home

qitushuaji_setup_2333.exe

奇兔刷机

Shenzhen Qitu Software Technolgy Co., Ltd.

This is a setup program which is used to install the application. The file has been seen being downloaded from www.baidu.com.
Publisher:
深圳市奇兔软件技术有限公司  (signed by Shenzhen Qitu Software Technolgy Co., Ltd.)

Product:
奇兔刷机

Description:
奇兔刷机安装程序

Version:
5.11.2.2333

MD5:
56f974b5ac9d03141b6d681098644241

SHA-1:
e94de67bf3867584682f02e28b9e4dc8e7610338

SHA-256:
155d180f880f876b1e5cd7b81cb6d9dc94bcd5dc2a90ec5cca0993245f35393c

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/18/2024 6:25:12 PM UTC  (today)

File size:
20.2 MB (21,195,016 bytes)

Product version:
5.11.2.2333

Copyright:
Copyright (c) 2014 深圳市奇兔软件技术有限公司。保留所有权利。

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\qitushuaji_setup_2333.exe

Digital Signature
Signed by:
Shenzhen Qitu Software Technolgy Co., Ltd.

Authority:
VeriSign, Inc.

Valid from:
12/11/2012 8:00:00 AM

Valid to:
12/12/2015 7:59:59 AM

Subject:
CN="Shenzhen Qitu Software Technolgy Co., Ltd.", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Shenzhen Qitu Software Technolgy Co., Ltd.", L=Shenzhen, S=Guangdong, C=CN

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
30F8759F4918CF4E5F01C2641B4AB9D9

File PE Metadata
Compilation timestamp:
7/8/2015 9:58:52 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
393216:D94V+6zGHPSpDBQh76JsNL0dePAEgCnf8F31s0Pp9CHieU0076KpeU:D94A+1d/JsCdrEgCna3eM/WNU0oeU

Entry address:
0x14967B0

Entry point:
60, BE, 00, 10, 85, 01, 8D, BE, 00, 00, BB, FE, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89...
 
[+]

Entropy:
7.9880

Packer / compiler:
UPX 2.90LZMA

Code size:
280 KB (286,720 bytes)

The file qitushuaji_setup_2333.exe has been seen being distributed by the following URL.

http://www.baidu.com/cb.php?c=IgF_pyfqnHRYrjmYn1f0IZ0qnfK9ujYkPHR3P1TL0Aw-5HDvnjmdnjf0TAq15HDsnHfdn1D0T1Y1n1RsPHDsmywbP1RkP1bd0AwY5HDYPj6drH6dPWT0IgF_5y9YIZ0lQzqYuh-_ui3LIAt8mv3EuAqLUhuGUAREUyNbpyDETy-YIgPCIy7JpNq1ugwdT7tzn1n1QhN3ufKzujY4rHb0mhYqn0KsTWYs0ZNGujYkPjb4nHDY0AqGujY4njnzr0KWpyfqnHcvnH0L0AqLUWY3P1TLnfKsXHYknjR0mLFW5Hf4nHf3

Scan qitushuaji_setup_2333.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.