home

xvidcodec.exe

Windows host process (Rundll32)

While the file properties state the file is developed by 'Microsoft Corporation', this is not the case and it is designed just to look like a legitimate Microsoft system file. The executable xvidcodec.exe, “Windows host process (Rundll32)” has been detected as malware by 16 anti-virus scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from am4-r1f2-stor02.uploaded.net and multiple other hosts.
Publisher:
Microsoft Corporation*  (Invalid match)

Product:
Microsoft® Windows® Operating System

Description:
Windows host process (Rundll32)

Version:
6.1.7600.16385 (win7_rtm.090713-1255)

MD5:
243affaeb974ed3a0f679411d5831aae

SHA-1:
e2a19c3659d5d100c7b9c7f8c7f1eacbfa2ace7d

SHA-256:
a69e375836effc52711252de3e32ce58707f82bb86bc371da062a9f0cd78a3ad

Scanner detections:
16 / 68

Status:
Malware

Analysis date:
11/28/2024 11:43:43 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.GenericKD.1943355
753

Avira AntiVirus
TR/Dldr.Adload.nnx.2
7.11.182.128

Baidu Antivirus
Trojan.Win32.NSIS
4.0.3.15113

Bitdefender
Trojan.GenericKD.1943355
1.0.20.65

Emsisoft Anti-Malware
Trojan.GenericKD.1943355
8.15.01.13.04

ESET NOD32
Win32/TrojanDownloader.Adload.NNX
9.10648

F-Secure
Trojan.GenericKD.1943355
11.2015-13-01_3

G Data
Trojan.GenericKD.1943355
15.1.24

Kaspersky
Trojan-Dropper.Win32.NSIS
14.0.0.2649

McAfee
Artemis!243AFFAEB974
5600.6887

Norman
Troj_Generic.WSNEM
11.20150113

nProtect
Trojan.GenericKD.1943355
14.10.30.01

Qihoo 360 Security
HEUR/QVM42.0.Malware.Gen
1.0.0.1015

Sophos
Mal/Mdrop-KH
4.98

Vba32 AntiVirus
TrojanDropper.ytu
3.12.26.3

VIPRE Antivirus
Trojan.Win32.Generic
34388

File size:
1.8 MB (1,928,903 bytes)

Product version:
6.1.7600.16385

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
RUNDLL32.EXE

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\programs\xvidcodec.exe

File PE Metadata
Compilation timestamp:
2/24/2012 7:20:04 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
49152:ZfDBMBT6dDeflSd2FXRgt2JmO47GVoGNuyMDIQ0BcphDa:FWBTLNRFXRgPO/+GNgD0SpVa

Entry address:
0x38AF

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 68, A2, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 90, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 90, 40, 00, 55, FF, 15, C0, 92, 40, 00, 6A, 08, A3, 98, EB, 47, 00, E8, 36, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, B0, EA, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 64, A2, 40, 00, FF, 15, 84, 91, 40, 00, 68, 4C, A2, 40, 00, 68, A0, 6A, 47, 00, E8, 18, 27, 00, 00, FF, 15, B0, 90, 40, 00, 50, BF, A0, F0, 4C, 00, 57, E8, 06, 27, 00, 00...
 
[+]

Entropy:
7.9926

Packer / compiler:
Nullsoft install system v2.x

Code size:
29 KB (29,696 bytes)

The file xvidcodec.exe has been seen being distributed by the following 2 URLs.

http://am4-r1f2-stor02.uploaded.net/.../314823bb-bca0-45ff-a96a-69bd537d2a30

http://am4-r1f2-stor02.uploaded.net/.../5cb01c2e-e896-4ccf-8d69-ddb809500800

Remove xvidcodec.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.