O=TrustSign Certificadora Digital, C=BR

Serial number:

00A5B2BDA976BB4450B07C790CEA08857A

File PE Metadata

Compilation timestamp:

1/2/2013 11:02:18 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

196608:zx/dZNnxjpDIYtrgfm0ZPIfFtj8GcMjKLJ:zxVrxjuYtrgfNRIFtj8GcMjK1

Entry address:

0xB85BC

Entry point:

E8, B1, CB, 00, 00, E9, 78, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 8B, FF, 55, 8B, EC, 83, EC, 18, 53, 8B, 5D, 0C, 56, 8B, 73, 08, 33, 35, 00, 40, 9F, 00, 57, 8B, 06, C6, 45, FF, 00, C7, 45, F4, 01, 00, 00, 00, 8D, 7B, 10, 83, F8, FE, 74, 0D, 8B, 4E, 04, 03, CF, 33, 0C, 38, E8, 1D, C4, FF, FF, 8B, 4E, 0C, 8B, 46, 08, 03, CF, 33, 0C, 38, E8, 0D, C4, FF, FF, 8B, 45, 08, F6, 40, 04, 66, 0F, 85, 16, 01, 00, 00, 8B, 4D, 10, 8D, 55, E8, 89, 53, FC, 8B, 5B, 0C, 89, 45, E8, 89, 4D, EC, 83, FB, FE, 74... 
[+]

Code size:

5 MB (5,264,896 bytes)

Startup File (All Users Run)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

.IAP{0070.0000.00E8.0004}

Command:

"C:\Program Files\locaweb\locaweb softphone\locaweb softphone.exe" \quiet

Scan locaweb softphone.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.