home

ctxfm102015.exe

WOLTERS KLUWER LIMITED

This is a setup program which is used to install the application. The file has been seen being downloaded from tc.cch.ca and multiple other hosts.
Publisher:
WOLTERS KLUWER LIMITED  (signed and verified)

Description:
{D29A8213-4949-443A-91A5-AFD1E1DC088C}

Version:
15.1.0.233

MD5:
e66255a5e4c43a7d3e9628da339cd0fc

SHA-1:
1c3cb9071ece5818fd651a3dbafca39ce11ee78c

SHA-256:
fc1d9462f3411a8464e894b061dbf8622348750caf0aae73a71a43684fca5d58

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/18/2024 6:50:14 AM UTC  (today)

File size:
50.9 MB (53,332,656 bytes)

Copyright:
Copyright © 2015 Wolters Kluwer Limited

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\ctxfm102015.exe

Digital Signature
Signed by:
WOLTERS KLUWER LIMITED

Authority:
GoDaddy.com, Inc.

Valid from:
6/22/2015 1:01:38 PM

Valid to:
6/22/2017 1:01:38 PM

Subject:
CN=WOLTERS KLUWER LIMITED, O=WOLTERS KLUWER LIMITED, L=Toronto, S=Ontario, C=CA

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
00B6CDDD50C238B5DA

File PE Metadata
Compilation timestamp:
8/16/2007 1:13:16 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
7.10

CTPH (ssdeep):
1572864:NRG4rFL+QyH6k72M4k0WRfvAsXm7m/Liq/xAbkMfeAAy:NY4rFLIH572M4qR3AsHmq/xAbkMfj

Entry address:
0x1000

Entry point:
55, 8B, EC, 81, EC, 7C, 05, 00, 00, 53, 56, 57, BE, 04, 01, 00, 00, 56, 8D, 85, 90, FD, FF, FF, 33, DB, 50, 53, 89, 5D, F4, FF, 15, 38, 20, 40, 00, 56, 8D, 85, 90, FD, FF, FF, 50, 50, FF, 15, 34, 20, 40, 00, 8B, 3D, 30, 20, 40, 00, 53, 53, 6A, 03, 53, 6A, 01, 68, 00, 00, 00, 80, 8D, 85, 90, FD, FF, FF, 50, FF, D7, 83, F8, FF, 89, 45, FC, 0F, 84, 82, 01, 00, 00, 8D, 85, 8C, FC, FF, FF, 50, 56, FF, 15, 2C, 20, 40, 00, 8D, 85, 94, FE, FF, FF, 50, 53, 68, 58, 20, 40, 00, 8D, 85, 8C, FC, FF, FF, 50, FF, 15, 28...
 
[+]

Entropy:
7.9994

Developed / compiled with:
Microsoft Visual C++

Code size:
1024 Bytes (1,024 bytes)

The file ctxfm102015.exe has been seen being distributed by the following 2 URLs.

http://tc.cch.ca/cchservices/.../download.v3.asp?lng=EN&brd=CTX&session=2ndG1mJC3&key=aeceedd8-a569-46c0-b23e-0b30a159a748&ref=6ndnjnerfmA3dna$$&file=2q1ryrK0XmdiWmtuUzxHL&sz=53332656&type=f&pid=5NTY$&vid=6mtaNnq$$&product=CTX

http://tc.cch.ca/cchservices/.../download.v3.asp?lng=EN&brd=CTX&session=2ndaYotKX&key=81c780ca-b6bd-4109-a9ec-6a914fe69a40&ref=1NDNJNERFMkdDNA$$&file=5QrRYRaqnMDImMTUkZX7b&sz=53332656&type=f&pid=8LQU$&vid=8KQAoLN$$&product=CTX

Scan ctxfm102015.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.