» 19d34fb7a5a55a9171097b82ae44a6e0.dll
Overview
Analysis
File Details
Programs (1)
Downloads (5)

19d34fb7a5a55a9171097b82ae44a6e0.dll

zlib

Shenzhen Weiaipu Information Technology Co., Ltd.

This is installed with 3uTools. The file has been seen being downloaded from 220.243.228.89 and multiple other hosts.

File name:

Publisher:

Shenzhen Weiaipu Information Technology Co., Ltd. (signed and verified)

Product:

zlib

Description:

zlib data compression library

Version:

1.2.8

MD5:

19d34fb7a5a55a9171097b82ae44a6e0

SHA-1:

f165a889a9b24dfcce94266a6291db96493a4f79

SHA-256:

ff2cc01e6f6979cf38b8895bd5612266d1932d6de016436c86b2fc79cb267b14

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

5/21/2024 12:40:09 AM UTC (today)

File size:

85.9 KB (87,960 bytes)

Product version:

1.2.8

Original file name:

zlib1.dll

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\19d34fb7a5a55a9171097b82ae44a6e0.dll

Digital Signature

Signed by:

Shenzhen Weiaipu Information Technology Co., Ltd.

Authority:

GlobalSign nv-sa

Valid from:

10/27/2015 5:40:00 AM

Valid to:

10/27/2016 5:40:00 AM

Subject:

CN="Shenzhen Weiaipu Information Technology Co., Ltd.", O="Shenzhen Weiaipu Information Technology Co., Ltd.", L=Shenzhen, S=Guangdong, C=CN

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121BF567E7ECFBF9C01390F0CC8231DDC82

File PE Metadata

Compilation timestamp:

5/21/2013 11:27:57 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

1536:ySYDRPL2J0IeL0sryWyoXa22BmnToIfgDIOlIO9sCL+:ydDFxMfg20TBfglv9sCL+

Entry address:

0xB22C

Entry point:

55, 8B, EC, 53, 8B, 5D, 08, 56, 8B, 75, 0C, 57, 8B, 7D, 10, 85, F6, 75, 09, 83, 3D, C4, 13, 4D, 5A, 00, EB, 26, 83, FE, 01, 74, 05, 83, FE, 02, 75, 22, A1, D4, 13, 4D, 5A, 85, C0, 74, 09, 57, 56, 53, FF, D0, 85, C0, 74, 0C, 57, 56, 53, E8, 15, FF, FF, FF, 85, C0, 75, 04, 33, C0, EB, 4E, 57, 56, 53, E8, 54, 00, 00, 00, 83, FE, 01, 89, 45, 0C, 75, 0C, 85, C0, 75, 37, 57, 50, 53, E8, F1, FE, FF, FF, 85, F6, 74, 05, 83, FE, 03, 75, 26, 57, 56, 53, E8, E0, FE, FF, FF, 85, C0, 75, 03, 21, 45, 0C, 83, 7D, 0C, 00... 
[+]

Developed / compiled with:

Microsoft Visual C++ 6.0

Code size:

44 KB (45,056 bytes)

The file 19d34fb7a5a55a9171097b82ae44a6e0.dll has been discovered within the following programs.

3uTools by ShenZhen Waip Infomation Technology Co., Ltd.

www.i4.cn

About 6% of users remove it

The file 19d34fb7a5a55a9171097b82ae44a6e0.dll has been seen being distributed by the following 5 URLs.

http://220.243.228.89/d.updater.3u.com/3utools/3utools/.../19D34FB7A5A55A9171097B82AE44A6E0.dll?wsiphost=local

http://180.180.248.170/d.updater.3u.com/3utools/3utools/.../19D34FB7A5A55A9171097B82AE44A6E0.dll

http://58.26.7.185/d.updater.3u.com/3utools/3utools/.../19D34FB7A5A55A9171097B82AE44A6E0.dll

http://d.updater.3u.com/3utools/3utools/.../19D34FB7A5A55A9171097B82AE44A6E0.dll

http://180.180.248.170/d.updater.3u.com/3utools/3utools/.../19D34FB7A5A55A9171097B82AE44A6E0.dll?wsiphost=ipdb

Scan 19d34fb7a5a55a9171097b82ae44a6e0.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.