home

qvodsetup5增强版.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from d.pcs.baidu.com and multiple other hosts.
MD5:
fbcd3ffe4d294b10d26f403a724b4135

SHA-1:
36c8975ac41774d7ad5afaacbae3dcf824d7731e

SHA-256:
3b36e5e121d27aa9564bd2967ee8218dfbd2feb4323723db1f0a7b9b8aa8e65b

Scanner detections:
1 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
11/24/2024 7:34:30 AM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
DLOADER.Trojan
9.0.1.0209

File size:
24.4 MB (25,615,400 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\qvodsetup5???.exe

File PE Metadata
Compilation timestamp:
6/19/2009 5:33:23 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
786432:I5Oe9edynYbfKAPqPVPMV1G00YmkfxuAmfrMezqJ:UOiedB2m1j0tqkrT0

Entry address:
0x3121

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 5C, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, 3F, 42, 00, E8, A2, 2C, 00, 00, A3, 64, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 24, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, 50, 91, 40, 00, 68, 60, 36, 42, 00, E8, 2B, 29, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, 19, 29, 00, 00...
 
[+]

Entropy:
7.9992

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file qvodsetup5增强版.exe has been seen being distributed by the following 9 URLs.

http://d.pcs.baidu.com/file/.../8utvb2k=&expires=8h&chkv=1&chkbd=0&chkpc=et&dp-logid=1993717199749787021&dp-callid=0&r=927976531

http://d.pcs.baidu.com/file/fbcd3ffe4d294b10d26f403a724b4135?fid=390337152-250528-1121109384862225&time=1410057028&rt=sh&sign=FDTAERY-DCb740ccc5511e5e8fedcff06b081203-1dIY5qioZPGxmiqUriyY5UxnXaM=&expires=8h&prisign=GF6x2T2CVlRV01o7Pki028kp4XDNjnf6nYJvYvdmp dC6iCzPtkM2aVC7McRJk1P9QVPB1kIp0CifNIlOMwtq9leEvhTVhjRcR83gRp4oLDRWmsGuAvcBYV8AuWyIY M7LBC/.../b4iih5gvgoRRKPZ5UeO5LvdEw==&chkv=0&chkbd=0&chkpc=et&r=462071661

http://pic.kanxi.cc/.../QvodSetup5.exe

http://d.pcs.baidu.com/file/fbcd3ffe4d294b10d26f403a724b4135?fid=3006907197-250528-182776826887497&time=1407659998&expires=1407660598&rt=sh&chkv=1&chkpc=et&sign=FDTERVYA-DCb740ccc5511e5e8fedcff06b081203-UPNEY3 /PyiGc7zn1/JZ4IsUww8=&r=203736994&sharesign=jNpkQfhaxzGS0bjULZe4nhWH6 jZU4t4kM0qYajjaFy v0i3OVyzkFQQG V14OWKtLU6vNVZ3LisyXQcYr0N7tQh1Nxvagclfog/V15NSWjVfxaDiWpm74SZ qZk4xIXfkLOR2WzFOONf59SPn3ie5xwajpXstpaIQDH9QyQQe63SbGSi9HuSr39iTxPAti9IHWGhjgQdtOyuD/DCMLHpPGKxiH5264UHfYX7cIdE/yKbyg3MwXRND 9CVnF/.../AO4kBHk2aai6UZ02biVjzjXtq31RQxF5CxZ55qOzlwFjZEdvXbUWA==&sh=1&cflg=7

http://img.kanxi.cc:81/.../QvodSetup5.exe

http://dl.kuaibo.com/QvodSetup5.exe

http://218.77.3.25/ws.cdn.baidupcs.com/.../fbcd3ffe4d294b10d26f403a724b4135?xcode=89c084d28f5d85949d30b31324225439b2947983434ae0b5837047dfb5e85c39&fid=355985566-250528-183662598072888&time=1405940267&sign=FDTAXER-DCb740ccc5511e5e8fedcff06b081203-aRHKtMseNAWCi3399DXpAfeaJDY=&to=hc&fm=N,B,U,ny&sta_dx=24&sta_cs=749&sta_ft=exe&sta_ct=1&newver=1&expires=1405940867&rt=sh&r=436645761&mlogid=2905275523&sh=1&vuk=-&vbdid=1480035098&fn=QvodSetup5.exe&wshc_tag=0&wsiphost=ipdbm

http://ws.cdn.baidupcs.com/.../fbcd3ffe4d294b10d26f403a724b4135?xcode=89c084d28f5d85949d30b31324225439b2947983434ae0b5837047dfb5e85c39&fid=355985566-250528-183662598072888&time=1405940267&sign=FDTAXER-DCb740ccc5511e5e8fedcff06b081203-aRHKtMseNAWCi3399DXpAfeaJDY=&to=hc&fm=N,B,U,ny&sta_dx=24&sta_cs=749&sta_ft=exe&sta_ct=1&newver=1&expires=1405940867&rt=sh&r=436645761&mlogid=2905275523&sh=1&vuk=-&vbdid=1480035098&fn=QvodSetup5.exe

http://d.pcs.baidu.com/file/fbcd3ffe4d294b10d26f403a724b4135?fid=355985566-250528-183662598072888&time=1405940267&sign=FDTAER-DCb740ccc5511e5e8fedcff06b081203-BOu4elM6ljEeI/CJZwD7MTmNoAs=&rt=sh&expires=1405940867&r=436645761&sh=1&sharesign=vB771SEByEI7fWiVpoIubc6NASjVGeO3pY93p52DvZhCzoreKOrhMhzxxswmQru NcAdB9PoP7r8krpCvs71gSP8njdB7dpgd2i7Hd1SBvaEmfqmZOMSF35CzkdlsxTjjX fUj594nuccGo6V7LaWiEAx/UMkEHut0mxkovR7kq9/Yk8TwLYvSB1hoY4EHbTsrg/.../LJyNJV8RkJAd99h JW2NLVvdxIKacpy1f0TdyqojXME IoC3loY=&cflg=65535

Scan qvodsetup5增强版.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.