home

wordpress.exe

Microsoft Web Platform Extensions

Microsoft Corporation

Publisher:
Microsoft Corporation  (signed and verified)

Product:
Microsoft® Web Platform Extensions

Description:
WPI launcher

Version:
7.1.50430.0

MD5:
ca4293242b7679bdc057d3437f6977d4

SHA-1:
874f0e541d1d3c9e5e41258d014cfd610ba49683

SHA-256:
5ca3400c444cf4b970833e0986656e907a318dba4f85d37e70512d67b3087710

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
11/4/2024 5:01:08 PM UTC  (today)

File size:
113.7 KB (116,384 bytes)

Product version:
7.1.50430.0

Copyright:
Copyright © 2011 Microsoft Corporation

Trademarks:
Microsoft® is a registered trademark of Microsoft Corporation.

Original file name:
wpilauncher.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\wordpress.exe

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
4/22/2014 1:39:00 PM

Valid to:
7/22/2015 1:39:00 PM

Subject:
CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
33000000CA6CD5321235C4E1550001000000CA

File PE Metadata
Compilation timestamp:
4/30/2014 5:22:36 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
1536:bePj/AyCfkrOIQ9TlnUlOaI0cUhsWjcdFSeC85dLrBSo:ber/y9ZnUlTISOFSeD57So

Entry address:
0x4560

Entry point:
E8, B6, 3D, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 58, 7C, 41, 00, E8, AA, 26, 00, 00, E8, 64, 1B, 00, 00, 0F, B7, F0, 6A, 02, E8, 49, 3D, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 2A, 37, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
5.9828

Code size:
49 KB (50,176 bytes)

The file wordpress.exe has been seen being distributed by the following 50 URLs.

https://profile.microsoft.com/RegSysProfileCenter/wizard.aspx?wizid=f4502d34-3b8f-4a04-b741-289e08aa1782&wp=MCLBI&lcid=1033&fu=https://www.microsoft.com/web/handlers/webpi.ashx/.../WebNode11Pack.appids&wa=wsignin1.0

https://www.microsoft.com/web/handlers/webpi.ashx/.../urlrewrite2.appids

https://profile.microsoft.com/RegSysProfileCenter/wizard.aspx?wizid=f4502d34-3b8f-4a04-b741-289e08aa1782&wp=MCLBI&lcid=1033&fu=https://www.microsoft.com/web/handlers/webpi.ashx/.../VWDOrVs2015AzurePack.appids&wa=wsignin1.0

https://www.microsoft.com/web/.../webpi.ashx?command=getinstallerredirect&appid=ASPDOTNETandWebTools2012_2

http://visit.digidip.net/visit?pid=652&generated=shortener&url=http://www.microsoft.com/web/.../webpi.ashx?command=getinstallerredirect&appid=MVC4VS2010_Loc

https://www.microsoft.com/web/handlers/webpi.ashx/.../WindowsAzureToolsVS2010.appids

http://lib.giveawayoftheday.com/Microsoft_Visual_Web_Developer_2010_Express_1709964/.../?cfcc5f8

http://webpihandler.azurewebsites.net/webpi.ashx?command=getinstaller&appid=ZBillingNET

https://www.microsoft.com/web/.../webpi.ashx?command=getinstallerredirect&appid=php53

https://go.microsoft.com/.../?LinkId=254280&clcid=0x416

http://go.microsoft.com/.../?LinkId=808331

http://www.microsoft.com/web/.../webpi.ashx?command=getinstaller&appid=vwd

http://www.microsoft.com/web/.../webpi.ashx?command=getprereleaseinstaller&appid=wordpresshebrew

http://go.microsoft.com/fwlink/.../?linkid=320376&clcid=0x416

https://webpihandler.azurewebsites.net/webpi.ashx?command=getinstaller&appid=Incentive

https://profile.microsoft.com/RegSysProfileCenter/wizard.aspx?wizid=f4502d34-3b8f-4a04-b741-289e08aa1782&wp=MCLBI&lcid=1033&fu=https://www.microsoft.com/web/handlers/webpi.ashx/.../VSorVWDASPNETCore.appids&wa=wsignin1.0

https://go.microsoft.com/.../?LinkId=746481&clcid=0x409

https://www.microsoft.com/web/handlers/webpi.ashx/.../VWDOrVs2013AzurePack.2E2.2E9.appids

https://profile.microsoft.com/RegSysProfileCenter/wizard.aspx?wizid=f4502d34-3b8f-4a04-b741-289e08aa1782&wp=MCLBI&lcid=1033&fu=https://www.microsoft.com/web/handlers/webpi.ashx/.../VWDOrVs2015AzurePack.2E2.2E9.appids&wa=wsignin1.0

http://webpihandler.azurewebsites.net/webpi.ashx?command=getinstaller&appid=Joomla

https://www.microsoft.com/web/.../webpi.ashx?command=getinstaller&appid=AdminPack;AdminPack

http://go.microsoft.com/fwlink/.../?linkid=323511&clcid=0x409

http://redirect.viglink.com/?key=d29472e3967263fc4e25b6e1cd784c4a&u=http://go.microsoft.com/.../?LinkId=746481&cuid=nodt-56

http://go.microsoft.com/.../?linkid=324322&clcid=0x416

https://www.microsoft.com/web/handlers/webpi.ashx/.../VSorVWDASPNETCore.appids

https://affilinks.affilizr.com/action/?pcode=utf-8&r=1463250632336.4&go=1&redir=http://action.metaffiliation.com/trk.php?mclic=P4324955D624171&argsite=40318892&redir=http://www.microsoft.com/web/.../webpi.ashx?command=getinstaller&appid=VWD2010SP1AzurePack

https://webpihandler.azurewebsites.net/webpi.ashx?command=getinstaller&appid=CloudSwyftTraining

http://www.microsoft.com/web/.../webpi.ashx?command=getinstaller&appid=SQLCE;SQLCEVSTools_4_0

http://go.microsoft.com/.../?LinkID=263635

http://www.microsoft.com/web/.../webpi.ashx?command=getinstallerredirect&appid=urlrewrite2

Latest 30 of 318 download URLs

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.