home

QiqiBox.exe

奇奇美化大师

Beijing Wenyue Technology Co.,Ltd.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘QiqiBox’.
Publisher:
Yuku Corporation  (signed by Beijing Wenyue Technology Co.,Ltd.)

Product:
奇奇美化大师

Description:
奇奇美化大师主程序

Version:
2.0.1.1520

MD5:
feeda7d51ac851bc8db389e40e0f6376

SHA-1:
6ae88703346470bbed48ec40ee2a0e04c6afbb6b

SHA-256:
aa37336f5f3243022e79e56a20c612e75c3db30b4251316bee32f9a5530a508c

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/28/2024 2:34:17 AM UTC  (today)

File size:
987.7 KB (1,011,376 bytes)

Product version:
2.0.1.1520

Copyright:
Copyright (C) 2007-2012 Yuku Corporation

Original file name:
QiqiBox.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\Program Files\qiqibox\qiqibox.exe

Digital Signature
Signed by:
Beijing Wenyue Technology Co.,Ltd.

Authority:
Thawte, Inc.

Valid from:
9/24/2012 8:00:00 AM

Valid to:
9/25/2013 7:59:59 AM

Subject:
CN="Beijing Wenyue Technology Co.,Ltd.", OU=IThelp, O="Beijing Wenyue Technology Co.,Ltd.", L=Beijing, S=Beijing, C=CN

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
58FD6DC5B97B2BA3D40A475127EF2DCC

File PE Metadata
Compilation timestamp:
5/21/2013 6:05:21 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:f02KolvpG31QeqULDO6xkSr4CmCkYmGaQF43cAqhS5AJ7DNKV50b6bR5L+KN7dZJ:/KEE31h9GSrQYmGdKZc700b26q/B

Entry address:
0x53EBA

Entry point:
E8, 70, 69, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 5D, E9, 87, 01, 00, 00, 3B, 0D, CC, 83, 48, 00, 75, 02, F3, C3, E9, EC, 69, 00, 00, 8B, FF, 55, 8B, EC, 8B, 55, 08, 56, 57, 85, D2, 74, 07, 8B, 7D, 0C, 85, FF, 75, 13, E8, B0, 3A, 00, 00, 6A, 16, 5E, 89, 30, E8, 58, 6C, 00, 00, 8B, C6, EB, 33, 8B, 45, 10, 85, C0, 75, 04, 88, 02, EB, E2, 8B, F2, 2B, F0, 8A, 08, 88, 0C, 06, 40, 84, C9, 74, 03, 4F, 75, F3, 85, FF, 75, 11, C6, 02, 00, E8, 7A, 3A, 00, 00, 6A, 22, 59, 89, 08, 8B, F1, EB, C6, 33, C0, 5F...
 
[+]

Entropy:
7.1215

Code size:
454 KB (464,896 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
QiqiBox

Command:
"C:\Program Files\qiqibox\qiqibox.exe" -autorun


Scan QiqiBox.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.