home

cxxewr.exe

yuuop

The executable cxxewr.exe has been detected as malware by 26 anti-virus scanners. The file has been seen being downloaded from www.weebly.com.
Product:
yuuop

Version:
1.0.0.0

MD5:
6557732bde97a42491b785c407416812

SHA-1:
dc2e1d199e58ca3033697fbe6034de13a10ed004

SHA-256:
7a3da4ded40c465b49a6d99dfaedb93c00802191de451238a8ea04235257fab9

Scanner detections:
26 / 68

Status:
Malware

Analysis date:
4/23/2024 5:58:59 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.Agent.BLJG
305

Agnitum Outpost
Trojan.Disfa
7.1.1

Avira AntiVirus
TR/Agent.638976.349
8.3.1.6

Arcabit
Trojan.Agent.BLJG
1.0.0.425

avast!
Win32:Malware-gen
2014.9-160405

AVG
Pakes2_c
2017.0.2783

Baidu Antivirus
Trojan.MSIL.Disfa
4.0.3.1645

Bitdefender
Trojan.Agent.BLJG
1.0.20.480

Emsisoft Anti-Malware
Trojan.Agent.BLJG
8.16.04.05.09

ESET NOD32
Generik.NMGLQYS (variant)
10.12098

Fortinet FortiGate
W32/Disfa.HBWA!tr
4/5/2016

F-Secure
Trojan.Agent.BLJG
11.2016-05-04_3

G Data
Trojan.Agent.BLJG
16.4.25

IKARUS anti.virus
Trojan.MSIL.Disfa
t3scan.1.9.5.0

K7 AntiVirus
Riskware
13.2016900

Kaspersky
Trojan.MSIL.Disfa
14.0.0.408

McAfee
RDN/Generic.dx
5600.6439

Microsoft Security Essentials
Trojan:Win32/Skeeyah.A!bit
1.1.11903.0

MicroWorld eScan
Trojan.Agent.BLJG
17.0.0.288

NANO AntiVirus
Trojan.Win32.Disfa.dupxre
0.30.24.3079

nProtect
Trojan.Agent.BLJG
15.08.13.01

Panda Antivirus
Trj/CI.A
16.04.05.09

Sophos
Mal/Generic-S
4.98

Trend Micro
TROJ_GEN.R02KC0DGS15
10.465.05

VIPRE Antivirus
Trojan.Win32.Generic
42904

Zillya! Antivirus
Trojan.Disfa.Win32.35992
2.0.0.2351

File size:
624 KB (638,976 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2015

Original file name:
yuuop.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\roaming\cxxewr.exe

File PE Metadata
Compilation timestamp:
6/14/2015 6:44:47 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
12288:eHZ2CoyZ4RRkYqg51TESoaB7Th1VqQ6TTngycQ1K9n+X:YoYSk5M1IHajDaYW1aS

Entry address:
0x9D05E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.8578

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
620.5 KB (635,392 bytes)

The file cxxewr.exe has been seen being distributed by the following URL.

http://www.weebly.com/uploads/5/5/8/0/.../cxxewr.exe

Remove cxxewr.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.