home

microsoft-office-professional-2007.exe

Nos

Fanetet

The application microsoft-office-professional-2007.exe, “Nos Setup ” has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Fanetet

Product:
Nos

Description:
Nos Setup

Version:
3.4.1.2

MD5:
c9c50b6563b85009597730ec20d9bbef

SHA-1:
ba19841bf1b6f67524c61ac16e88a8adba4778dd

SHA-256:
936b172112f1efbb284cdaf39ff9615afc35852cbe72acd66f8acb9bc8caaa26

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/27/2024 3:57:39 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore (L)
16.8.5.20

File size:
1 MB (1,061,112 bytes)

Product version:
4.7.0

Copyright:
File wizard

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\microsoft-office-professional-2007.exe

File PE Metadata
Compilation timestamp:
6/20/1992 6:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:PqiYW7uFl5qjOjWBCSVmN489Oom3c1jxkWaVXFDmy:PjYPwjOjWBKjOFCxkWaLq

Entry address:
0xA5F8

Entry point:
60, 8A, EC, 31, F2, EB, 02, 85, F3, 0F, AF, C3, C7, C0, 36, 81, AD, 42, 40, FF, CF, 0F, AF, F9, 85, FF, 8B, D8, 3A, C2, 74, 08, 86, F7, 8D, 1D, 2A, 4B, AF, 62, E8, 40, 00, 00, 00, BF, 00, 00, 00, 00, 78, 07, C6, C1, 6E, FE, C2, FE, C7, 0F, AF, C2, 0F, AF, EE, 69, C7, BD, 83, 59, 44, 0F, AF, F0, 81, C7, 01, 00, 00, 00, 84, FD, 8B, ED, 04, A3, 84, DD, C7, C1, 78, 20, 11, 75, 0F, B7, DE, 81, FF, 3C, 04, 00, 00, 0F, 8C, C5, FF, FF, FF, 6B, F6, 00, B4, FC, 32, F1, FE, C3, F3, EB, 0A, 0C, 86, 8D, 2D, 02, 7D, A4...
 
[+]

Entropy:
7.9364  (probably packed)

Code size:
39.5 KB (40,448 bytes)

The file microsoft-office-professional-2007.exe has been seen being distributed by the following URL.

http://www.factoryheadcentral.com/c?x=pgWORymAzWUtZSZ4nyhKQGU383c1HliSNuebXNhnc0A=&c=xyMRKjkXWdD1MJM0QVL80afxn3j1jWQ7EcWKqVPaCZ9XKULRW5goQ N1xwnkOokcYI27VcCxtUyT EPwFgFLJy/5eUF0Hp8ltv56 kx4ZFLx2AN8U8SDR5mqsxAQQvU1BpSrQXp53aTMdiJcA5vtZggroYcxoPvaYOj4G7sBAMg=&e=0&downloadAs=microsoft-office-professional-2007.exe&fallback_url=http://pf.benjaminstrahs.com/s/1467174636/en/4/.../46039-1800344-microsoft-office-professional-2007.exe

Remove microsoft-office-professional-2007.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.