home

network_inventory_advisor.exe

Network Inventory Advisor

Random Apps

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from download.fileeagle.com and multiple other hosts.
Publisher:
ClearApps, Inc.  (signed by Random Apps)

Product:
Network Inventory Advisor

Version:
4.2.0.2938

MD5:
cbb3bb62644ab5e2c4d6478de79c59e6

SHA-1:
d8b554955bf451b222162c5790015d27f77c111d

SHA-256:
ff9b850a3763094709c3ff362f5dc273b999552fa71f291c499bb10af25816f0

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
11/5/2024 8:09:39 PM UTC  (today)

Scan engine
Detection
Engine version

Vba32 AntiVirus
TrojanPSW.Bjlog
3.12.26.3

File size:
14.6 MB (15,352,928 bytes)

Copyright:
Copyright (c) 1999-2013 by ClearApps

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Digital Signature
Signed by:
Random Apps

Authority:
Symantec Corporation

Valid from:
2/27/2015 1:00:00 AM

Valid to:
2/27/2017 12:59:59 AM

Subject:
CN=Random Apps, O=Random Apps, L=Atlanta, S=Georgia, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
110672059CC6908B63E964C3594A36CD

File PE Metadata
Compilation timestamp:
9/9/2009 3:23:14 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
393216:8Eg2+axgOPWmTF1mae415AA1XiF8vptbXh1W8YI2:8Egyh/TLmM51oKvptbzVj2

Entry address:
0x33E9

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 70, 85, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 80, 40, 00, 55, FF, 15, B0, 82, 40, 00, 6A, 08, A3, 78, 06, 47, 00, E8, 67, 27, 00, 00, 55, 68, B4, 02, 00, 00, A3, 90, 05, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 6C, 85, 40, 00, FF, 15, 80, 81, 40, 00, 68, 54, 85, 40, 00, 68, 80, 85, 46, 00, E8, 35, 26, 00, 00, FF, 15, B0, 80, 40, 00, 50, BF, A0, 10, 4C, 00, 57, E8, 23, 26, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
25 KB (25,600 bytes)

The file network_inventory_advisor.exe has been seen being distributed by the following 8 URLs.

http://download.fileeagle.com/files/2015/.../network_inventory_advisor.exe

http://www.clearapps.com/.../network_inventory_advisor.exe

http://network-inventory-advisor.softonic.com/download-tracker?th=8yS3 KGEYLiw7GKMHzA/.../q6eivsCo7RoAXQjwTxeqDUx 3Mh2P5fQOYV4sDcdGdUhzanUPXpxFYHHbA W27fX4fPN1keSNwXHYXqjm5CJMrzphEOI0eAPaEx4BswepSfK76nadnus3sFpzgGY0CYzQdpi14EGHGR7DvF4CP217yWTdNKgrhCbQgdLQ==

http://en.softonic.com/sads/tracker.php?ev=c&co=RO&sid=d80976d36d5fd39b44c80c419c93fb7b&upv=1f30889f53bedcaa76e06cdaec758678&z=results&sk=0&abt=&eid=&params=F39B2A32BFC101987B1458170C278E037A20367D534EE9D84A67B79F24B959C32383E09186A528A20AB9CB1FEA9FF5A9EADBA1CB9FAB98954E607303936EB7A88064A16A4E148D993A011D5C24AEF0ED301001F98D46481BE301B3692317F2EE3BBF929D651CBB6C97E736C458332E1382FF14EDD1272E9D07C847DD4F739A9F48664C41E80AD3620059CA75A343F81ECA776272251C530B4784589D014764DA&h=FA734D0B906DBEE7D60C13B10C4276B835F11DD9DE685A7129A09ACCC682548E&directdownload=1&f=301023&d=http://www.network-inventory-advisor.com/.../network_inventory_advisor.exe

http://www.filecluster.com/.../62436.html

http://en.softonic.com/sads/tracker.php?ev=c&co=PK&sid=3d0b6388dc2c5bacfc9f65a8839a4cf5&upv=3cbc4d9555848aac358e99d038e399ed&z=results&sk=0&abt=&eid=&params=F39B2A32BFC101987B1458170C278E037A20367D534EE9D84A67B79F24B959C3BEC3CE16090639A271CC47150B67477747508E65CA5B160AB26B4D0B0DE14C62914C7AB07B91BB656013A9EBAB164CE85A95AAAE0EEF54198CFE3801F7F7401591D9A013B5CB701220EBDD152F8BB53ABCB30BEE78345D0A4583B566914D5915C3D4761FBE64098FFFCD3FAF5A688244D560977779B43F8CF34BB695E44F0B4B&h=D92D85C4A850847A7B1EFDAE66DDFF957EF4DA6FD2B66FFDEBA6EB83D973B819&directdownload=1&f=301023&d=http://www.network-inventory-advisor.com/.../network_inventory_advisor.exe

http://dl.network-inventory-advisor.com/network_inventory_advisor.exe

http://www.network-inventory-advisor.com/.../network_inventory_advisor.exe

Scan network_inventory_advisor.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.