home

VStart.exe

音速启动(VStart)

Shanghai Tuizhong Network Technology Studio

The application VStart.exe by Shanghai Tuizhong Network Technology Studio has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat.
Publisher:
3L软件工作室(3LSoft)  (signed by Shanghai Tuizhong Network Technology Studio)

Product:
音速启动(VStart)

Description:
音速启动 - 您的启动专家

Version:
5.02.0001

MD5:
ef3c76660da114baa62a57b05471d1ad

SHA-1:
38a37c5f820502a546373e9994a47ae99ff8d5f0

SHA-256:
3f5003944a80b44a881c8c3edb22263476252ccb5a3f94d0fb99500a93f1d2a8

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/27/2024 3:48:37 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.Downloader.STN (M)
16.8.29.12

File size:
2.5 MB (2,662,128 bytes)

Product version:
5.02.0001

Copyright:
http://www.3lsoft.com

Trademarks:
http://www.3lsoft.com

Original file name:
VStart.exe

File type:
Executable application (Win32 EXE)

Language:
Chinese (Simplified, PRC)

Common path:
C:\Program Files\vstart50\vstart.exe

Digital Signature
Signed by:
Shanghai Tuizhong Network Technology Studio

Authority:
VeriSign, Inc.

Valid from:
4/12/2013 9:00:00 AM

Valid to:
6/11/2016 8:59:59 AM

Subject:
CN=Shanghai Tuizhong Network Technology Studio, OU=IT, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Shanghai Tuizhong Network Technology Studio, L=ShangHai, S=ShangHai, C=CN

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
17067005A0EBBDDA152B423715D32628

File PE Metadata
Compilation timestamp:
7/20/2013 1:22:53 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
24576:mgXP8mXlY2IlNXAAt8meUBCwy7zJ3/2qOSa46Iuk1JemxNhDMVaAXsovnkcaD4aT:DXDsXL8meXAVyxNhDJDzRAXIH4YXP

Entry address:
0x11AD4

Entry point:
68, CC, 2C, 41, 00, E8, F0, FF, FF, FF, 00, 00, 40, 00, 00, 00, 30, 00, 00, 00, 38, 00, 00, 00, 00, 00, 00, 00, 19, 4B, 5F, DC, D8, 32, 80, 4B, BA, E7, DD, BE, 58, 7D, 8C, 37, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 00, 00, 00, 00, 00, 56, 53, 74, 61, 72, 74, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, B0, 00, 00, 00, 88, 00, 00, 00, 00, 00, 00, 00, 02, 00, 00, 00, 51, 00, 00, 00, A1, DF, B3, 4D, E3, 1A, 4E, 43, 8A, A6, 62, 54, BF, 0D, 7A, D1, 01, 00, 00, 00, 90, 00, 00, 00, A0, 00, 00, 00, 01, 00, 00, 00...
 
[+]

Entropy:
6.2463

Developed / compiled with:
Microsoft Visual Basic v5.0/v6.0

Code size:
2.4 MB (2,519,040 bytes)

Remove VStart.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.