Malware scan of upqing.exe c7f918e4caaf8e4e61 - herdProtect
upqing.exe
Zhuhai Kingsoft Office Software Co.,Ltd
upqing.exe
Publisher:&&(signed and verified)
Version:9,1,0,4715
MD5:6bc23ffd77f7aae1a9c3a
SHA-1:c7f918e4caaf8e4e61
SHA-256:ceacb77c15e13a33a308c970eaae40e189c501ed6
Scanner detections:3 / 68
Status:Clean&&(3 probable false positive detections)
Explanation:These detections are probably false positives (erroneous), the file is probably malware free.
Analysis date:7/14/:41 AM UTC&&(five months ago)
Scan engineDetectionEngine version
The HackerPosible_Worm326.8.0.5.470
Trend Micro House CallSuspicious_GEN.F47V06307.2.195
Vba32 AntiVirussuspected of Trojan.Downloader.gen.h3.12.26.3
File size:90.9 KB (93,032 bytes)
Product version:9,1,0,4715
Original file name:upqing.exe
File type:Executable application (Win32 EXE)
Common path:C:\users\user\appdata\roaming\kingsoft\qing\update\upqing.exe
Signed by:
Authority:VeriSign, Inc.
Valid from:2/19/:00 AM
Valid to:4/20/:59 AM
Subject:CN=&Zhuhai Kingsoft Office Software Co.,Ltd&, OU=RD Department, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=&Zhuhai Kingsoft Office Software Co.,Ltd&, L=Zhuhai, S=Guangdong, C=CN
Issuer:CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at /rpa (c)10, OU=VeriSign Trust Network, O=&VeriSign, Inc.&, C=US
Serial number:404BDAD0A11EFAF5CC25B
Compilation timestamp:6/16/:11 PM
OS version:5.1
OS bitness:Win32
Subsystem:Windows GUI
Linker version:10.0
CTPH (ssdeep):1536:xlyXId1rSsPLZMHNWaRJHWhVMYniawCi98D9U0EWTe+l/4ySuTfu:xlyX+DCtjWhmARtZXlPjTfu
Entry address:0x35000
Entry point:60, BE, 00, 10, 42, 00, 8D, BE, 00, 00, FE, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, EF, 75, 09, 8B, 1E, 83, EE, FC, 11, DB, 73, E4, 31, C9, 83, E8, 03, 72, 0D, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 74, 89, C5, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, 75, 20, 41, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB...&[+]
Entropy:7.8354
Packer / compiler:UPX v0.89.6 - v1.02 / v1.05 -v1.24
Code size:84 KB (86,016 bytes)
There are numerous known code variantions that share the same compilation structure.
4 / 68&&&&&&(inconclusive)&&9,1,0,4856&&(6d1f78a1c0c67f0aa67)
0 / 68&&9,1,0,4855&&(bac97edafa237f0e4ba633c494f06)
0 / 68&&9,1,0,4855&&(8f25fd5bf28cf6cbf00d8b04cc740)
0 / 68&&9,1,0,4847&&(6b295e475abce00ea877)
0 / 68&&9,1,0,4843&&(912d3ee8b29ba3eae7f43ccc261e3fa)
0 / 68&&9,1,0,4843&&(8f7efbece96aae938b955e)
3 / 68&&9,1,0,4842&&(871ccfacab2b894a3c1e7e)
2 / 68&&9,1,0,4842&&(ec05b4ea6f233ab3de658f0656bc4a)
0 / 68&&9,1,0,4793&&(34bcfba94c1aea13ca5c7a4141946ec)
6 / 68&&&&&&(inconclusive)&&9,1,0,4764&&(98ed1fc5ca99646da3faa08e9e5d4f2a1c0ac7f2)
0 / 68&&9,1,0,4746&&(ae1bb881c71f9aaa74f8b)
2 / 68&&9,1,0,4739&&(ab40bffd9aa)
0 / 68&&9,1,0,4716&&(c25e43d4c9f2d2d5cfdd2)
5 / 68&&&&&&(inconclusive)&&9,1,0,4716&&(11aa22bbfbc54575cd)
4 / 68&&&&&&(inconclusive)&&9,1,0,4567&&(260ac4a5cf0f75f386e5a3e31d93fc9)
0 / 68&&(8b0b5fc)
0 / 68&&(7b938ae43edce451859)
0 / 68&&(e9caca97ceaa50ad0ef37eef8c37b)
0 / 68&&(2a000be83acccb9b1bff3b536ffe)
0 / 68&&(e638e9aa2b1b565c96b3d1b366de)
0 / 68&&(cc5fdfb2eb7de1faa74e6)
0 / 68&&(ba4c9c8babf3a344bed26ac018e37fb1b9ff620f)
0 / 68&&(fc66a5ef14bd1d4ce0e020)
0 / 68&&(c533d5e46c7a15d9edf3)
0 / 68&&(82c2bad117debd24601a)
0 / 68&&(9f728b6ed3aeba95faef41)
0 / 68&&(d1ab7e0ff9cdfd0b27d068c4bfb2c712)
0 / 68&&(1790fde0e61f61dcb9b9)
0 / 68&&(af041ca7f66bdadd0c9cd2)
0 / 68&&(1f0d817cb6af16dca8f5a2c144260)
0 / 68&&(1f4f379dfcda7b71d857fa92dbfb91e1b7eac055)
Distribution by Country1, You can UPLOAD any files, but there is 20Mb limit per file. 2,
VirSCAN supports Rar/Zip decompression, but it must be less than 20 files. 3, VirSCAN can scan compressed files with password 'infected' or 'virus'.
Portuguese Brazil
Русский
укра?нська
Nederlands
Espa?ol (Latin America)
Server load
File information
File Name :
(File not down)
File Size :93032 byte
File Type :application/x-dosexec
Scanner results
Scanner results:<font color="#%Scanner(s) (3/38)found malware!
Time: <font color="#14-06-26 14:47:04 (CST)
Engine Ver
Scan result
Found nothing
7.11.156.220
Found nothing
Found nothing
Found nothing
Found nothing
Found nothing
Found nothing
4.1.3.52192
Found nothing
Found nothing
bitdefender
Found nothing
Found nothing
Found nothing
5.0.2.3300
Found nothing
Found nothing
6.5.1.5418
Found nothing
Found nothing
Found nothing
Found nothing
Found nothing
Found nothing
Found nothing
Found nothing
Found nothing
Found nothing
Found nothing
9.500-1005
Found nothing
Found nothing
Found nothing
25.19.00.04
25.19.00.04
Found nothing
Found nothing
3.9.2592.2
3.9.2592.2
Found nothing
Found nothing
Found nothing
17.47.17308
1.0.2.2108
Found nothing
virusbuster
15.0.827.0
Found nothing
■Heuristic/Suspicious ■Exact
NOTICE: Results are not 100% accurate and can be reported as a false positive by some scannerswhen and if malware is found. Please judge these results for yourself.
Copy to clipboard
File upload
Please not close this windows,
If you do not have to upload response time, make sure you upload files less than 20M
You can view the results of the last scan or rescan1, You can UPLOAD any files, but there is 20Mb limit per file. 2,
VirSCAN supports Rar/Zip decompression, but it must be less than 20 files. 3, VirSCAN can scan compressed files with password 'infected' or 'virus'.
Portuguese Brazil
Русский
укра?нська
Nederlands
Espa?ol (Latin America)
Server load
Same MD5 files scan history
File Size:92504 byte
File Type:PE32 executable for MS Windows (GUI) Intel 80386 32-bit
Scan Result
Check Date
Detect Rate
File upload
Please not close this windows,
If you do not have to upload response time, make sure you upload files less than 20M
You can view the results of the last scan or rescan1, You can UPLOAD any files, but there is 20Mb limit per file. 2,
VirSCAN supports Rar/Zip decompression, but it must be less than 20 files. 3, VirSCAN can scan compressed files with password 'infected' or 'virus'.
Portuguese Brazil
Русский
укра?нська
Nederlands
Espa?ol (Latin America)
Server load
File information
File Name :
(File not down)
File Size :117608 byte
File Type :application/x-dosexec
Scanner results
Scanner results:<font color="#%Scanner(s) (4/39)found malware!
Time: <font color="#14-10-18 22:19:18 (CST)
Engine Ver
Scan result
Found nothing
7.11.179.100
Found nothing
Found nothing
Found nothing
9.0.0.4157
9.0.0.4157
Found nothing
Found nothing
Found nothing
4.1.3.52192
Found nothing
Found nothing
bitdefender
Found nothing
Found nothing
Found nothing
5.0.2.3300
Found nothing
23.008, 23.008
Found nothing
6.5.1.5418
Found nothing
Found nothing
Found nothing
Found nothing
V1.32.31.0
Found nothing
Found nothing
Found nothing
Found nothing
Found nothing
Found nothing
Found nothing
9.500-1005
Found nothing
Found nothing
Found nothing
Found nothing
25.17.00.04
25.17.00.04
Found nothing
Found nothing
3.9.2589.2
3.9.2589.2
Found nothing
Found nothing
Found nothing
17.47.17308
1.0.2.2108
virusbuster
15.0.942.0
Found nothing
■Heuristic/Suspicious ■Exact
NOTICE: Results are not 100% accurate and can be reported as a false positive by some scannerswhen and if malware is found. Please judge these results for yourself.
Copy to clipboard
File upload
Please not close this windows,
If you do not have to upload response time, make sure you upload files less than 20M
You can view the results of the last scan or rescan