home

BianYa.exe

BianYa

GuangxiNanningshi Shengjuguangzaixian Info Tech Co.,LTD.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘Bianya_201407101500’.
Publisher:
昇橘光在线  (signed by GuangxiNanningshi Shengjuguangzaixian Info Tech Co.,LTD.)

Product:
BianYa

Description:
BianYa File Manager

Version:
1.0.0

MD5:
41775c7f4038e7539f487dd3251bfd70

SHA-1:
fec3bd674c8e96119b20d4e2a3c292893ab0563e

SHA-256:
97f734fac69f624b4579ec6e3888fb6e52093ea4f6ea6fb8b971b678ba998a3f

Scanner detections:
1 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
4/26/2024 10:41:19 PM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/WuJi.A potentially unwanted application
7.0.302.0

File size:
917.1 KB (939,152 bytes)

Product version:
1.0.0

Copyright:
Copyright (c) 2010-2013 昇橘光在线

Original file name:
BianYa.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\bianya\201407101500\bianya.exe

Digital Signature
Signed by:
GuangxiNanningshi Shengjuguangzaixian Info Tech Co.,LTD.

Authority:
Thawte, Inc.

Valid from:
4/14/2014 8:00:00 AM

Valid to:
4/15/2015 7:59:59 AM

Subject:
CN="GuangxiNanningshi Shengjuguangzaixian Info Tech Co.,LTD.", O="GuangxiNanningshi Shengjuguangzaixian Info Tech Co.,LTD.", L=Nanning, S=Guangxi, C=CN

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
2BAC93FD3FE5B005036AD0D4C873C6E5

File PE Metadata
Compilation timestamp:
7/1/2014 10:10:57 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
24576:f55mzvUrYV1pHQXUzwGB5Ky7/Tq1cQwQWC:OYrYVvH0sjBIyyEC

Entry address:
0x6B96B

Entry point:
E8, F4, 8A, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 51, 56, 8B, 75, 0C, 56, E8, 2A, FE, FF, FF, 89, 45, 0C, 8B, 46, 0C, 59, A8, 82, 75, 17, E8, FF, 0E, 00, 00, C7, 00, 09, 00, 00, 00, 83, 4E, 0C, 20, 83, C8, FF, E9, 2F, 01, 00, 00, A8, 40, 74, 0D, E8, E4, 0E, 00, 00, C7, 00, 22, 00, 00, 00, EB, E3, 53, 33, DB, A8, 01, 74, 16, 89, 5E, 04, A8, 10, 0F, 84, 87, 00, 00, 00, 8B, 4E, 08, 83, E0, FE, 89, 0E, 89, 46, 0C, 8B, 46, 0C, 83, E0, EF, 83, C8, 02, 89, 46, 0C, 89, 5E, 04, 89, 5D, FC, A9, 0C, 01, 00...
 
[+]

Entropy:
6.5751

Code size:
537.5 KB (550,400 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Bianya_201407101500

Command:
"C:\Program Files\bianya\201407101500\bianya.exe" -mini


Scan BianYa.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.