home

cjrx1100en.exe

Lexmark International, Inc.

This is a setup program which is used to install the application. The file has been seen being downloaded from ziggi.uol.com.br and multiple other hosts.
Publisher:
Lexmark International, Inc.  (signed and verified)

MD5:
978d70c0fa0e0813f458f17fcedf123c

SHA-1:
52d3084bc269dc3dbd8a2a587d914cbd6a065635

SHA-256:
ebbe54198c61fec44ed4c4f400081a35967a953516c6607cbfda16961536a1e3

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/21/2024 7:48:12 PM UTC  (today)

File size:
34.9 MB (36,577,960 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\cjrx1100en.exe

Digital Signature
Signed by:
Lexmark International, Inc.

Authority:
Thawte Consulting (Pty) Ltd.

Valid from:
7/9/2007 2:00:00 AM

Valid to:
8/4/2009 1:59:59 AM

Subject:
CN="Lexmark International, Inc.", OU=PS&SD BUSINESS SOFTWARE & SOLUTIONS, O="Lexmark International, Inc.", L=Lexington, S=Kentucky, C=US

Issuer:
CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA

Serial number:
166EB85E7D08509F2F215FB5E9177B98

File PE Metadata
Compilation timestamp:
7/23/2007 7:28:54 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
786432:U2MOeRmz48UYUbWRhElWI2IHcXS4JPA2P7guRPaZrjoCGteRd33/GpoRSo:H6EzHlDz6B4JoYPabGkRh4E

Entry address:
0x7698

Entry point:
E8, 19, 28, 00, 00, E9, 16, FE, FF, FF, 55, 8B, EC, 83, EC, 20, 53, 33, DB, 39, 5D, 10, 75, 20, E8, A4, 15, 00, 00, 53, 53, 53, 53, 53, C7, 00, 16, 00, 00, 00, E8, 35, 15, 00, 00, 83, C4, 14, 83, C8, FF, E9, 80, 00, 00, 00, 8B, 4D, 0C, 3B, CB, 56, 8B, 75, 08, 74, 21, 3B, F3, 75, 1D, E8, 75, 15, 00, 00, 53, 53, 53, 53, 53, C7, 00, 16, 00, 00, 00, E8, 06, 15, 00, 00, 83, C4, 14, 83, C8, FF, EB, 53, B8, FF, FF, FF, 7F, 3B, C8, 89, 45, E4, 77, 03, 89, 4D, E4, 57, FF, 75, 18, 8D, 45, E0, FF, 75, 14, C7, 45, EC...
 
[+]

Entropy:
7.9988  (probably packed)

Code size:
56 KB (57,344 bytes)

The file cjrx1100en.exe has been seen being distributed by the following 14 URLs.

http://ziggi.uol.com.br/.../54688

https://d2.driverscollection.com/2ec2dca8d063c1/c213e6ce48769bfbf06e1943046beda93cf20a4ecffd9a9f32583cf363d096036b5626cb3bd23e4d6ae3772728ee0c11571907e4/0/94/36/.../cjrX1100EN.exe

https://d2.driverscollection.com/45137a1c8ff5e/6cbbc14f6aad35240405e012b9fa81bf6471ee8cfbc456f1d38ea53a979513e1171e924a88e897ae7dcf5fbc85f8606657e81ba8/0/94/36/.../cjrX1100EN.exe

https://d2.driverscollection.com/1b015bd2c5b7665/132b16c42388751159b3b7c4e57440cddf9f811334fe224a673abe2c2e309b8ecce7f741741b4ba1f203d65bf6284aa6582a5473/0/94/36/.../cjrX1100EN.exe

http://members.driverguide.com/.../dispatch_cache_get.php?msl=978d70c0fa0e0813f458f17fcedf123c,1714108_1274747271&time=1466808543&auth=83af35cc3c4a8c7d3110566a8c7dcda1&file=cjrX1100EN.exe

http://members.driverguide.com/.../dispatch_cache_get.php?msl=978d70c0fa0e0813f458f17fcedf123c,1714108_1274747271&time=1465066153&auth=487f8e13d4178e1616577a74b6ca418f&file=cjrX1100EN.exe

https://d2.driverscollection.com/_7_14192142192242292342803150012002cc2e42a20b9bdeecbbf/a6b083b97b4931c9564e5eb3fb8519c43daf6f42f44b46d94c991e4c7e3ca96eb803bbd1e3a8bebd8b0ca935a90370d1580ce2ec/0/94/36/.../cjrX1100EN.exe

http://members.driverguide.com/.../dispatch_cache_get.php?msl=978d70c0fa0e0813f458f17fcedf123c,1714108_1274747271&time=1473750588&auth=d29ec82c7a881a0a90613bf636fe89dc&file=cjrX1100EN.exe

http://ftp2.ziggi.com.br/driver/.../cjrX1100EN.exe

http://members.driverguide.com/.../dispatch_cache_get.php?msl=978d70c0fa0e0813f458f17fcedf123c,1714108_1274747271&time=1460817384&auth=af2e3371a539d6f9106dc4ad69e754e0&file=cjrX1100EN.exe

https://d2.driverscollection.com/45137a726ea5f/949c252c6fca987d76d923f577744187887a32fb0261a113c5df9dc8ee1dbddb36cee0828c7b5bee33f2f63637358f8a56d82316/0/94/36/.../cjrX1100EN.exe

http://www.windows10drivers.com/go/Download/.../1

http://www.siliconguide.com/drivers/download/.../

http://downloads.lexmark.com/downloads/.../cjrX1100EN.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.