home

nss103815.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from download992.mediafire.com and multiple other hosts.
MD5:
286feecdf304842731dd35498838517c

SHA-1:
5e7e2fdc3b86fae51a5863aa1b935a6ff5b9767f

SHA-256:
bbaf5d10aad9e1d546fcfe48165272259db30de18a4598dc7d347e20a61a6c86

Scanner detections:
5 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
11/27/2024 12:40:10 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Packed/Execryptor
7.1.1

Dr.Web
Trojan.Click2.33727
9.0.1.0362

Quick Heal
(Suspicious) - DNAScan
12.13.12.00

Trend Micro House Call
PAK_Generic.009
7.2.362

Trend Micro
PAK_Generic.009
10.465.28

File size:
7 MB (7,323,880 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\nss103815.exe

File PE Metadata
Compilation timestamp:
8/26/2005 9:19:47 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
196608:v7i/YcpxRD1qV9b6UQ7W9hHo09xa78L+lljMK3i8iIZJ7u:v7i/YcxD1U9bNoi+lljF3wiS

Entry address:
0x31A3

Entry point:
83, EC, 20, 53, 55, 56, 33, F6, 57, 89, 74, 24, 18, BD, 38, 92, 40, 00, 89, 74, 24, 14, C6, 44, 24, 10, 20, FF, 15, 30, 70, 40, 00, 56, FF, 15, 80, 72, 40, 00, 68, 28, 92, 40, 00, 68, 20, E8, 42, 00, A3, D0, F0, 42, 00, E8, C0, 27, 00, 00, BB, 00, 64, 43, 00, BF, 00, 04, 00, 00, 53, 57, FF, 15, 58, 71, 40, 00, E8, 79, FF, FF, FF, 85, C0, 75, 24, 68, FB, 03, 00, 00, 53, FF, 15, AC, 70, 40, 00, 68, 20, 92, 40, 00, 53, E8, 9A, 27, 00, 00, E8, 59, FF, FF, FF, 85, C0, 0F, 84, 46, 01, 00, 00, BE, 00, 50, 43, 00...
 
[+]

Entropy:
7.9983  (probably packed)

Code size:
23 KB (23,552 bytes)

The file nss103815.exe has been discovered within the following program.

NSS (remove only)  by B-Phreaks Ltd
www.b-phreaks.co.uk
About 5% of users remove it
 
Powered by Should I Remove It?

The file nss103815.exe has been seen being distributed by the following 8 URLs.

http://download992.mediafire.com/hmrv2jzb1ezg/.../NSS103815.exe

https://docviewer.yandex.com.tr/source?id=4chqz-1lrx7rcgljlhcakx4lbvpb81jx2pflv3hximxbrkk1bqvj9cj9ibq34457icnnij7mii9fyldgsryi8b4pldhvspjr5ibld1aie&archive-path=//.../HCQtmrPM34JUmGy3DKL2A==&name=NSS103815.rar

http://s10602.chomikuj.pl/File.aspx?e=JBEN4VCAwnnpbm4OHnouBY9cTy1i6AuXlxx2x49E9hvvEi-ioTo8mJr7b_cP5TBYE13_nfr5bEF3yi_eFT0M2J7LKFXLtkgRHkvWx04sXv-8L-aK4Ju7y1vO2KLDynnl2gK26iYL8nuenA2YDHw8Cg&pv=2

http://s10066.chomikuj.pl/File.aspx?e=JBEN4VCAwnnpbm4OHnouBcUrskVqNOrstqRTQVlJsfDjdk2IaP0QMIRRxK092kztaCu_43e8EXwtjOrE_Glu7y_jmWqoiv-RoPtN3S2_rChlNrJsJpe6Tl8al20vkmQdcKA8XHEDffJYfcc55zoW1g&pv=2

http://s10066.chomikuj.pl/File.aspx?e=JBEN4VCAwnnpbm4OHnouBY9cTy1i6AuXlxx2x49E9htnp_cMC-TakYtx8dZUNeX_CCOzB01AtiL3VQAn4iv8hYZG2Mt6TmWoq0o7Po_dlCRrJyb7Aro1Z43U_XVX9kNGJ1AIKAMFZ663eycIPwTV7A&pv=2

http://s10066.chomikuj.pl/File.aspx?e=JBEN4VCAwnnpbm4OHnouBcUrskVqNOrstqRTQVlJsfAkTk8oE29hAcZ57YspU0Icjjb15gh7r7svH-c7QEwOf6XJtg4xEiVT6fCsjIh1qkD61u8pTzKZtoE2U7CTJtFnkDKX4DPV55z2u14EZCbEcg&pv=2

http://s10066.chomikuj.pl/File.aspx?e=JBEN4VCAwnnpbm4OHnouBc4v7J6vE_NOaP1WwQ7sNaZuXHAwhQBaZx3nOD-s7NvebBEVyg3ismFU8jAoG42IqGICgR_ZiduV19nlwVlsP4_qRWai1eAzukqguCTfi7sfHCQiuY6Ff_s0fuvBk1-A5w&pv=2

https://downloader.disk.yandex.com.tr/disk/29eef39cb85f0da701f855fba8e1c8a2b65789af5a6dd81f4ee7811fbeb24a45/569a436e/.../x-msdownload&fsize=7323880&hid=441c8981717ad18c790f58b10abf088b&media_type=executable&tknv=v2

Scan nss103815.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.