update71236.exe

X-Lite_Installer

CounterPath Corporation

This is a setup and installation application. The file has been seen being downloaded from www.lo4d.com and multiple other hosts.
Publisher:
CounterPath Corporation   (signed by CounterPath Corporation)

Product:
X-Lite_Installer

Description:
X-Lite_Installer Setup

MD5:
bc02de157fad377dfd341e4d4a687f40

SHA-1:
735611beb556daeb1e249a5385f2234754d0706a

SHA-256:
d968e8842a3a016e8f7e0372996b1f39761e0bc2a0d089f24bb9c39993b4b770

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
4/25/2024 11:30:10 AM UTC  (today)

Scan engine
Detection
Engine version

Rising Antivirus
PE:Trojan.Win32.NetFilter.a!1075334147
23.00.65.131225

File size:
43.7 MB (45,781,544 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Documents and Settings\{user}\Local settings\temp\{random}.tmp\x-lite\update71236.exe

Digital Signature
Authority:
VeriSign, Inc.

Valid from:
1/30/2012 9:00:00 PM

Valid to:
2/12/2014 8:59:59 PM

Subject:
CN=CounterPath Corporation, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=CounterPath Corporation, L=Vancouver, S=British Columbia, C=CA

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
5E680F7C7366DB8716BF753E73BD5852

File PE Metadata
Compilation timestamp:
10/9/2012 5:48:22 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
786432:81XYioSXiDO6lVhOA/d21qVRcVd3dNyYXHPv+iXQmRa6R0OayriQsw/mxTL8g6:89d9XiDbjVF2c7cVPNyYHPv+POa0pqu

Entry address:
0xF3BC

Entry point:
55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, 64, ED, 40, 00, E8, E8, 71, FF, FF, 33, C0, 55, 68, 89, FA, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 45, FA, 40, 00, 64, FF, 32, 64, 89, 22, A1, 48, 3B, 41, 00, E8, BE, F7, FF, FF, E8, 65, F3, FF, FF, 8D, 55, EC, 33, C0, E8, F7, C3, FF, FF, 8B, 55, EC, B8, 4C, 66, 41, 00, E8, 6A, 58, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 4C, 66, 41, 00, B2, 01...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
59 KB (60,416 bytes)

The file update71236.exe has been seen being distributed by the following 17 URLs.

http://www.lo4d.com/get-file/x-lite/.../

http://gsf-cf.softonic.com/735/611/.../file?SD_used=0&channel=WEB&fdh=no&id_file=42633&instance=softonic_en&type=PROGRAM&Expires=1439968886&Signature=iSZhG6YNXsUsm~00gi~1Wyw4Kr6evhTonGuNY4u99mFZdOxitmopJwD6IKogAtptOze8hSwp~0aR7Z68Zp~EPlxYOC5oE1liJRxXD6dyNfkjT1ZFVQxwjVjXL52M9sxdBFkX9irUP1ghwe3epr2AAfjJCPaNpXzdo7s7A1HQxlk_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=X-Lite_Win32_4-5-5-_71236.exe

http://gsf-cf.softonic.com/735/611/.../file?SD_used=0&channel=WEB&fdh=no&id_file=42633&instance=softonic_en&type=PROGRAM&Expires=1446529284&Signature=hFt3TjpnHYNNzZENa-X3Uf9POjy7wa46jYmJJKgGUNkuny~-UhUcTnpZXCdfM~tSaeG9oGpNu28g9D4x~F~hNIazKQQblkB2TE7Md1n9cMntWpblDOi-WfRzG1dgY21be-dAr3DZV0cJlS8vL6rkINyoX4sowW9WK7a3kOZ9jk8_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=X-Lite_Win32_4-5-5-_71236.exe

http://gsf-cf.softonic.com/735/611/.../file?SD_used=0&channel=WEB&fdh=no&id_file=42633&instance=softonic_en&type=PROGRAM&Expires=1440501128&Signature=cCcFwOnhX5GNEqqu8LXVTwRmoqEa7Tq2EFECfNp9wMMLN-ma9TFVI6-oJ9lVm9fCBF8z-B1SWRnKcJR-P5-q0W3saAMN67GkFbxpD-prC~3P-MEd6bc75-DJA5EWM2nUjAenlYoIxU~g7yaO0p68B5Xynw2xjEAtB64iA4W9z9s_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=X-Lite_Win32_4-5-5-_71236.exe

http://gsf-cf.softonic.com/735/611/.../file?SD_used=0&channel=WEB&fdh=no&id_file=42633&instance=softonic_en&type=PROGRAM&Expires=1443431652&Signature=UebtzXHtQzoMIH8xv-RCb4lTAn~fKDfH2kuSJv2z2QUV7M5wLC3YiWtv20Q2THDRdOD8Pai14I9JmbKc-aRB2HaMvyFwP9aZLVR4rAPUJWocoeFHmguGA01RRcnt-Aoa86gtPP3SEULGn16d9S0DqjoB2ub6JEigE43N-W~r1Jg_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=X-Lite_Win32_4-5-5-_71236.exe

http://gsf-cf.softonic.com/735/611/.../file?SD_used=0&channel=WEB&fdh=no&id_file=42633&instance=softonic_en&type=PROGRAM&Expires=1439027140&Signature=ChUGaQHGYz7kfaQh~3r9h1eQhwM0CNaSJWZiuDrZgc5JBBkJ-5uT2pz5HKVMvW~TMCUPw2Id~DDN6EhqTbZIlsaeIjM8~InRq3Bqccb3uxULB6l~VFBC-9bE9-RZbDYFGfbeVV2WY4tkJzXf6moU6SiC4ev6HWj8GG4uqG4W2BU_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=X-Lite_Win32_4-5-5-_71236.exe

http://gsf-cf.softonic.com/735/611/.../file?SD_used=0&channel=WEB&fdh=no&id_file=42633&instance=softonic_fr&type=PROGRAM&Expires=1452652665&Signature=JJ5HGG-l574tH3-ClvIfWUMmfiE~Xz1ZfLJuOR5APszmhqnzf21OI~qBpqELkUirTRGRa8~eqr93PmT-rci7NKpvYp3WX~1LNy12R5X~yDnptRqaNKIm56sE6Yj85k3KN5c8zwl6VALICjyMTKSJHKeJPJDTft7cJuSQbclzm6g_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=X-Lite_Win32_4-5-5-_71236.exe

http://dl.cdn.chip.de/downloads/.../X-Lite_Win32_4.5.5._71236.exe

http://gsf-cf.softonic.com/735/611/.../file?SD_used=0&channel=WEB&fdh=no&id_file=42633&instance=softonic_en&type=PROGRAM&Expires=1434052540&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=KKtl79Gqd4h~9OcMsPb9KDxUntESpGWqwRV-hIvGHHkMUWS7Bd0h0U5sVZfDtbqWlUlcfxE9R7imUns2db9bIM8DLd8CUIvXt8R0vvvfRQ4MkHt4kMd2yhbB1fAJmeaqm76rehqUkpu0AxE-PekiXK1T-cJoEA5dJM7HIiNlSJE_&filename=X-Lite_Win32_4-5-5-_71236.exe

Scan update71236.exe - Powered by Reason Core Security