home

nextpvr_3.8.3.exe

File

International Data Group Poland S.A.

The application nextpvr_3.8.3.exe, “File Setup ” by International Data Group Poland S.A has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup and installation application and has been known to bundle potentially unwanted software. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.quickfarmbundle.com.
Publisher:
International Data Group Poland S.A.  (signed and verified)

Product:
File

Description:
File Setup

MD5:
b0688fa9eebef778f8030767f1dceea4

SHA-1:
25c9dc5321ede1bc470a73f145228ae644c0a869

SHA-256:
0b751a0762c0a305ee15963b9af59d1104f9a2eb2d255dd694817fbeb29ff319

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
11/23/2024 6:03:03 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP (M)
17.3.15.7

File size:
1.7 MB (1,834,456 bytes)

Product version:
3.3.1

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\nextpvr_3.8.3.exe

Digital Signature
Signed by:
International Data Group Poland S.A.

Authority:
GlobalSign nv-sa

Valid from:
8/30/2016 11:21:17 AM

Valid to:
8/31/2017 11:21:17 AM

Subject:
CN=International Data Group Poland S.A., O=International Data Group Poland S.A., L=Warszawa, C=PL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE

Serial number:
64A80379DAA3514FAED45E16

File PE Metadata
Compilation timestamp:
1/30/2013 2:21:56 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

Entry address:
0x113BC

Entry point:
55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, 2C, 00, 41, 00, E8, E8, 51, FF, FF, 33, C0, 55, 68, 9E, 1A, 41, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 5A, 1A, 41, 00, 64, FF, 32, 64, 89, 22, A1, 48, 5B, 41, 00, E8, 16, D8, FF, FF, E8, 65, D3, FF, FF, 80, 3D, DC, 2A, 41, 00, 00, 74, 0C, E8, 2B, D9, FF, FF, 33, C0, E8, 80, 32, FF, FF, 8D, 55, EC, 33, C0, E8, E2, A3, FF, FF, 8B, 55, EC, B8, 50, 86...
 
[+]

Entropy:
7.9599

Developed / compiled with:
Microsoft Visual C++

Code size:
63.5 KB (65,024 bytes)

The file nextpvr_3.8.3.exe has been seen being distributed by the following URL.

http://www.quickfarmbundle.com/5HgIQrJFslZk_KAtek8i637kPWQZHSoP sJjJzZPEuvJdaCQP1IyIgMQEsSXUuFYaBB_716lgDf3KD8x1pyr7miGParxZt6uClmK_mZpu5vPaRCNwbXPCK LtQ9dDSchG_PoK2Lj0Op3Ph GaeWs XJR83xESBgeHqhKmmp9XuH0KOW8PB1BGVaFk6a4DiSictcx9GLkRFp XYl5Isst4mMmflltGRBCJzgJL1BHFvrL9MUIfrNSADJH7BfA3hxkydu78wg4Fj28crncy1B4EeXCgpdfpz6C1krYxUvbXS836aAJN4R5oXkoAxsWVklP7PmKtCiA_vfLPTcMid4BdMd9tjxMmeSahD3Jp1gyaqQjAz9_JCgW67tedUIzZQXZxmKVz1z KnHGjRtisinPXXiEXfzOL5QVc1dGm1Jvtq56RCVsHEBDbBHf 2eQy2s9s7wNOIQAnJWX9AmoxU8CHjh3fnVmpebo3OVudMgBk6R2Qkm4RkEkbcilNb3BEvb6IkT3b5NKjc0MqR6230WULH3ABuDGFrU7kTJfHooOdG1p9_WEnNn8JsbdIchzoVXGWrMEqrchCrL48jbuLTazoz3bJDKGNRCcpULyKXJ4 WKPaHKgGAFW5Bc6sUjpgLt87YNOtXchPr0UICsUde ljvpUd4Cfw==-GykAAEQ3F5tFgyWJKLwurcv5z1uQQjaRSGMbB_LGxIfRvK1zIlc1zx0oDC78BA==

Remove nextpvr_3.8.3.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.