home

launcher.exe

CHINA CITIC BANK CORPORATION LIMITED

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘CITICibnkmt’.
Publisher:
CHINA CITIC BANK CORPORATION LIMITED  (signed and verified)

MD5:
4aa7cbbd17b5c437ac7e7024a68f6244

SHA-1:
9163f8dcb03a0a08e138a5dfd73956b21795f403

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/19/2024 10:08:02 PM UTC  (today)

File size:
209.4 KB (214,416 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\cncb\perciticmate\launcher.exe

Digital Signature
Signed by:
CHINA CITIC BANK CORPORATION LIMITED

Authority:
VeriSign, Inc.

Valid from:
4/27/2010 8:00:00 AM

Valid to:
6/27/2011 7:59:59 AM

Subject:
CN=CHINA CITIC BANK CORPORATION LIMITED, OU=Information Technology Dept., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=CHINA CITIC BANK CORPORATION LIMITED, L=Beijing, S=Beijing, C=CN

Issuer:
CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
6584FB6CD6EDA5436F3D4F39C0E4D2A6

File PE Metadata
Compilation timestamp:
8/10/2010 7:12:10 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
1536:LSPuzONco+ghWUN8PIBw0OO4jNCqNpydpoa7C5:LSPWONWUsINO/8qNsdp5A

Entry address:
0x20C3

Entry point:
E8, 7E, 04, 00, 00, E9, 36, FD, FF, FF, CC, FF, 25, FC, 30, 40, 00, FF, 25, F8, 30, 40, 00, CC, CC, 68, 35, 21, 40, 00, 64, FF, 35, 00, 00, 00, 00, 8B, 44, 24, 10, 89, 6C, 24, 10, 8D, 6C, 24, 10, 2B, E0, 53, 56, 57, A1, 18, 40, 40, 00, 31, 45, FC, 33, C5, 50, 89, 65, E8, FF, 75, F8, 8B, 45, FC, C7, 45, FC, FE, FF, FF, FF, 89, 45, F8, 8D, 45, F0, 64, A3, 00, 00, 00, 00, C3, 8B, 4D, F0, 64, 89, 0D, 00, 00, 00, 00, 59, 5F, 5F, 5E, 5B, 8B, E5, 5D, 51, C3, FF, 74, 24, 10, FF, 74, 24, 10, FF, 74, 24, 10, FF, 74...
 
[+]

Entropy:
3.7805

Code size:
8 KB (8,192 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
CITICibnkmt

Command:
C:\Program Files\cncb\perciticmate\launcher.exe -\perbs


Scan launcher.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.