Gridinsoft Logo
File Icon

The wps_wid.cid-837326872.1712602843.exe (WPS Office Setup) File Analysis

Updated 2 years ago
Checked by Malware Check
wps_wid.cid-837326872.1712602843.exe

Technical Analysis

File Name wps_wid.cid-837326872.1712602843.exe
File Type
PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version 1.0.171.174
Database Version 2024-04-08 21:00:29 UTC
✓

Clean File

No threats detected by our scanner

0%
Detection Rate
5,687,696
File Size (bytes)
2024-04-08
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
91ea6f8c0cc370d8dfa40e11ac525d99
SHA1
ec6ac8cd1b4828da6af02cb90796b6375b123c04
SHA256
5319e95ee3ef59a1f1a449bb979076405682c1eb0cc603e8794807fecb5b2cf3
SHA512
976501ba40e76a321757a8021e37de565e961bcc0559bb25b8abb2e73d3bb760b66d6c9d9bfacd50a3cf75598339445a9e967653d054953adc8536530c2cfd37
ImpHash
a2f9eb2060503865cc8ea051d42d3043

PE Analysis

Basic Information

▼
Icon
Hash: 5316f6d2f33cf51fbc7cae985eb6899b
Fuzzy: 3de6f91d22d39c03dbc69425870a7c37
dHash: d8ccb2aa8e9694c4
Image Base 0x00400000
Entry Point 0x00663f07
Compilation Time 2024-04-07 04:59:24
Checksum 0x00575823 (Actual: 0x00575823)
OS Version 5.1
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
PDB Path D:\rc_v12_i18n_202403_branch\Build\Release\WPSOffice\office6\addons\konlinesetup_xa\konlinesetup_xa.pdb
Digital Signature OK
Imports 1 libraries
KERNEL32
Exports 82 functions
Resources 15 Resources
Sections 5 Sections

Version Information

▼
CompanyName Zhuhai Kingsoft Office Software Co.,Ltd
FileDescription WPS Office Setup
FileVersion 12,2,0,16731
InternalName konlinesetup_xa
LegalCopyright Copyright©2024 Kingsoft Corporation. All rights reserved.
OriginalFilename konlinesetup_xa.exe
ProductName WPS Office
ProductVersion 12,2,0,16731
MIMEType
Translation 0x0000 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 3,941,690 bytes 3,941,888 bytes 6.73 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 8B5A500AFC3BD75528EAA89876D60226
.rdata 0x003c4000 818,196 bytes 818,688 bytes 5.95 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 57575B83C28001A84A018ACA48DEA1DE
.data 0x0048c000 86,756 bytes 52,736 bytes 4.79 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D2C0A182552FA847EB4504149D450324
.rsrc 0x004a2000 687,764 bytes 688,128 bytes 7.65 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ AEC4D439BBF7B9D18534E57461683E66
.reloc 0x0054a000 164,312 bytes 164,352 bytes 6.61 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ B864D82BFEE1594FC45C649E76297D6A
Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 15 (686,859 bytes)
Resource Type Count Total Size Percentage
ZIPRES 2 516,069 bytes
75.1%
RT_ICON 8 167,594 bytes
24.4%
RT_STRING 2 222 bytes
0%
RT_GROUP_ICON 1 118 bytes
0%
RT_VERSION 1 908 bytes
0.1%
RT_MANIFEST 1 1,948 bytes
0.3%

Certificate Chain Analysis

▼
Certificate Information
Product WPS Office
Description WPS Office Setup
File Version 12,2,0,16731
Original Name konlinesetup_xa.exe
Signing Date 12:30 PM 04/07/2024 (797 days ago)
Verification Status Signed
Signers Zhuhai Kingsoft Office Software Co., Ltd.; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert
Counter Signers DigiCert Timestamp 2023; DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA; DigiCert Trusted Root G4; DigiCert
Internal Name konlinesetup_xa
Copyright Copyright©2024 Kingsoft Corporation. All rights reserved.
Certificate Chain Summary
DigiCert Trusted Root G4 #1 Primary
Validity Period: 2022-08-01 00:00:00 → 2031-11-09 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 0E 9B 18 8E F9 D0 2D E7 EF DB 50 E2 08 40 18 5A
DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA #2 Chain
Validity Period: 2022-03-23 00:00:00 → 2037-03-22 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 07 36 37 B7 24 54 7C D8 47 AC FD 28 66 2A 5E 5B
DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 #3 Chain
Validity Period: 2021-04-29 00:00:00 → 2036-04-28 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 08 AD 40 B2 60 D2 9C 4C 9F 5E CD A9 BD 93 AE D9
DigiCert Timestamp 2023 #4 Chain
Validity Period: 2023-07-14 00:00:00 → 2034-10-13 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 05 44 AF F3 94 9D 08 39 A6 BF DB 3F 5F E5 61 16
Zhuhai Kingsoft Office Software Co., Ltd. #5 Chain
Validity Period: 2021-10-14 00:00:00 → 2024-10-16 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 05 A8 1D 3B 96 27 0D 9A 1D EB 07 CD 88 67 D0 A9

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

OK

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. 1
    Weekly Quick Scans: Set a reminder to run a scan every Sunday. Most infections are caught within the first week, so regular checks give you peace of mind.
  2. 2
    Update Everything: Those annoying update popups exist for a reason — they patch security holes. Windows, browsers, Adobe, Java — keep them all current.
  3. 3
    Download Smart: Stick to official websites and app stores. If a "free" version of paid software sounds too good to be true, it probably comes with unwanted extras.
  4. 4
    Think Before You Click: Malware loves email attachments and "urgent" links. Even if an email looks like it's from your bank or a friend, verify suspicious requests through a different channel.
Proactive Protection
This file looks clean right now, but that doesn't mean you should let your guard down. New malware appears daily, and even legit files can be compromised after download. When in doubt, verify the source and check for a digital signature.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Gridinsoft Portal
Signed in via Gridinsoft Portal · View profile
Your Score for

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now
Gridinsoft Anti-Malware