home

saveaspdfandxps.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from download.microsoft.com.
MD5:
1806dbb632a4ec3971a2e13d137aaf2f

SHA-1:
a7e891116108ae7aeb9ddb0135afd538f8218d98

SHA-256:
46321bd7ce68e14c7da359c87cd873c08e742248e20ad216b67d4c635872e491

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 6:56:09 PM UTC  (today)

File size:
934.7 KB (957,128 bytes)

File type:
Executable application (Win64 EXE)

Common path:
C:\users\{user}\downloads\saveaspdfandxps.exe

File PE Metadata
OS bitness:
Win64

CTPH (ssdeep):
12288:odLOhAuj/kUc9OZffZ5n2xxSyE0oJWxC+0djI3mUYpjc02QZzC0LgzO7ewdYr57u:vhhY43kJk+0TUmPrqbwuBAFZ

Entry point:
DB, 00, 00, 00, 00, 00, 15, 20, 8B, DC, E5, C2, 35, 0D, 88, 2D, 4A, 6E, DC, 97, 01, E3, C9, FF, 33, 1F, C0, 80, 2B, F6, 64, 85, EE, D9, F1, AC, 51, 92, C5, 28, 97, 18, 62, 4B, B2, 29, 2B, B0, E4, F7, 6E, 13, B2, BE, 8B, 43, 12, B7, 23, E7, 05, 98, 86, 2A, 32, A5, 5F, 44, 7A, 1D, FA, 39, 4B, 1C, E2, BC, CA, BC, 68, 8D, D5, AA, 60, 37, 54, 47, 49, 03, DE, 7E, 04, 50, 0E, 16, ED, 5D, CF, 3C, D1, 0F, 66, CE, AB, 5C, 29, 68, F9, F7, 50, DA, B5, F4, A3, 4A, 6A, 51, 92, 78, A3, 8D, 89, B6, 42, FA, 72, 49, A8, 0A...
 
[+]

The file saveaspdfandxps.exe has been seen being distributed by the following URL.

http://download.microsoft.com/download/5/0/b/.../SaveAsPDFandXPS.exe

Scan saveaspdfandxps.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.