home

jnshde4.tmp

The file jnshde4.tmp has been detected as malware by 3 anti-virus scanners. It runs as a separate (within the context of its own process) windows Service named “TV Call Charge”. The file has been seen being downloaded from d3jydz90x0ejp8.cloudfront.net.
MD5:
662bb9d2113f984ad60ef3c34ec51b45

SHA-1:
bd775b030cdeb6933bd441667f3d57a375819e2f

SHA-256:
e1ed8889dcf1e1acf1ac7eacf7574294f7a911fe9923a5db24ef4511a4817ae9

Scanner detections:
3 / 68

Status:
Malware

Analysis date:
12/26/2024 7:16:09 PM UTC  (today)

Scan engine
Detection
Engine version

Kaspersky
UDS:DangerousObject.Multi.Generic
14.0.0.2319

Panda Antivirus
Trj/Genetic.gen
15.03.20.02

Reason Heuristics
Threat.Downloader.KY
16.2.29.19

File size:
110.5 KB (113,152 bytes)

Common path:
C:\users\{user}\appdata\roaming\41d51c7f-1426832106-11e3-9673-ce39e75c1b10\jnshde4.tmp

File PE Metadata
Compilation timestamp:
3/19/2015 9:15:20 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
3072:v1voyO8k3Vx9Jr1iQBBOhW+l0P+qC+hweAIK4jy/Zr:tgyOl3bJiKo1l8+qjwe5jy/Zr

Entry address:
0xAE98

Entry point:
E8, 42, 46, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 8B, 55, 08, 56, 57, 85, D2, 74, 07, 8B, 7D, 0C, 85, FF, 75, 13, E8, 12, 2D, 00, 00, 6A, 16, 5E, 89, 30, E8, B6, 2C, 00, 00, 8B, C6, EB, 33, 8B, 45, 10, 85, C0, 75, 04, 88, 02, EB, E2, 8B, F2, 2B, F0, 8A, 08, 88, 0C, 06, 40, 84, C9, 74, 03, 4F, 75, F3, 85, FF, 75, 11, C6, 02, 00, E8, DC, 2C, 00, 00, 6A, 22, 59, 89, 08, 8B, F1, EB, C6, 33, C0, 5F, 5E, 5D, C3, 8B, FF, 55, 8B, EC, 53, 8B, 5D, 08, 83, FB, E0, 77, 6F, 56, 57, 83, 3D, BC, C9, 41, 00, 00...
 
[+]

Entropy:
6.2920

Code size:
76.5 KB (78,336 bytes)

Service
Display name:
TV Call Charge

Service name:
pehisupy

Type:
Win32OwnProcess


The file jnshde4.tmp has been seen being distributed by the following URL.

http://d3jydz90x0ejp8.cloudfront.net/JOSrv.exe

Remove jnshde4.tmp - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.