home

installer_java_arabe.exe

The application installer_java_arabe.exe has been detected as a potentially unwanted program by 11 anti-malware scanners. The program is a setup application that uses the Nullsoft Scriptable Install System installer, however the file is not signed with an authenticode signature from a trusted source. Infected by an entry-point obscuring polymorphic file infector which will create a peer-to-peer botnet and receives URLs of additional files to download. The file has been seen being downloaded from sojovivi47bd6miyitun.kanocireikagup.info.
MD5:
52f62ff8a5c0f3d10316326183ba5e6f

SHA-1:
dba227f44aa339179601725da0977247e93326b4

SHA-256:
26f60afe6db3124c4103997ef9741e2c24213fe4364e3326589a04afced1d94e

Scanner detections:
11 / 68

Status:
Potentially unwanted

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
12/27/2024 9:52:07 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:SaliCode
160518-2

AVG
Win32/Sality
2015.0.4591

Dr.Web
Win32.Sector.22
9.0.1.05190

Emsisoft Anti-Malware
Win32.Sality
11.5.0.6191

ESET NOD32
Win32/Sality.NBA virus
8.0.319.0

F-Prot
W32/Sality.gen2
4.6.5.141

Kaspersky
Virus.Win32.Sality
15.0.0.562

McAfee
Virus.W32/Sality.gen.z
18.0.204.0

Microsoft Security Essentials
Threat.Undefined
1.223.1286.0

Norman
Win32.Sality.3
28.05.2016 15:32:18

Reason Heuristics
Adware.Bundler.ET (M)
16.6.11.3

File size:
908.6 KB (930,368 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Nullsoft Scriptable Install System

Common path:
C:\users\{user}\downloads\installer_java_arabe.exe

File PE Metadata
Compilation timestamp:
12/6/2009 12:52:12 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
24576:Jl+I/mGbD7SpGwc/Cui1FGJ0tlKVQjbenI3gxjyOH0vt://muDOlc/CCOMV7n0g9yOH0l

Entry address:
0x30FA

Entry point:
86, DF, 86, EF, 88, F2, 69, D3, 5A, A9, B8, 60, 87, E9, 84, C2, 22, CB, 49, 87, C2, 85, C8, 69, DD, 22, 87, 46, E2, C6, C3, 15, 85, D3, 70, 0A, FE, C5, 0F, AF, F5, BA, 91, CF, 27, BE, 81, ED, 26, 05, 00, 00, 8D, 35, 11, 66, C3, AE, 81, ED, BC, 68, 00, 00, 69, C0, AA, 2B, 2E, 31, 89, D2, B7, 69, 08, FF, 84, CD, 4A, 8A, FB, 8D, 15, 22, 44, F2, 70, 48, 8D, 3D, 5F, 18, 7A, BE, F6, C4, BD, E8, 94, 00, 00, 00, 85, F9, 15, 64, 24, B1, 72, 88, F3, F7, C2, 49, 6B, DA, C3, 86, C0, F7, C7, CC, 60, F7, CD, 8A, C0, 80...
 
[+]

Entropy:
7.9430  (probably packed)

Code size:
23.5 KB (24,064 bytes)

The file installer_java_arabe.exe has been seen being distributed by the following URL.

http://sojovivi47bd6miyitun.kanocireikagup.info/.../download?p=mavmed&trckid=M_6908298338d529727f81432933673&ref=clickater.com&tid=JMC1145_vAICbozcWB-PZjPBTZtHut

Remove installer_java_arabe.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.