home

xltools.exe

WavePoint Co. Ltd.

Publisher:
WavePoint Co. Ltd.  (signed and verified)

Description:
Setup

Version:
12.0.21005.1 built by: REL

MD5:
14ee671750c3b1c309306680b3914394

SHA-1:
db7c620a6b319453c515a7a0e6ed49ae2beeb92d

SHA-256:
5ed9e7692fa74f1a8ebc2b4011281adeabb586a1db649e98a37d7cd81385b262

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/15/2024 8:26:29 AM UTC  (today)

File size:
795.6 KB (814,664 bytes)

Product version:
12.0.21005.1

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\xltools.exe

Digital Signature
Signed by:
WavePoint Co. Ltd.

Authority:
VeriSign, Inc.

Valid from:
9/22/2014 8:00:00 PM

Valid to:
11/22/2015 6:59:59 PM

Subject:
CN=WavePoint Co. Ltd., O=WavePoint Co. Ltd., L=St. Petersburg, S=St. Petersburg, C=RU

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
44FD0667BF940EBD141EF9AD38CA8097

File PE Metadata
Compilation timestamp:
10/5/2013 12:40:50 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
6144:eDRMxppSSVridF55EGOaJhaQXgFIaUHQWWiNLsqEIvooEE0Wgpga5oKzBkwLhgeQ:eDGxppI1wQwFXQWiNq5o3u4

Entry address:
0x2FAFD

Entry point:
E8, AD, 65, 00, 00, E9, 7F, FE, FF, FF, E9, 06, 32, 00, 00, 55, 8B, EC, 56, FF, 75, 08, 8B, F1, E8, B5, 32, 00, 00, C7, 06, 44, 65, 40, 00, 8B, C6, 5E, 5D, C2, 04, 00, C7, 01, 44, 65, 40, 00, E9, C0, 32, 00, 00, 55, 8B, EC, 83, EC, 10, EB, 0D, FF, 75, 08, E8, 64, 6D, 00, 00, 59, 85, C0, 74, 11, FF, 75, 08, E8, C5, 6C, 00, 00, 59, 85, C0, 74, E6, 8B, E5, 5D, C3, 6A, 01, 8D, 45, FC, C7, 45, FC, 4C, 65, 40, 00, 50, 8D, 4D, F0, E8, 47, 32, 00, 00, 68, 4C, 10, 45, 00, 8D, 45, F0, C7, 45, F0, 44, 65, 40, 00, 50...
 
[+]

Entropy:
5.3745

Code size:
323.5 KB (331,264 bytes)

The file xltools.exe has been seen being distributed by the following 2 URLs.

https://u924114.ct.sendgrid.net/.../click?upn=CllLf3LEvbV6iLEgNmYiL8nLsDWN-2FalZEmtH7CDCxDShNcaAxDtoPhmzgWWD85ttprcsc9sr1CETekjCeaWCqA-3D-3D_ZDYYC9JTUwE0eVdkyUgPZBhk-2BIBhtrZ17-2FRRU-2BUb6UxsvK2T4FBykaM-2F0lkHTjNYqSXQebY8qpzhyOp-2BnmrC2X2ooRiuMcp9vBixh-2FJm4nwHngyTk-2FerAp0E-2FoU8pMYvmdKpmXmEMMqeQwBly1pGu8ZMyEA-2FDn63Imo02HBWLVd9i1QpfnDezYyLqyef9b4mS0ATo6RnFcXxKCu5Chhvy9OCDnj0wZuQX34xZKpJPwwQelqNogG1-2B56Uawsvr7JFXi2vFFVGDHcMc-2BRXldz2JiWMgjKD6Rg1a2to14jLYyyqQn-2FKAB5zj9HlWGrkClDkns7X4-2BFnNPp13oXrZWeJ7qc0e78DkmHVAKhJhvbAicrjgbRkrGcuGJ-2BFcbSZ2mXW8998O3R0PABejSd2IaPtPA-3D-3D

https://u924114.ct.sendgrid.net/.../click?upn=CllLf3LEvbV6iLEgNmYiL0PQk-2Bkltg9uhHAmHk10wodVy71Js9P6SNS8IdCU5wpSGWRAkjQ3skRmb8lDCIl7YZJPZXG6hnHT2I4vpZ3iPrtzreTu5dLC7sIyAj8PedVTO2MgqkMC37AY5TBcAFo-2BKkdp85ymhEYXDmtzTtTvJR8-3D_i6xJKawXjs5H74gAFvs9XsHJ8n7lFuTnvUf1pXd1alId789n5r8ef99kLX-2BW-2F819PAPyabYfm-2Bh8FGCUZOADV6nsLLf-2FqvYUbLlIq4mUwuUj73Ri0rty0d-2Fv4-2Fr-2BiU5nOL54Rgz5-2FclGkI3UXB186gQbMEESHPB6ZIUG37BveGZfu-2BIRsg-2BJiMikVA3IjZvCabFt1tkgQiyfNv62ZShBlA-3D-3D

Scan xltools.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.