» Xi'an TingXue Network Technology co., Ltd.
Digital Signature
Files (27)
Downloads (19)
Distribution (3)
Related (58)

Xi'an TingXue Network Technology co., Ltd.

Publisher Information

Xi'an TingXue Network Technology co., Ltd. is a software publisher located in Xi'an, Shaanxi in China*. Thre are 2 additional code signing certificates issued to this publisher.

Authority:

WoSign CA Limited

Valid from:

1/21/2016 2:41:37 PM

Valid to:

5/21/2016 2:41:37 PM

Subject:

CN="Xi'an TingXue Network Technology co., Ltd.", O="Xi'an TingXue Network Technology co., Ltd.", L=Xi'an, S=Shaanxi, C=CN

Issuer:

CN=WoSign Class 3 Code Signing CA, O=WoSign CA Limited, C=CN

Serial number:

5451a8e67dccd396c3bef61e2ef9a151

Status:

Inconclusive detections from multiple engines

Scan engine

Details

Detections

Dr.Web

infected with Trojan.Upload.107, Detection.Undefined

55.56%

AegisLab AV Signature

Troj.NSIS.StartPage

44.44%

IKARUS anti.virus

Trojan.SuspectCRC

33.33%

Bkav FE

W32.eHeur.Downloader, W32.ExecPriD.Trojan

22.22%

Panda Antivirus

Trj/Genetic.gen

11.11%

Baidu Antivirus

Win32.Trojan.YouXun

11.11%

ESET NOD32

Win32/RiskWare.YouXun (variant)

11.11%

Microsoft Security Essentials

SoftwareBundler:Win32/Xiazai

11.11%

0 / 68

processwork.dll (823066c452c072fec651aa1bc9d43fff)

3 / 68 (inconclusive)

setup_2482x.exe (0508b8e8831a1cf37974072dc74702ee)

0 / 68

update.exe (18364ddf1a16a3603554ebbcb8801447)

0 / 68

Unrar.dll (RAR decompression library by Alexander Roshal) (a248df003b447a296b84d5156f2dbbd0)

3 / 68 (Malware)

uninst.exe (25848a14f3d4bcc99dbefc57f87f7ff6)

0 / 68

jxsjzs.exe (d930e6c7adb519023d500f6b5c49c071)

0 / 68

jxsj.exe (284ad30e9ccf25bd11501a6edbf959e0)

0 / 68

jxpc.exe (8ddcae3f64fd1b1974ea73a109067d9a)

0 / 68

jxgamebox.exe (6f2f9bb831e7cc6d0fa50bb9f211c48f)

0 / 68

glut32.dll (499d07bc8b8927ccc0f37edbcd7d1b6f)

0 / 68

glut.dll (2c810cccfbde3a89187154391cc5cb4e)

0 / 68

gamestart.exe (cff8a40414856d180f52460668a1b9e1)

0 / 68

game_6182mnc.exe (39e2f4f9a283b56871693dcfe464a6ed)

1 / 68 (inconclusive)

setup_6182mnc.exe (11412c76d2fcacbba2ea4e774a9cd9b6)

0 / 68

dui.dll (e11d30899e9cb90d85c6838d57b102ca)

3 / 68 (inconclusive)

setup_6124mny_2.exe (0f40817fd17354250a482df1d5aadb11)

0 / 68

setup_6124cd.exe (ad4dd519876a913c15ab8ff687d21073)

0 / 68

nsdialogs.dll (6deda89daa3aaa2a61773ce4e114da0a)

0 / 68

system.dll (a4a05ae017940431409480a96294f9af)

2 / 68

inetc.dll (46f8d24c9549ddcd780b4309fa17390b)

2 / 68 (inconclusive)

processwork.dll (6cbf06b48cbdc4557302f1bb27294f3a)

1 / 68

dui.dll (085c8eb05589ed0f2efe11a49a553868)

0 / 68

ontop.dll (1b3647f89d45a2a8577385746bf8fc9f)

1 / 68

uninst.exe (64ea4ffbacd67c8827c6fc85bcaa68fc)

0 / 68

commlib.dll (CommLib.dll) (1f51f69cded01ffb46d3d6735b2b3ed4)

0 / 68

jxgamebox.exe (04793638608893b2144a6d6fc8634c94)

2 / 68 (inconclusive)

setup_6124c.exe (cf121f4fd2582ed649101a7d1e72dfc8)

Downloads URLs for files signed by Xi'an TingXue Network Technology co., Ltd..

2 / 68 (inconclusive)

http://dl.fly086.com/d.php?id=6124 (setup_6124c.exe)

3 / 68 (inconclusive)

http://www.baidu.com/cb.php?c=IgF_pyfqnHRdnj03Pjm0IZ0qnfK9ujYkPHn1PjRv0Aw-5HDdP1f1nWc0TAq15HDsnjcknjm0T1dBn1PhnWD1rjfznv7Bmvfd0AwY5HDYPHbdnHnsn100IgF_5y9YIZ0lQzqbUa4hUZbsrjm8mvqVQvf8TA9s5v-b5HmknWf0ThfqP6KBUHYs0ZKz5H00Iy-b5HnsPW6vrjf0Uv-b5HDkrHTdPsKWpyfqPHc4n1f0ULI85H00TZbqnH0d0APzm1Y1rj0z (setup_6124mny_2.exe)

2 / 68 (inconclusive)

http://www.baidu.com/cb.php?c=IgF_pyfqnHRdnj03Pjm0IZ0qnfK9ujYkPHn1PjRv0Aw-5HDdP1f1nWc0TAq15HDsnjcknjm0T1YLuWFWmHKBnAPbmWRkmWF90AwY5HDYPH6vPHnzPWT0IgF_5y9YIZ0lQzqbUa4hUZbsrjm8mvqVQvf8TA9s5v-b5HmknWf0ThfqPsKBUHYs0ZKz5H00Iy-b5HnsPW6vrjf0Uv-b5HDkrHTdPsKWpyfqPHc4n1f0ULI85H00TZbqnH0d0APzm1YkPW6knf (setup_6124c.exe)

2 / 68 (inconclusive)

http://www.baidu.com/cb.php?c=IgF_pyfqnHRdnj03Pjm0IZ0qnfK9ujYkPHn1PjRv0Aw-5HDdP1f1nWc0TAq15HDsnjcknjm0T1YsnynsmHcdmvRdrHDLm1m30AwY5HDYPHTLPH63PHR0IgF_5y9YIZ0lQzqbUa4hUZbsrjm8mvqVQvf8TA9s5v-b5HmknWf0ThfqrHb40AFV5H00TZcqn0Kdpyfqn10vrjm3P0KEpyfqnHD4P1RL0APGujYdnWb1P0KEIv3qn0KsXHYknjR0mLFW5HmYrj6v (setup_6124c.exe)

2 / 68 (inconclusive)

http://dl.fly086.com/d.php?id=6182 (setup_6124c.exe)

1 / 68 (inconclusive)

http://dl.fly086.com/ul.php?id=9982&u=aHR0cDovL3R4Y2RuLnFpcWlyaWxpLmNvbS9kb3dubG9hZC9TZXR1cF85OTgyeC5leGU= (setup_6182mnc.exe)

3 / 68 (inconclusive)

http://dl.fly086.com/d.php?id=2295 (setup_6124mny_2.exe)

2 / 68 (inconclusive)

http://www.baidu.com/cb.php?c=IgF_pyfqnHRdnj03Pjm0IZ0qnfK9ujYkPHn1PjRv0Aw-5HDdP1f1nWc0TAq15HDsnjcknjm0T1Yzn1NBn16kuj9bm1w9mvub0AwY5HDYPHfdrHT3PWT0IgF_5y9YIZ0lQzqbUa4hUZbsrjm8mvqVQvf8TA9s5v-b5HmknWf0ThfqrHb40AFV5H00TZcqn0Kdpyfqn10vrjm3P0KEpyfqnHD4P1RL0APGujYdnWb1P0KEIv3qn0KsXHYknjR0mLFW5Hn3PWn4 (setup_6124c.exe)

1 / 68 (inconclusive)

http://dl.fly086.com/d.php?id=6182 (setup_6182mnc.exe)

2 / 68 (inconclusive)

http://www.baidu.com/cb.php?c=IgF_pyfqnHRdnj03Pjm0IZ0qnfK9ujYkPHn1PjRv0Aw-5HDdP1f1nWc0TAq15HDsnjcknjm0T1Y3rjf3PAFBrHb4mymLnvfd0AwY5HDYPHR1P1bvnW00IgF_5y9YIZ0lQzqbUa4hUZbsrjm8mvqVQvf8TA9s5v-b5HmknWf0ThfqPsKBUHYs0ZKz5H00Iy-b5HnsPW6vrjf0Uv-b5HDkrHTdPsKWpyfqPHc4n1f0ULI85H00TZbqnH0d0APzm1YvnHRLP0 (setup_6124c.exe)

2 / 68 (inconclusive)

http://www.baidu.com/cb.php?c=IgF_pyfqnHRdnj03Pjm0IZ0qnfK9ujYkPHn1PjRv0Aw-5HDdP1f1nWc0TAq15HDsnjcknjm0T1Y4uH-9uW-BnW7hPHubmHnv0AwY5HDYPHf3nj6snWm0IgF_5y9YIZ0lQzqbUa4hUZbsrjm8mvqVQvf8TA9s5v-b5HmknWf0ThfqrHb40AFV5H00TZcqn0Kdpyfqn10vrjm3P0KEpyfqnHD4P1RL0APGujYdnWb1P0KEIv3qn0KsXHYknjR0mLFW5HfzrjmY (setup_6124c.exe)

2 / 68 (inconclusive)

http://dl.fly086.com/ul.php?id=1292&u=aHR0cDovL3R4Y2RuLnFpcWlyaWxpLmNvbS9kb3dubG9hZC9TZXR1cF8xMjkyeC5leGU= (setup_6124c.exe)

3 / 68 (inconclusive)

http://dl.fly086.com/ul.php?id=2482&u=aHR0cDovL3R4Y2RuLnFpcWlyaWxpLmNvbS9kb3dubG9hZC9TZXR1cF8yNDgyeC5leGU= (setup_6124mny_2.exe)

1 / 68 (inconclusive)

http://lxdl.91nzh.com/.../Setup_1513mnc.exe (11412c76d2fcacbba2ea4e774a9cd9b6)

2 / 68 (inconclusive)

http://dl.fly086.com/ul.php?id=2482&u=aHR0cDovL3R4Y2RuLnFpcWlyaWxpLmNvbS9kb3dubG9hZC9TZXR1cF8yNDgyeC5leGU= (setup_6124c.exe)

1 / 68 (inconclusive)

http://www.baidu.com/cb.php?c=IgF_pyfqnHRdnj03Pjm0IZ0qnfK9ujYkPHn1PjRv0Aw-5HDdP1f1nWc0TAq15HDsnjcknjm0T1YvPyD1Pjc3mHn4nH6LuANW0AwY5HDYPW01PHTzrHT0IgF_5y9YIZ0lQzqbUa4hUZbsrjm8mvqVQvf8TA9s5v-b5HmknWf0ThfqPsKBUHYs0ZKz5H00Iy-b5HnsPW6vrjf0Uv-b5HDkrHTdPsKWpyfqPHc4n1f0ULI85H00TZbqnH0d0APzm1YzrjT1ns (setup_6182mnc.exe)

3 / 68 (inconclusive)

http://dl.fly086.com/ul.php?id=1292&u=aHR0cDovL3R4Y2RuLnFpcWlyaWxpLmNvbS9kb3dubG9hZC9TZXR1cF8xMjkyeC5leGU= (setup_6124mny_2.exe)

3 / 68 (inconclusive)

http://dl.fly086.com/d.php?id=6182 (setup_6124mny_2.exe)

0 / 68

http://dl.fly086.com/d.php?id=6182 (setup_6124cd.exe)

Distribution

The following websites host and distribute files published by Xi'an TingXue Network Technology co., Ltd..

lxdl.91nzh.com

dl.fly086.com

www.baidu.com

The certificates below are also signed by Xi'an TingXue Network Technology co., Ltd..

6190EFA7A2B8F0695104A04BBE7112B5 (Jan 21, 2016 to May 21, 2016)

335183F94C563B4721865B606129EFBA (May 06, 2015 to May 06, 2016)

The following publishers (by Authenticode signature organization name) are related.

ZUNSHANG INFO TECH CO. LTD.

Beijing Sohu New Media Information Technology Co., Ltd.

Beijing baidu Netcom science and technology co.ltd

Baidu (China) Co., Ltd.

Shanghai Weilu Network Technology Co., Ltd.

广西南宁市昇泰安电子商务发展有限公司

重庆话语科技有限公司

Youbo Network Technology Co.,Ltd

Shanghai Zhenrui Network Technology Studio

上海冰狗网络科技有限公司

Changzhou Zunshang Information Technology Co., Ltd

Tencent Technology(Shenzhen) Company Limited

Shanghai Gaoxin Computer System Co.,ltd

Beijing Kingsoft Security software Co.,Ltd

GuangxiNanningshi Shengjuguangzaixian Info Tech Co.,LTD.

Shanghai kuaiping Network Technology Co., Ltd

SHANGRAO WANGJU TIANXIA TECHNOLOGY CO.,LTD.

SHANGHAI FENGHAN NETWORK INFORMATION TECHNOLOGY STUDIO

易书海

BEIJING QIYI CENTURY SCIENCE&TECHNOLOGY CO.,LTD.

ZhongXiang ZhiXing Network Service Co., Ltd.

刘诗诗

Youqu Network Technology Co.Ltd

Chongqing QuWan Technology Co., Ltd.

Yantai ZhengHao Network Technology Co.,Ltd.

Yantai Zhenghao Network Technology (Zhifu Branch) Co., LTD.

30 of 58 publishers

* Note, the details and description above are based on the code signing digital signature issued to Xi'an TingXue Network Technology co., Ltd. by WoSign CA Limited on January 21, 2016 with the serial number '5451a8e67dccd396c3bef61e2ef9a151'.

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.