» ncis_season_3_nl.exe
Overview
Analysis
File Details

ncis_season_3_nl.exe

ВERSHNET LLC

The application ncis_season_3_nl.exe by ВERSHNET has been detected as a potentially unwanted program by 12 anti-malware scanners.

File name:

Publisher:

ВERSHNET LLC (signed and verified)

Version:

1.0.0.0

MD5:

394304d78be7105d97ca3a9d0b83d758

SHA-1:

56340f9ebf95f914414f868a68a75d15d759d290

SHA-256:

644251edf792a2b11767b9264b4d6d9acbddbe15255eb61cdda3a0baf6ddbddb

Scanner detections:

12 / 68

Status:

Potentially unwanted

Analysis date:

1/15/2025 9:30:01 AM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

Trojan.InstallMonster

7.1.1

Avira AntiVirus

ADWARE/Lollipop.jewc

8.3.1.6

AVG

Adware NaviPromo.X

2016.0.3110

Bkav FE

W32.HfsAdware

1.3.0.6379

Dr.Web

Trojan.InstallMonster.1230

9.0.1.0134

ESET NOD32

Win32/InstallMonstr.KP potentially unwanted application

9.7.0.302.0

herdProtect (fuzzy)

variant of d3dx9_43.exe

2015.8.11.5

K7 AntiVirus

Unwanted-Program

13.204.16012

Malwarebytes

PUP.Optional.InstallMonster

v2015.05.17.05

Reason Heuristics

Threat.Win.Reputation.IMP

15.5.17.13

VIPRE Antivirus

Threat.4785227

40432

Zillya! Antivirus

Adware.InstallMonster.Win32.164

2.0.0.2188

File size:

3.3 MB (3,452,984 bytes)

Product version:

1.0.0.0

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Digital Signature

Signed by:

ВERSHNET LLC

Authority:

COMODO CA Limited

Valid from:

2/5/2015 1:00:00 AM

Valid to:

2/6/2016 12:59:59 AM

Subject:

CN=ВERSHNET LLC, O=ВERSHNET LLC, STREET="600-Richchya, house 66, office 10", L=Vinnitsa, S=Vinnitskiy Region, PostalCode=21027, C=UA

Issuer:

CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

0DCBDEF5E756334284571793EA14D465

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

49152:WucJrGMLYG1LTnQ9r5vtnn/X785CPrqeVLZ+yoChDvD+U645dhb6Qf5fZ6X4/pTJ:mJr7T7gPv785GGqUy/Jb+IXb6eE4/pfV

Entry address:

0x974E10

Entry point:

60, BE, 00, D0, AA, 00, 8D, BE, 00, 40, 95, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89... 
[+]

Packer / compiler:

UPX 2.90LZMA

Code size:

2.8 MB (2,920,448 bytes)

Remove ncis_season_3_nl.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.