home

winmx353.exe

WinMX Installler

Frontcode Technologies

This is a self-extracting archive and installer. The file has been seen being downloaded from winmx.e-mov.com and multiple other hosts.
Publisher:
Frontcode Technologies

Product:
WinMX Installler

Description:
WinMX Installer

Version:
1, 0, 0, 1

MD5:
5b59e46d582ddc53cdf7542c1c590670

SHA-1:
264aa16e1575138cd6484d7f75f5f6ad66b70ecf

SHA-256:
60382146f9b6b7017412176e6af6c081c25dbcac39d279a11afe96c6c1103bf8

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
11/24/2024 11:56:48 AM UTC  (today)

Scan engine
Detection
Engine version

Bkav FE
HW32.CDB
1.3.0.4959

File size:
804 KB (823,296 bytes)

Product version:
1, 0, 0, 1

Copyright:
Copyright (C) 2001 Frontcode Technologies. All Rights Reserved.

Trademarks:
WinMX tm Frontcode Technologies

Original file name:
Installer.EXE

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\winmx353.exe

File PE Metadata
Compilation timestamp:
7/2/2004 6:54:24 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:bX346Qqey7/gcETr47jEk1btGTm1byd1ykgMRB+dwzG8DOa9z4EPia:bXYqeC/gfTr2jJXjbyykgo32aH

Entry address:
0x116000

Entry point:
68, 80, 60, 51, 00, 68, 43, 53, 5D, 00, 68, 00, 00, 00, 00, E8, 2F, F3, 0B, 00, E9, 61, CB, EE, FF, 40, 28, 23, 29, 50, 4B, 4C, 49, 54, 45, 33, 32, 20, 43, 6F, 70, 79, 72, 69, 67, 68, 74, 20, 31, 39, 39, 38, 20, 50, 4B, 57, 41, 52, 45, 20, 49, 6E, 63, 2E, 2C, 20, 41, 6C, 6C, 20, 52, 69, 67, 68, 74, 73, 20, 52, 65, 73, 65, 72, 76, 65, 64, 20, 28, 24, 52, 65, 76, 69, 73, 69, 6F, 6E, 3A, 20, 24, 29, 00, 50, 4B, 4C, 54, 33, 32, 00, 00, 10, 01, 00, 00, 26, 4D, E5, 40, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC...
 
[+]

Entropy:
7.9490

Packer / compiler:
PKLITE32, 0x1.1

Code size:
768 KB (786,432 bytes)

The file winmx353.exe has been seen being distributed by the following 6 URLs.

http://winmx.e-mov.com/.../winmx353.exe

http://web.archive.org/web/20041130083658/http://dld91.winmx.com/.../winmx353.exe

http://gsf-cf.softonic.com/264/aa1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=13522&instance=softonic_it&type=PROGRAM&Expires=1470544033&Signature=K9SaZa5jN96Otfo0J-weA3cqCmoOADWwJGRKkOvYa0Zqqet1Eo74hsTEu9ExvaDtVw6APG5p-Aky8Z3281SqOOkQDU05YcyvrBFoTwUlfD~sANs0YsrjiFLMUZ067knt~pCyzkQ8OU0n9y014F0O9o8mE7obT~Gio4qWL1UvkXI_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=winmx353.exe

http://www.passport-vip.com/.../winmx353.exe

http://software.oldversion.com/download.php?f=YTo1OntzOjQ6InRpbWUiO2k6MTQ2MDY2ODE4NztzOjI6ImlkIjtpOjE3NTU7czo0OiJmaWxlIjtzOjEyOiJ3aW5teDM1My5leGUiO3M6MzoidXJsIjtzOjQ0OiJodHRwOi8vd3d3Lm9sZHZlcnNpb24uY29tL3dpbmRvd3Mvd2lubXgtMy01MyI7czo0OiJwYXNzIjtzOjMyOiJkYTc5ZGI5MjIzMTlhNDc4NTY2NzYwYmZmZDEzNWYzZSI7fQ==

http://gsf-cf.softonic.com/264/aa1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=13522&instance=softonic_it&type=PROGRAM&Expires=1454231288&Signature=MqZBxeXy1Uezmn1l8EYd5hf3bOk7hiEbmHptCj6z8rHaAaC3zxd8XBfMqj-is4r2Tko8ls09Ci3zgoesnCXs7Cvz1GkclnB942s7Mqi2DROLQCtsJwEGwzTSesGudO--bBE0Mc8G27WOK~S5guj2EtToG1fgi1oME7CGoBVdzmk_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=winmx353.exe

Scan winmx353.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.