home

VStart.exe

音速启动(VStart)

SHANGHAI FENGHAN NETWORK INFORMATION TECHNOLOGY STUDIO

The application VStart.exe by SHANGHAI FENGHAN NETWORK INFORMATION TECHNOLOGY STUDIO has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. While running, it connects to the Internet address 203.130.53.126-BJ-CNC on port 80 using the HTTP protocol.
Publisher:
3L软件工作室(3LSoft)  (signed by SHANGHAI FENGHAN NETWORK INFORMATION TECHNOLOGY STUDIO)

Product:
音速启动(VStart)

Description:
音速启动 - 您的启动专家

Version:
5.06

MD5:
5a71c47f8a7932e7d556a0618739a915

SHA-1:
e67b3a3ff81d66cd94ce56b88a4228922b7cf4e9

SHA-256:
d248ae56f22a0abfabe57dae428981b170e363c956a78d587ad515926d0c0580

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/24/2024 2:22:49 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.SHANGHAIFENGHANNETWORKINFORMATIONTECHNOLOGYSTUDIO (M)
15.9.2.23

File size:
2.6 MB (2,755,248 bytes)

Product version:
5.06

Copyright:
http://www.3lsoft.com

Trademarks:
http://www.3lsoft.com

Original file name:
VStart.exe

File type:
Executable application (Win32 EXE)

Digital Signature
Signed by:
SHANGHAI FENGHAN NETWORK INFORMATION TECHNOLOGY STUDIO

Authority:
VeriSign, Inc.

Valid from:
4/7/2014 8:00:00 AM

Valid to:
4/7/2017 7:59:59 AM

Subject:
CN=SHANGHAI FENGHAN NETWORK INFORMATION TECHNOLOGY STUDIO, OU=IT, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=SHANGHAI FENGHAN NETWORK INFORMATION TECHNOLOGY STUDIO, L=Shanghai, S=Shanghai, C=CN

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
694E2E0ECECA0C1410EC755324F4D446

File PE Metadata
Compilation timestamp:
10/14/2014 11:53:25 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
49152:LDjBK2u57gXkhoFKVbz8fPKLPpRAHV0X3:XdnFc/8fPoBRAH6

Entry address:
0x127C4

Entry point:
68, 5C, 3A, 41, 00, E8, F0, FF, FF, FF, 00, 00, 40, 00, 00, 00, 30, 00, 00, 00, 38, 00, 00, 00, 00, 00, 00, 00, B6, 09, 20, 1F, 07, 9A, 0A, 4E, 8E, 6A, 0B, 65, 93, 6C, 39, 21, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 0D, 0A, 20, 20, 20, 20, 56, 53, 74, 61, 72, 74, 00, 20, 00, 6C, 73, 65, 0D, 0A, 20, 20, B0, 00, 00, 00, 88, 00, 00, 00, 00, 00, 00, 00, 02, 00, 00, 00, 51, 00, 00, 00, 4B, 1A, 3A, 05, DF, 84, 15, 40, 9E, 21, 3F, 1C, AC, DA, 6E, FC, 01, 00, 00, 00, 90, 00, 00, 00, A0, 00, 00, 00, 01, 00, 00, 00...
 
[+]

Entropy:
6.1906

Developed / compiled with:
Microsoft Visual Basic v5.0/v6.0

Code size:
2.5 MB (2,609,152 bytes)

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to 203.130.53.126-BJ-CNC  (203.130.53.126:80)

Remove VStart.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.