home

Vivox.HDN.Up.exe

Bobsled by T-Mobile

Vivox Inc.

It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘VivoxHDN’. The file has been seen being downloaded from d2xj26462na9l3.cloudfront.net.
Publisher:
Vivox  (signed by Vivox Inc.)

Product:
Bobsled by T-Mobile

Description:
Bobsled by T-Mobile Software Manager

Version:
1.20.3.17353

MD5:
0dcef41acfa4c5b98ece120240f783b7

SHA-1:
767baa7e69461397e7e87668f9cf3d24033a4094

SHA-256:
ccf85eb893041ad2e51a83a70be03d203f4da1ed3a8530e6b048c7924b4ca8b1

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 10:30:03 PM UTC  (today)

File size:
33.5 MB (35,094,416 bytes)

Product version:
1.20.3.17353

Copyright:
Copyright © Vivox 2011

Original file name:
Vivox.HDN.Up.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\vivox\hdn\current\vivox.hdn.up.exe

Digital Signature
Signed by:
Vivox Inc.

Authority:
Thawte, Inc.

Valid from:
8/18/2010 3:00:00 AM

Valid to:
8/18/2012 2:59:59 AM

Subject:
CN=Vivox Inc., O=Vivox Inc., L=Natick, S=Massachusetts, C=US

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
1591E4DDD6D6D0200607FFAD2BBCF386

File PE Metadata
Compilation timestamp:
6/22/2012 8:41:44 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
786432:xWhzrRpO+Yf35cTGpAdRB4M/QtDYCeAbdTM15NucNDrs5wxIbWlaVHMhGjIdCf0/:xWhz6+YfOdRacAhY5Nrfs5IMWSf9IkhW

Entry address:
0x20B61EE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 03, 00, 03, 00, 00, 00, 28, 00, 00, 80, 0E, 00, 00, 00, E8, 00, 00, 80, 10, 00, 00, 00, 00, 01, 00, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 16, 00, 02, 00, 00, 00, 18, 01, 00, 80, 03, 00, 00, 00, 30, 01, 00, 80, 04, 00, 00, 00, 48, 01, 00, 80, 05, 00, 00, 00, 60, 01, 00, 80, 06, 00, 00, 00, 78, 01, 00, 80, 07, 00, 00, 00, 90, 01, 00, 80, 08, 00, 00, 00, A8, 01...
 
[+]

Entropy:
7.2861

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
32.7 MB (34,292,224 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
VivoxHDN

Command:
"C:\users\{user}\appdata\local\vivox\hdn\current\vivox.hdn.up.exe" \d


The file Vivox.HDN.Up.exe has been seen being distributed by the following URL.

https://d2xj26462na9l3.cloudfront.net/vring/plugins/hdn/.../Bobsled by T-Mobile-1.20.3.17353.exe

Scan Vivox.HDN.Up.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.