home

NXPowerLiteSetup61_2.exe

NXPowerLite Desktop 6

Neuxpower Solutions Ltd

This is a setup program which is used to install the application. The file has been seen being downloaded from www.vaultsfarmhosting.com and multiple other hosts.
Publisher:
Neuxpower Solutions Ltd  (signed and verified)

Product:
NXPowerLite Desktop 6

Description:
NXPowerLite™ - Optimize Microsoft Office, PDF, JPEG and ZIP files

Version:
6.1.2

MD5:
13b1128890664cfa220546253d7da196

SHA-1:
85ccb51abbe62b9dc8b25324b4138a9e124df694

SHA-256:
370a7f5f888d87f9cef2986788bf1f8093623d3169b3f77539c172f7c3e0340e

Scanner detections:
2 / 68

Status:
Clean  (2 probable false positive detections)

Explanation:
These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:
5/21/2024 9:01:51 PM UTC  (today)

Scan engine
Detection
Engine version

Vba32 AntiVirus
TrojanDropper.Agent
3.12.26.3

Zillya! Antivirus
Dropper.Agent.Win32.169667
2.0.0.2109

File size:
20.6 MB (21,630,848 bytes)

Product version:
6.1.2

Copyright:
Copyright (C) NXPowerLite Desktop 6

Original file name:
NXPowerLiteSetup61_2.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\nxpowerlitesetup61_2.exe

Digital Signature
Signed by:
Neuxpower Solutions Ltd

Authority:
VeriSign, Inc.

Valid from:
11/13/2013 11:00:00 AM

Valid to:
1/12/2017 10:59:59 AM

Subject:
CN=Neuxpower Solutions Ltd, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Neuxpower Solutions Ltd, L=London, S=London, C=GB

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
7F174823BB635C5E91C2CAF38EE3F287

File PE Metadata
Compilation timestamp:
12/21/2012 2:26:49 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
393216:s5QNaHp0zoYYYgEUhX5ApPXoF+Z/UAWXnHJ+hp4I5YopTMTMxr26+sMuhzq6a:lNW/Rtpg++ZlTYh67dN+sVhXa

Entry address:
0x2F62E

Entry point:
E8, 2A, 9F, 00, 00, E9, 79, FE, FF, FF, 8B, FF, 55, 8B, EC, 8B, 55, 08, 53, 56, 57, 33, FF, 3B, D7, 74, 07, 8B, 5D, 0C, 3B, DF, 77, 1E, E8, 81, 3A, 00, 00, 6A, 16, 5E, 89, 30, 57, 57, 57, 57, 57, E8, 0A, 3A, 00, 00, 83, C4, 14, 8B, C6, 5F, 5E, 5B, 5D, C3, 8B, 75, 10, 3B, F7, 75, 07, 33, C0, 66, 89, 02, EB, D4, 8B, CA, 0F, B7, 06, 66, 89, 01, 41, 41, 46, 46, 66, 3B, C7, 74, 03, 4B, 75, EE, 33, C0, 3B, DF, 75, D3, 66, 89, 02, E8, 38, 3A, 00, 00, 6A, 22, 59, 89, 08, 8B, F1, EB, B3, 8B, FF, 55, 8B, EC, 83, EC...
 
[+]

Entropy:
7.9649  (probably packed)

Code size:
268.5 KB (274,944 bytes)

The file NXPowerLiteSetup61_2.exe has been seen being distributed by the following 5 URLs.

http://www.vaultsfarmhosting.com/c?x=yDX29qZkbae8Mzy9uTtHgcgpm8PASHJLwk6TQXuFt M=&c=9qPbkbHaLWLiMz83vGEf x wtZDbzHfjjG3/5uq8HDGJB/syablkhAhGIGH0Cm2vV2Q5MFbkwXdykNyvgcPxH6qYePcctIzFyHEOa9QuqmDn20lpC2MSOZEfTb4I2rjqGyA/SBYPULtj6/yGsRhAOFYJyGxFUrvo6F4FW3nrERk=&e=0&downloadAs=nxpowerlite-6.1.2.exe&fallback_url=http://pf.benjaminstrahs.com/s/1468071916/es/8/.../81261-1802294-nxpowerlite.exe

http://gsf-cf.softonic.com/85c/cb5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69687292&instance=softonic_en&type=PROGRAM&Expires=1436237035&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=coXs0ImPMbDbHxAWhwuNS1Aka6qE2yvhIuUecoabuR3~g5qPz0DDi-Ww~KMOK3NeBqIdnAc7Osc8l6owgVRgrhpanp7i4PFPbtc5UZSV4rF1xezBVEmsPCs3qA8PspvY0Xj7A2Hl8RBHEPBtPx3REp8yGzWUFUEX~j06NMHbuOg_&filename=NXPowerLiteSetup61_2.exe

http://www.universequicksigns.com/c?x=Ig0rm/0lsVlkAkbKSw502DG7VQM4OfcM0xTDbkzV4o8=&c=mjzoKF941/j0EjOKkQUIh5InXB6XmQf8jDdQCHHwzov7JR/R/73P3BJ6zaZ0kN 6MeL jy/f1NauE5bLob2ucGrlFAAqqMneNgJlWcC9HigxAzpJAIsPTTcGb3yGymrGim/NPRx9JrOyWyBD0DdHbw==&e=0&downloadAs=nxpowerlite-6.1.2.exe&fallback_url=http://pf.benjaminstrahs.com/s/1463714674/es/8/.../81261-1802294-nxpowerlite.exe

http://www.cyclecleansign.com/c?x=uvpEQv/l8rDub5DA1L4V67ogPr6/cQn4YKbB wX4KYo=&c=WPKeYxNsBseDx3XAvzeF4sAzGbBy34hDLexbbG3MOw8LNdgLSdVQm1T/6vRxXSxUaNBrvo35Gllc9zsoJj7NNYLYv8fmjUd43fZEhwNKUubXuI4UXLQAixmkT0DbrRk5qjUku/lpH4Ki0Cq D N4XEi51 16nhhgh5worKzv6vrBh4S7wAdZjG or0JtCafd&e=0&downloadAs=nxpowerlite-6.1.2.exe&fallback_url=http://pf.benjaminstrahs.com/s/1462394981/es/8/.../81261-1802294-nxpowerlite.exe

http://www.vaultsheadcentral.com/c?x=5wpUYoSfOIcI0H90ktXQ65Ufd7 4dYwPKvdM8SJzyu0=&c=FxVF5 4swXr pt4vyVGy3vWLlLjVi1dSGOuc/hCKD 3QJQVeeH/Nw5Esktw4SXRdyEYY9F3EabZsDcN7rDUk0SVmEZIptdiIZ4qdvr33HpbdqbhNBcDBqEAWHaJcHEp9QDFOMyDIMnvHkcpD1PAizQ==&e=0&downloadAs=nxpowerlite-6.1.2.exe&fallback_url=http://pf.benjaminstrahs.com/s/1458252557/es/8/.../81261-1802294-nxpowerlite.exe

Scan NXPowerLiteSetup61_2.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.