home

NO$GBA.EXE

No$gba

This is a setup program which is used to install the application. The file has been seen being downloaded from dc404.4shared.com and multiple other hosts.
Product:
No$gba

Description:
Nocash GBA Emulator

Version:
Windows version

MD5:
744d29ec13e5b7e5e873dd5afc417013

SHA-1:
95406971aa2a49d8a4c5923c05439271c11c7c63

SHA-256:
918ee2db99b0d63e66e13d495d5965c8b77311cbb8ffc88b88cb881eabaf5b65

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/5/2024 8:26:43 PM UTC  (today)

File size:
166.6 KB (170,646 bytes)

Copyright:
Copyright © 2001,2002 Martin Korth

Original file name:
NO$GBA.EXE

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\no$gba.exe

File PE Metadata
Compilation timestamp:
1/7/2050 3:26:47 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
3072:/c/ApiSj7ge5Iw24LQ8w1+hI45BMpWUqeyIemFfcD64Y4oOoqan35n8mGWm:/caiOce2KRw8hIZp8epBVN7GR

Entry address:
0xF9860

Entry point:
60, BE, 2E, 80, 4D, 00, 8D, BE, D2, 8F, F2, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 19, 8B, 1E, 83, EE, FC, 11, DB, 72, 10, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 78, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11...
 
[+]

Packer / compiler:
UPX 2.90LZMA]

Code size:
136 KB (139,264 bytes)

The file NO$GBA.EXE has been discovered within the following programs.

Camtasia Studio 8  by TechSmith Corporation
Publisher's description - “Camtasia Studio--Screen recording and video editing software. Camtasia Studio helps you quickly create professional quality videos and share them with anyone, on nearly any device without formal training.”
www.techsmith.com
9% remove it
Emulators for romsdvd2  by Bspellen
www.thepiratebay.org
About 5% of users remove it
Project64 1.6  by Project64
Publisher's description - “Project64 is a Nintendo 64 emulator for Windows by Zilmar, Jabo, Tooie and Witten. Project64 or PJ64 dates back to its first public release Project64 v1.0 in May 26th 2001. Project64 is an emulator designed to emulate a Nintendo64 video game system on a Microsoft Windows based PC.”
www.pj64.net
About 7% of users remove it
 
Powered by Should I Remove It?

The file NO$GBA.EXE has been seen being distributed by the following 12 URLs.

http://dc404.4shared.com/download/.../Emulador.EXE

http://cfile234.uf.daum.net/.../2026F2584D9B2D3811A007

http://f.sync.hamicloud.net/.../@download?f2e8ccea8c98aa3e697dfe5993170295&293a74657045b230756b47f07c970c2c

http://dla.uloz.to/Ps;Hs;fid=947775;cid=1278858464;rid=1536223920;up=0;uip=178.72.214.225;tm=1371583837;ut=f;aff=ulozto.cz;did=ulozto-cz;He;ch=015b7bebff120ada6d5147fe56f67409;Pe/.../emulator-pres-to-se-to-pousti-ta-hra.exe

http://online.b1.org/rest/online/download/NO$GBA.2.6a-805.zip/.../NO$GBA.EXE

https://mega.nz/temporary/.../FAdzTToI

http://s10564.chomikuj.pl/File.aspx?e=yYz_7x98KnB72tQYAja2uO1I2FPeIEyTKWgEJ8tOLUTPjcmZg9q_neGj5YKtvsy0oH_BE-BQf3hXVvCdM8A8c5Fvg-alKQUUXTKG8s6aYzQZcQslcOlNFCnB5g6rFk_Fykx-KjYEOwOQ8TxfXW5tsw&pv=2

http://blogattach.naver.net/198c05b6a3f9fd210fe88dbd83641364c1996e8a0b/20150130_236_blogfile/.../NO$GBA.EXE

http://s10564.chomikuj.pl/File.aspx?e=yYz_7x98KnB72tQYAja2uNn-5MwKfplRAill0KaewgLCldali6JjtS9glqvAI9Z1MertLMoDdvgjXBOPrqXlhZw-TfvGk6HtMh3I_XsPBblYZvV5OOaWjxwmqiD1DSzV-49ueCbu7wF71Pqu0SsflA&pv=2

http://blogattach.naver.net/d045cc7f6d3734e8c626457a4dadd1ad0d5dae47a2/20121021_245_blogfile/.../NO$GBA.EXE

https://mega.nz/temporary/.../qlBQmIKL

about:internet

Scan NO$GBA.EXE - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.