home

NJServer.exe

The executable NJServer.exe has been detected as malware by 34 anti-virus scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from s1.directxex.com.
Version:
0.0.0.0

MD5:
8641e3676b2bc16a7cf31bf2712d3dc4

SHA-1:
69652ccc939db6f64545d817e948deac2d333336

SHA-256:
e80bc8aa4fbd4e22b4691d6e9578a117d11327c8f37f0b5bc8888b3d7c73268a

Scanner detections:
34 / 68

Status:
Malware

Analysis date:
11/30/2024 3:31:45 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Zusy.90205
786

AegisLab AV Signature
Troj.W32.Gen
2.1.4+

Agnitum Outpost
Trojan.Zapchast
7.1.1

AhnLab V3 Security
Malware/Win32.Generic
2014.11.06

Avira AntiVirus
BDS/MSIL.Bladabindi.D.359
7.11.183.62

avast!
MSIL:GenMalicious-OY [Trj]
2014.9-141210

AVG
BackDoor.Generic18
2015.0.3264

Baidu Antivirus
Trojan.MSIL.Zapchast
4.0.3.141210

Bitdefender
Gen:Variant.Zusy.90205
1.0.20.1720

Comodo Security
UnclassifiedMalware
19997

Dr.Web
Win32.HLLW.Autoruner2.6549
9.0.1.0344

Emsisoft Anti-Malware
Gen:Variant.Zusy.90205
8.14.12.10.02

ESET NOD32
MSIL/Bladabindi.BH
8.10675

Fortinet FortiGate
MSIL/Kryptik.UD!tr
12/10/2014

F-Prot
W32/Trojan2.OJJE
v6.4.7.1.166

F-Secure
Gen:Variant.Zusy.90205
11.2014-10-12_4

G Data
Gen:Variant.Zusy.90205
14.12.24

IKARUS anti.virus
Trojan.MSIL.Zapchast
t3scan.1.8.3.0

K7 AntiVirus
Trojan
13.185.13888

Kaspersky
Trojan.MSIL.Zapchast
14.0.0.2817

Malwarebytes
Backdoor.Bot
v2014.12.10.02

McAfee
RDN/Generic.bfr!hh
5600.6920

Microsoft Security Essentials
Backdoor:MSIL/Bladabindi.gen!D
1.11104

MicroWorld eScan
Gen:Variant.Zusy.90205
15.0.0.1032

NANO AntiVirus
Trojan.Win32.Zapchast.dastbi
0.28.6.62995

Norman
Troj_Generic.UECQI
11.20141210

Qihoo 360 Security
HEUR/Malware.QVM03.Gen
1.0.0.1015

Quick Heal
Trojan.MSI.r4
12.14.14.00

Sophos
Mal/Generic-S
4.98

Trend Micro House Call
TROJ_SPNR.35GA14
7.2.344

Trend Micro
TROJ_SPNR.35GA14
10.465.10

Vba32 AntiVirus
Trojan.MSIL.Zapchast
3.12.26.3

VIPRE Antivirus
Trojan.Win32.Generic
34536

Zillya! Antivirus
Trojan.Zapchast.Win32.27728
2.0.0.1976

File size:
123.5 KB (126,464 bytes)

Product version:
0.0.0.0

Original file name:
NJServer.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\njserver.exe

File PE Metadata
Compilation timestamp:
5/28/2014 10:35:29 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
1536:3UQ2WXQy7pbwK3FZTMHiXTQnBY5tNdnxXc6rb4LROg2VfsMlpWDCC8p:3UQ2WBM48e5t/xsmNNlpWDfa

Entry address:
0x1D3EE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, D1, 9F, 85, 53, 00, 00, 00, 00, 02, 00, 00, 00, 1C, 01, 00, 00, 1C, E0, 01, 00, 1C, B8, 01, 00, 52, 53, 44, 53, BF, 4F, 79, 8D, 40, 3C, 15, 43, B8, 49, 58, DB, D6, B0, 5E, 7F, 01, 00, 00, 00, 44, 3A, 5C, D8, AA, D8, B4, D9, 81, D9, 8A, D8, B1, 5C, 4E, 6A, 72, 61, 74, 20, 53, 6F, 75, 72, 63, 65, 20, 20, 43, 6F, 64, 65, 20, 47, 65, 6E, 65, 72, 61, 74, 6F, 72, 20, 42, 79, 20, C4, B1, 6C, 6C, C4, B1, 6C, 6C, C4, B1, 4D, D1...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
109 KB (111,616 bytes)

The file NJServer.exe has been seen being distributed by the following URL.

http://s1.directxex.com/.../l61LvmobcuzgYRJDSCBgEQeBLGwpb4mUstJXoE1wT_-SkDQV4EmepZ1MRCIkIUcdWdPsalQY2fIKzi5lDte0TIRmDcDHI3HUP9kv

Remove NJServer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.