nsxf39f.tmp
ETH64 - Setup
LLC
The file nsxf39f.tmp by LLC has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from zone3-14b7.kxcdn.com and multiple other hosts.
Publisher:
Open Source (signed by LLC )
MD5:
e02de707108606b50045c50529b1e841
SHA-1:
7555d0ba279130ee159c7b886721c7f76e60e103
Scanner detections:
1 / 68
Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.
Analysis date:
11/24/2024 6:38:25 AM UTC (today)
Scan engine
Detection
Engine version
Reason Heuristics
PUP.Amonitize.OpenSource.Installer (M)
15.12.16.14
File size:
1.1 MB (1,116,688 bytes)
Copyright:
2015 - Open Source
Language:
English (United States)
Common path:
C:\users\{user}\appdata\local\temp\nsxf39f.tmp
Authority:
COMODO CA Limited
Valid from:
5/6/2015 7:00:00 PM
Valid to:
5/6/2016 6:59:59 PM
Subject:
CN="LLC ""YOPTA SOFT""", O="LLC ""YOPTA SOFT""", STREET="str.Tsytadelna, 7", L=Kiev, S=Kiev, PostalCode=01015, C=UA
Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Serial number:
1CAFDF1C4C426FC3DD811D48793D99C9
The file nsxf39f.tmp has been seen being distributed by the following 4 URLs.
http://113.171.224.169/.../Cdn.exe
http://113.171.224.210/.../Cdn.exe