home

minecraft-1.7.2.exe

Nebuki

AgileMax (New Media Holdings Ltd.)

The application minecraft-1.7.2.exe, “Nebuki Setup ” by AgileMax (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download Minecraft but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware. The file has been seen being downloaded from www.senddeliveryshare.com.
Publisher:
AgileMax (New Media Holdings Ltd.)  (signed and verified)

Product:
Nebuki

Description:
Nebuki Setup

MD5:
aace48f531686f32131d61f176ca6477

SHA-1:
cc2f683091fe808d3036d87eddd7c6e2fadceebf

SHA-256:
a38bba341b8d0d81a5466325ed8f1de6210cda3b461fdc8ee179458c3ec71744

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/27/2024 1:30:31 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH (M)
16.8.2.17

File size:
911.7 KB (933,592 bytes)

Product version:
2.5

Copyright:
Fast web

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\minecraft-1.7.2.exe

Digital Signature
Signed by:
AgileMax (New Media Holdings Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 1:04:31 PM

Valid to:
10/30/2016 4:53:45 PM

Subject:
CN=AgileMax (New Media Holdings Ltd.), O=AgileMax (New Media Holdings Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112186313590F7C0AF7C143BC6BDE6200476

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:GpVKQdkoB1+5FK6ywmG6g/KKLugux2TrhbIC:kHdVUc6NxLvq2TdbIC

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file minecraft-1.7.2.exe has been seen being distributed by the following URL.

http://www.senddeliveryshare.com/fDrwhpseLTbmpIdHQPan5b SVd7qdtt3eJ29WN5Gpu9jFV9i3A8UcRQe7wKU48GZcNaLR0rsF18Rx9HQS5tOVjdCx5sTv 0gCuZ5IRwpxahrh4G6ONqW1kZIfDKJJu80L9HH8zZ3PKZOJ0r 5n_Yz_a9sdxmyDBMSCMi7kaXNOQi4K1VjgrgwsGtiHbm62jph6cUl6iTPxXl_Wp9PP8v0xc2FiYdu2 15jmcRp8Dbwnp_lpgC_t3_mhnCR_u_W2cmo4qYQILupMM_9eY5vaXfy9uzz6C3TwI8ASupwY5vYTfyRwVVMGlewVABjSVFORqTTCqBNTPsacgdkTK45QmqELBQyItlY7hPGwpwreEgj0qh1kmqe6wLYZYv6WN3dmFF_Gi 7KYu_yJ3ZsmBXOBxE9cZ0WE6 U7EqBiNWG LdzE8pr8kj1cPPWqmmUuKiURVHFfFDf4-Gz8AAETdFtuPFkMXLGHIvCblVxAccsD FsohAAg2xs7wSUV9Y0p cEPIXHEgmnxdH22HTm27Y1xt5FSy8BM=

Remove minecraft-1.7.2.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.