home

wuinstall.exe

WinUtilities Professional Edition

SuiNing Yilong Software Store

The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from sharewareonsale.com and multiple other hosts.
Publisher:
YL Computing, Inc   (signed by SuiNing Yilong Software Store)

Product:
WinUtilities Professional Edition

Description:
WinUtilities Professional Edition Setup

Version:
12.28

MD5:
c48ec6bec1b0fd23b3ac1957a840c581

SHA-1:
32f891f6bf0a48ffa0486585e1c81a762726473f

SHA-256:
180adb19c67df68ffb944d38e86285bb4ae83b63922b78ad4f2cb3df07d38c9b

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
12/24/2024 5:16:50 PM UTC  (today)

File size:
6.1 MB (6,386,920 bytes)

Product version:
12.28

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\downloads\wuinstall.exe

Digital Signature
Signed by:
SuiNing Yilong Software Store

Authority:
thawte, Inc.

Valid from:
1/20/2016 1:00:00 AM

Valid to:
6/10/2016 1:59:59 AM

Subject:
CN=SuiNing Yilong Software Store, OU=IT, O=SuiNing Yilong Software Store, L=Suining, S=Sichuan, C=CN

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
37E67A439246DF1262B641BFA1CD1049

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
196608:UMjkB9n9BrN1LLjqrO0iOnEFVJ0747nUEUfURw0U:UMjkB9n9Tpqy0iOn+VJ07QnUEsURwz

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file wuinstall.exe has been seen being distributed by the following 9 URLs.

https://sharewareonsale.com/?download_file=5133&order=wc_order_56c647624274a&email=flypig0209@yahoo.com.tw&key=6cffc23dda05246912855770da3be7b8

https://sharewareonsale.com/?download_file=5133&order=wc_order_56c44d78e3cb4&email=hangyu.arthur@gmail.com&key=6cffc23dda05246912855770da3be7b8

https://sharewareonsale.com/?download_file=5133&order=wc_order_56c5e9700ac76&email=ln90528@gmail.com&key=6793b21a3ebfcbd5973dbd30146a9098

http://goo.gl/f5M3HK

https://sharewareonsale.com/?download_file=5133&order=wc_order_56c3dce7c1afe&email=thanhlevan6868@gmail.com&key=6cffc23dda05246912855770da3be7b8

https://sharewareonsale.com/?download_file=5133&order=wc_order_56c41b6646444&email=justinboulay@hotmail.com&key=6cffc23dda05246912855770da3be7b8

http://arnaqueoufiable.com/.../link.php?id=261

http://www.ylcomputing.com/.../wuinstall.exe

https://secure.avangate.com/affiliate.php?ACCOUNT=WUYANLIN&AFFILIATE=11859&AFFSRC=ijqtzy6hrj007u8200yrq&PATH=http://www.ylcomputing.com/.../wuinstall.exe

Scan wuinstall.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.