home

lenovophotomaster_2.1.59456.3330.emodule_patch_php151008-02_normal.exe

CyberLink Corp.

This is a setup program which is used to install the application. The file has been seen being downloaded from liveupdate.cyberlink.com and multiple other hosts.
Publisher:
CyberLink Corp.  (signed and verified)

MD5:
1c6615ce0e3f887ca1ba708f7047a3f7

SHA-1:
ec3e5da32f7fc1463d2146b75e2b5a2a9eb93d36

SHA-256:
a5cb80e2d1f7757e7bf918499c4f56b1f9a012baa5b43ff92022f75a5dca907b

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/16/2024 9:11:26 PM UTC  (today)

File size:
36.3 MB (38,064,392 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\cyberlink\photomaster\patch\lenovophotomaster_2.1.59456.3330.emodule_patch_php151008-02_normal.exe

Digital Signature
Signed by:
CyberLink Corp.

Authority:
Symantec Corporation

Valid from:
3/4/2015 4:00:00 PM

Valid to:
5/3/2018 4:59:59 PM

Subject:
CN=CyberLink Corp., O=CyberLink Corp., L=New Taipei City, S=Taiwan, C=TW

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
2CD2C5777BFC596CE3F6EBFDFB9B9469

File PE Metadata
Compilation timestamp:
6/9/2012 6:19:49 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
786432:bxIu1QgmPO7T9dJzStjOAZ89RnUnmMVwQQtxurNydHCfC+YEYT90NXGXVQ:tqdPOl+tjbZ89RUTiuNydHIC+lqKAQ

Entry address:
0xAC87

Entry point:
E8, E3, FE, FF, FF, 33, C0, 50, 50, 50, 50, E8, 9F, 30, 00, 00, C3, 56, 57, 8B, 7C, 24, 0C, 8B, F1, 8B, CF, 89, 3E, E8, 8F, AB, FF, FF, 89, 46, 08, 89, 56, 0C, 8B, 87, 24, 0C, 00, 00, 89, 46, 10, 5F, 8B, C6, 5E, C2, 04, 00, 8B, C1, 8B, 08, 8B, 50, 10, 3B, 91, 24, 0C, 00, 00, 75, 0D, 6A, 00, FF, 70, 0C, FF, 70, 08, E8, 0E, B1, FF, FF, C3, 56, 8B, F1, 8B, 06, 85, C0, 74, 07, 50, FF, 15, C4, 40, 41, 00, 83, 26, 00, 83, 66, 08, 00, 83, 66, 0C, 00, 5E, C3, 56, 8B, F1, 80, 7E, 04, 00, 75, 34, 68, F4, 44, 41, 00...
 
[+]

Entropy:
7.9989  (probably packed)

Code size:
73 KB (74,752 bytes)

The file lenovophotomaster_2.1.59456.3330.emodule_patch_php151008-02_normal.exe has been seen being distributed by the following 2 URLs.

https://liveupdate.cyberlink.com/b/a/r?PRODUCTNAME=PhotoPlus&PRODUCTVERSION=2.0&VERSIONTYPE=LE&CHANNEL=OEM&LANGUAGE=ENU&OSREGION=0xa7&SYSTEMLOCALE=0x4409&BU=CLT&MAJORVER=2&MINORVER=1&BUILDNO=3024&VENDORNAME=6637&SR=PHP150420-01&DEVICE=&BBProductId=327&BBProdVerId=1202&BBProdVerTypeId=5133&BBnChannel=1&BBnLangId=1&BBnOSRegion=128&BBnLocale=0&APREGID=5ebf87e5582c0d42ccf86e018dc3ba58&SRTYPE=OEM&DAY_LEFT=0&IsNewBB=1&AB=0&FIRSTLAUNCHDATE=2016/01/01&SuiteName=&SuiteVer=&SuiteVtype=&RENEWALTYPEID=-1&RATEPLANID=-1&STORAGEPLAN=-1&ADMODE=&PATTERNID=1401023&BB_ID=91253&TEST_NO=1-1&INTERVAL=0&TypeId=1&PatchType=0&Category=Download&URL=https://update.cyberlink.com/OEM/Patch/PhotoPlus/.../LenovoPhotoMaster_2.1.59456.3330.eModule_Patch_PHP151008-02_Normal.exe&UUID=S-1-5-21-1242345367-1301860180-1312644315-1001-F0FD7FF2-2F92-418F-883B-88E5C2011A41

https://liveupdate.cyberlink.com/b/a/r?PRODUCTNAME=PhotoPlus&PRODUCTVERSION=2.0&VERSIONTYPE=LE&CHANNEL=OEM&LANGUAGE=ENU&OSREGION=0x6f&SYSTEMLOCALE=0x3809&BU=CLT&MAJORVER=2&MINORVER=1&BUILDNO=3024&VENDORNAME=6637&SR=PHP150420-01&DEVICE=&BBProductId=327&BBProdVerId=1202&BBProdVerTypeId=5133&BBnChannel=1&BBnLangId=1&BBnOSRegion=84&BBnLocale=0&APREGID=3c04222fa4602b879d9a1b07ee96afd2&SRTYPE=OEM&DAYLEFT=0&IsNewBB=1&AB=0&FIRSTLAUNCHDATE=2016/01/09&SuiteName=&SuiteVer=&SuiteVtype=&RENEWALTYPEID=-1&RATEPLANID=-1&STORAGEPLAN=-1&ADMODE=&PATTERNID=1401023&BB_ID=91253&TEST_NO=1-1&INTERVAL=0&TypeId=1&PatchType=0&Category=Download&URL=https://update.cyberlink.com/OEM/Patch/PhotoPlus/.../LenovoPhotoMaster_2.1.59456.3330.eModule_Patch_PHP151008-02_Normal.exe&UUID=S-1-5-21-2066941001-3576198039-4236707757-1001-C7A840D2-79C9-4C03-BC4E-58945041986A

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.