home

mp160win64111ea23.exe

Canon Inc.

This is a setup program which is used to install the application. The file has been seen being downloaded from letoltom.hu and multiple other hosts.
Publisher:
Canon Inc.  (signed and verified)

MD5:
49fa073b485aff3e5aee2e9391235ede

SHA-1:
9e68ff46975141add9c44b6cbd7e7a2184a6d7af

SHA-256:
065993ba4b60cc8bf3b007a4c5c46d987ce8d8f5726e3e433bc0b8f1a2189453

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/9/2024 8:33:38 AM UTC  (today)

File size:
22.2 MB (23,237,960 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\mp160win64111ea23.exe

Digital Signature
Signed by:
Canon Inc.

Authority:
VeriSign, Inc.

Valid from:
5/18/2009 1:00:00 AM

Valid to:
5/19/2010 12:59:59 AM

Subject:
CN=Canon Inc., OU=Inkjet System Development Center, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Canon Inc., L=Kawasaki-shi, S=Kanagawa, C=JP

Issuer:
CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa (c)04, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
442F9C58B61E1D9833719F449E43668A

File PE Metadata
Compilation timestamp:
7/23/2007 6:30:02 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
393216:yh2MG7hgqTh74iN0hYgBOLVRqFNC6wR/6hip3i4wp50lijNxlRh7ewK/ZxUOi:yQMIhgqThcgxgBOhWN5c5Y1vRh7DpP

Entry address:
0x7EB8

Entry point:
E8, 19, 28, 00, 00, E9, 16, FE, FF, FF, 55, 8B, EC, 83, EC, 20, 53, 33, DB, 39, 5D, 10, 75, 20, E8, A4, 15, 00, 00, 53, 53, 53, 53, 53, C7, 00, 16, 00, 00, 00, E8, 35, 15, 00, 00, 83, C4, 14, 83, C8, FF, E9, 80, 00, 00, 00, 8B, 4D, 0C, 3B, CB, 56, 8B, 75, 08, 74, 21, 3B, F3, 75, 1D, E8, 75, 15, 00, 00, 53, 53, 53, 53, 53, C7, 00, 16, 00, 00, 00, E8, 06, 15, 00, 00, 83, C4, 14, 83, C8, FF, EB, 53, B8, FF, FF, FF, 7F, 3B, C8, 89, 45, E4, 77, 03, 89, 4D, E4, 57, FF, 75, 18, 8D, 45, E0, FF, 75, 14, C7, 45, EC...
 
[+]

Entropy:
7.9989  (probably packed)

Code size:
60 KB (61,440 bytes)

The file mp160win64111ea23.exe has been seen being distributed by the following 16 URLs.

http://letoltom.hu/driver_server.php?a=54924

http://www.techspot.com/drivers/downloadnow/.../?evp=6ed8d9f2fdd00767becd39f9bc2d9716&file=1

http://www.techspot.com/drivers/downloadnow/.../?evp=b9f9adf415e4f8d287a2e784ef512b54&file=1

http://www.techspot.com/drivers/downloadnow/.../?evp=0916bf02c1be30399289b475868dae34&file=1

http://www.techspot.com/drivers/downloadnow/.../?evp=67eb2e6af7f3f14bd36f3ea6c37e87da&file=1

http://www.techspot.com/drivers/downloadnow/.../?evp=3589aea352ea3d647eb267168f709d7b&file=1

http://ec.ccm2.net/br.ccm.net/download/.../mp160win64111ea23.exe

http://www.techspot.com/drivers/downloadnow/.../?evp=91e732b318425e6b223e571227a97a6c&file=1

http://www.techspot.com/drivers/downloadnow/.../?evp=533110cc46ed5462825eedd275dcf170&file=1

http://pdisp01.c-wss.com/.../WWUFORedirectTarget.do?id=MDkwMDAwMjExMzA0&cmp=ACB&lang=EN

http://www.techspot.com/drivers/downloadnow/.../?evp=01767b771277d7ae0695ac871a34b069&file=1

http://pdisp01.c-wss.com/.../WWUFORedirectTarget.do?id=MDkwMDAwMjExMzA0&cmp=ABR&lang=EN

http://pdisp01.c-wss.com/.../WWUFORedirectTarget.do?id=MDkwMDAwMjExMzA0&cmp=ACY&lang=EN

http://gdlp01.c-wss.com/gds/3/0900002113/.../mp160win64111ea23.exe

http://printera.at.ua/.../0-0-1-38-20

http://files.canon-europe.com/files/soft35929/.../mp160win64111ea23.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.