home

exelock.exe

Liao Guobo

This is a setup program which is used to install the application. The file has been seen being downloaded from files.jalantikus.com and multiple other hosts.
Publisher:
kakasoft  (signed by Liao Guobo)

Description:
ExeLock allows you to password protect Windows executable programs.

Version:
5.0.0.10

MD5:
92083cc47c6108fce8c646ebf89ee0bf

SHA-1:
ea6f95b7e7b706a9057d021f0c94bc4855225ab2

SHA-256:
31832b73eed0980a5ff4161bc68868349d9cbe59e0f05fe64f704ed34b46a80a

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
4/18/2024 7:20:13 PM UTC  (today)

Scan engine
Detection
Engine version

Vba32 AntiVirus
TrojanDropper.Injector
3.12.24.3

File size:
1.5 MB (1,529,712 bytes)

Product version:
5.0.0.0

Copyright:
Copyright 2008-2012 KaKaSoft.All rights reserved

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\exelock.exe

Digital Signature
Signed by:
Liao Guobo

Authority:
StartCom Ltd.

Valid from:
11/26/2011 2:44:42 AM

Valid to:
11/27/2013 1:03:59 AM

Subject:
E=support@hoposoft.com, CN=Liao Guobo, L=Shenzhen, S=Guangdong, C=CN, Description=575657-pU7OeW9FKsyh29tD

Issuer:
CN=StartCom Class 2 Primary Intermediate Object CA, OU=Secure Digital Certificate Signing, O=StartCom Ltd., C=IL

Serial number:
04AA

File PE Metadata
Compilation timestamp:
10/30/2012 12:34:53 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:UXiY9E/lZbSXeFUN/GbR7nAOW9YT+DlN420xJDp8mcu5pF68/ri9n6rarJ9F6PRJ:kiY9MlAuFUa9nnkZN420UOH68u9nM06b

Entry address:
0x50EC70

Entry point:
60, BE, 00, 60, 7A, 00, 8D, BE, 00, B0, C5, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89...
 
[+]

Entropy:
7.8838

Packer / compiler:
UPX 2.90LZMA]

Code size:
1.4 MB (1,478,656 bytes)

The file exelock.exe has been seen being distributed by the following 4 URLs.

http://files.jalantikus.com/dde/3668/.../ExeLock.5.0.JalanTikus.exe

http://www.hostingsoftwaredelivery.com/c?x=mznCAL2xqQHuHlyxkYdYNvek0T3uhpL6vje8RAC7bJM=&c=E/0NTGQC5fM4gOmkADtAZzajAdNazjzMsmVEPlBdRlA0FhsQLnKqvU4ZLFAv X0/RS/hmJON5Qh39rzs 0VJyLx47k/gH1sDYNPmtzi4YE5cksvmdvDvXeGxzKoDmZz0D7G1AjYs1WOZFgsOvc7WdQ==&downloadAs=ExeLock Downloader - JalanTikus.exe&fallback_url=http://files.jalantikus.com/dde/3668/.../ExeLock.5.0.JalanTikus.exe

http://www.presenttagnow.com/c?x=YUHWskRKlnHt4iXZe2HhOzuZ6gPLENuuSH/UIXJkKc8=&c=5XK5FytMDVXW70OKplx6iR4P4ol57Dwvbz1rbVVNq/8D9n4fD66PJjh77I8fSfuga9ZhyFa mH47KpRbVFwwwaT7u9wFfNZRDdYa8qjOWcppKvuNkv3GAgp64hvAVXe &downloadAs=ExeLock Downloader - JalanTikus.exe&fallback_url=http://files.jalantikus.com/dde/3668/.../ExeLock.5.0.JalanTikus.exe

http://www.kakasoft.com/.../ExeLock.exe

Scan exelock.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.