nsd9152.tmp

The file nsd9152.tmp has been detected as a potentially unwanted program by 14 anti-malware scanners. The file has been seen being downloaded from d24u51ac8ybaqu.cloudfront.net. While running, it connects to the Internet address server-54-192-36-126.jfk1.r.cloudfront.net on port 443.
MD5:
c910019cfa57638aa2abdd534f8a055e

SHA-1:
844609edd1004229ca359cf43209ffa510be69f3

SHA-256:
1a86e00ca8391fa2d60ca2baa33aa2307bda4bad47ca36ba19f05cd7cbab6926

Scanner detections:
14 / 68

Status:
Potentially unwanted

Explanation:
May modify the web browser's settings including changing the homepage and search provider in addition to delivering ads (by injecting banner and text-links directly in the webpage).

Analysis date:
11/22/2024 8:59:59 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Mikey.28783
5692572

AhnLab V3 Security
PUP/Win32.CrossRider
2015.12.07

Avira AntiVirus
TR/Taranis.399
8.3.2.4

Arcabit
Trojan.Mikey.D706F
1.0.0.628

Bitdefender
Gen:Variant.Mikey.28783
1.0.20.1700

Emsisoft Anti-Malware
Gen:Variant.Mikey.28783
10.0.0.5366

F-Secure
Gen:Variant.Mikey.28783
11.2015-06-12_1

G Data
Gen:Variant.Mikey.28783
15.12.25

Kaspersky
UDS:DangerousObject.Multi.Generic
14.0.0.1011

Malwarebytes
Trojan.Downloader
v2015.12.06.07

MicroWorld eScan
Gen:Variant.Mikey.28783
16.0.0.1020

Norman
Gen:Variant.Mikey.28783
28.10.2015 12:55:53

Panda Antivirus
Trj/Genetic.gen
15.12.06.07

Qihoo 360 Security
HEUR/QVM08.0.Malware.Gen
1.0.0.1077

File size:
10 KB (10,240 bytes)

Common path:
C:\users\{user}\appdata\local\temp\nsd9152.tmp

File PE Metadata
Compilation timestamp:
12/6/2015 11:42:34 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
96:h3pV5SboUjrYFeFD9kFw2PXGUYaqeX/PCDhvOLCTrEHbsONAJBHmCi:hr6jj8F0kFw2PXGU5XHCDhvrb6AJBH2

Entry address:
0x1000

Entry point:
6A, 70, 68, 38, 23, 40, 00, E8, F8, 01, 00, 00, 33, DB, 89, 5D, FC, 8D, 45, 80, 50, FF, 15, 00, 20, 40, 00, 83, CF, FF, 89, 7D, FC, 66, 81, 3D, 00, 00, 40, 00, 4D, 5A, 75, 28, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, 17, 0F, B7, 88, 18, 00, 40, 00, 81, F9, 0B, 01, 00, 00, 74, 20, 81, F9, 0B, 02, 00, 00, 74, 05, 89, 5D, E4, EB, 2A, 83, B8, 84, 00, 40, 00, 0E, 76, F2, 33, C9, 39, 98, F8, 00, 40, 00, EB, 11, 83, B8, 74, 00, 40, 00, 0E, 76, DF, 33, C9, 39, 98, E8, 00, 40, 00, 0F, 95, C1...
 
[+]

Entropy:
4.8919

Developed / compiled with:
Microsoft Visual C++ v7.1

Code size:
3 KB (3,072 bytes)

The file nsd9152.tmp has been seen being distributed by the following URL.

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP SSL):
Connects to server-54-230-52-89.jfk6.r.cloudfront.net  (54.230.52.89:443)

TCP (HTTP SSL):
Connects to server-54-230-38-186.jfk1.r.cloudfront.net  (54.230.38.186:443)

TCP (HTTP SSL):
Connects to server-54-230-38-177.jfk1.r.cloudfront.net  (54.230.38.177:443)

TCP (HTTP SSL):
Connects to server-54-192-55-186.jfk6.r.cloudfront.net  (54.192.55.186:443)

TCP (HTTP SSL):
Connects to server-54-192-54-202.jfk6.r.cloudfront.net  (54.192.54.202:443)

TCP (HTTP SSL):
Connects to server-54-192-36-126.jfk1.r.cloudfront.net  (54.192.36.126:443)

TCP (HTTP SSL):
Connects to server-204-246-169-90.jfk1.r.cloudfront.net  (204.246.169.90:443)

Remove nsd9152.tmp - Powered by Reason Core Security