home

mxone.exe

Sistema operativo Microsoft Windows

While the file properties state the file is developed by 'Microsoft Corporation', this is not the case and it is designed just to look like a legitimate Microsoft system file. The executable mxone.exe, “Win32 Cabinet Self-Extractor ” has been detected as malware by 2 anti-virus scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from down.zonavirus.com and multiple other hosts.
Publisher:
Microsoft Corporation*  (Invalid match)

Product:
Sistema operativo Microsoft® Windows®

Description:
Win32 Cabinet Self-Extractor

Version:
6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)

MD5:
f645f0fdf89177cf7ad5dcd8df9627d8

SHA-1:
09102587d191b6c70722d4cfee57dd5aafdd3d8f

SHA-256:
a1b14b351edd20eac36e7e48fb7e36a14671b06ba649a0e52c22c0e27fa9abf5

Scanner detections:
2 / 68

Status:
Malware

Analysis date:
11/24/2024 12:33:52 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Unnamed.Threat.15
14.3.2.10

Trend Micro House Call
TROJ_GEN.F47V1228
7.2.353

File size:
1.3 MB (1,314,304 bytes)

Product version:
6.00.2900.2180

Copyright:
© Microsoft Corporation. Reservados todos los derechos.

Original file name:
WEXTRACT.EXE

File type:
Executable application (Win32 EXE)

Language:
Spanish

Common path:
C:\users\{user}\downloads\mxone.exe

File PE Metadata
Compilation timestamp:
8/4/2004 3:01:37 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
7.10

CTPH (ssdeep):
24576:OAR2gJDCu+Z4MUjT5Jz0ituU6CbLL9r9sm1L6ldSTKwFtUQg835tdNp8xME:ag+Z47bz0ituUbb3hKm1L4ST/r13/p8y

Entry address:
0x645C

Entry point:
E8, 0A, 00, 00, 00, E9, 7A, FF, FF, FF, CC, CC, CC, CC, CC, 8B, FF, 55, 8B, EC, 83, EC, 10, A1, D0, B2, 00, 01, 85, C0, 74, 07, 3D, 40, BB, 00, 00, 75, 4D, 56, 8D, 45, F8, 50, FF, 15, 70, 11, 00, 01, 8B, 75, FC, 33, 75, F8, FF, 15, 6C, 11, 00, 01, 33, F0, FF, 15, 68, 11, 00, 01, 33, F0, FF, 15, 64, 11, 00, 01, 33, F0, 8D, 45, F0, 50, FF, 15, 60, 11, 00, 01, 8B, 45, F4, 33, 45, F0, 33, C6, 25, FF, FF, 00, 00, 5E, 75, 05, B8, 40, BB, 00, 00, A3, D0, B2, 00, 01, F7, D0, A3, CC, B2, 00, 01, C9, C3, CC, CC, CC...
 
[+]

Developed / compiled with:
Microsoft CAB SFX

Code size:
38.5 KB (39,424 bytes)

The file mxone.exe has been seen being distributed by the following 3 URLs.

http://down.zonavirus.com/programas/mx-one/.../mxone.exe

http://www.mxone.net/get.php?des=mxone

http://ldc.mx/get.php?des=mxone

Remove mxone.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.