home

QiqiBox.exe

奇奇美化大师

Beijing Wenyue Technology Co.,Ltd.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘QiqiBox’.
Publisher:
Wenyue Corporation  (signed by Beijing Wenyue Technology Co.,Ltd.)

Product:
奇奇美化大师

Description:
奇奇美化大师主程序

Version:
2.0.3.3060

MD5:
9f5b1315ab202efda95d96b08b13f5a9

SHA-1:
1f4ecfd3dfe5fa78074a147ff43c04f0ca00a9e9

SHA-256:
d6bd8e8cd8fda60c5ec87aee08ef800858260334f9ebba45690839e17a06a898

Scanner detections:
1 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
11/5/2024 10:29:39 AM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/QiqiBox.A potentially unwanted application
6.3

File size:
1009.2 KB (1,033,392 bytes)

Product version:
2.0.3.3060

Copyright:
Copyright (C) 2007-2013 Wenyue Corporation

Original file name:
QiqiBox.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\qiqibox\qiqibox.exe

Digital Signature
Signed by:
Beijing Wenyue Technology Co.,Ltd.

Authority:
Thawte, Inc.

Valid from:
10/21/2013 8:00:00 AM

Valid to:
10/22/2014 7:59:59 AM

Subject:
CN="Beijing Wenyue Technology Co.,Ltd.", OU=IThelp, O="Beijing Wenyue Technology Co.,Ltd.", L=Beijing, S=Beijing, C=CN

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
265E6914040F4A740B16B1E0D9E67CFE

File PE Metadata
Compilation timestamp:
12/3/2013 11:26:48 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:8c/LLCnQGCiA1ogFMpXNhumhWaCRezoLMtTIY5kkHd0wQ7DNKV50b6bR5L+KNy9z:lLWnQG/Vem44cLMts3kHBQ700b26XwIr

Entry address:
0x577E5

Entry point:
E8, 25, 6B, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 5D, E9, 87, 01, 00, 00, 3B, 0D, CC, D3, 48, 00, 75, 02, F3, C3, E9, A1, 6B, 00, 00, 8B, FF, 55, 8B, EC, 8B, 55, 08, 56, 57, 85, D2, 74, 07, 8B, 7D, 0C, 85, FF, 75, 13, E8, 65, 3C, 00, 00, 6A, 16, 5E, 89, 30, E8, 0D, 6E, 00, 00, 8B, C6, EB, 33, 8B, 45, 10, 85, C0, 75, 04, 88, 02, EB, E2, 8B, F2, 2B, F0, 8A, 08, 88, 0C, 06, 40, 84, C9, 74, 03, 4F, 75, F3, 85, FF, 75, 11, C6, 02, 00, E8, 2F, 3C, 00, 00, 6A, 22, 59, 89, 08, 8B, F1, EB, C6, 33, C0, 5F...
 
[+]

Entropy:
7.1163

Code size:
471 KB (482,304 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
QiqiBox

Command:
"C:\Program Files\qiqibox\qiqibox.exe" -autorun


Scan QiqiBox.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.