» pc_faster_setup_mini_056.exe
Overview
Analysis
File Details
Downloads (2)
Network (1)

pc_faster_setup_mini_056.exe

Baidu PC Faster

Baidu Online Network Technology (Beijing)Co., Ltd

The executable pc_faster_setup_mini_056.exe, “Baidu PC Faster MiniSetup” has been detected as malware by 41 anti-virus scanners. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. The file is most likely infected with the Neshta virus, a Russian virus that gathers system information and send it to a remote command and cotrol server. The file has been seen being downloaded from dl-vip.pcfaster.baidu.com.eg and multiple other hosts. While running, it connects to the Internet address host-105.203.253.104.etisalat.com.eg on port 80 using the HTTP protocol.

File name:

Publisher:

Baidu Inc. (signed by Baidu Online Network Technology (Beijing)Co., Ltd)

Product:

Baidu PC Faster

Description:

Baidu PC Faster MiniSetup

Version:

4,0,0,64871

MD5:

64f33d8c204885c81f208e1c75356cf4

SHA-1:

668917f0c75fcb5f5ada61b6a32508667cab77e7

SHA-256:

8178ef80580caf55fbde41877fdacfb939052f1e3bfd88f6ba5ebd76f24515d0

Scanner detections:

41 / 68

Status:

Malware

Explanation:

Infected with the direct-infection Neshta file infector virus.

Analysis date:

12/27/2024 3:33:52 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Win32.Neshta.C

789

Agnitum Outpost

Win32.Neshta.A

7.1.1

AhnLab V3 Security

Win32/Neshta

2013.08.22

Avira AntiVirus

W32/Neshta.a

7.11.30.172

avast!

Win32:Apanas [Trj]

2014.9-141207

AVG

Worm/Delf

2015.0.3267

Baidu Antivirus

Virus.Win32.Neshta.$a

4.0.3.14127

Bitdefender

Win32.Neshta.A

1.0.20.1705

Bkav FE

W32.HanGu.PE

1.3.0.4959

Clam AntiVirus

W32.Neshuta.A

0.98/19505

Comodo Security

Win32.Neshta.A

16801

Dr.Web

Win32.HLLP.Neshta

9.0.1.0341

Emsisoft Anti-Malware

Win32.Neshta

8.14.12.07.12

ESET NOD32

Win32/Neshta.A virus

8.7.0.302.0

Fortinet FortiGate

W32/Neshta.A

12/7/2014

F-Prot

W32/HLLP.41472

v6.4.6.5.141

F-Secure

Win32.Neshta.A

11.2014-07-12_1

G Data

Win32.Neshta

14.12.22

IKARUS anti.virus

Virus.Win32.Neshta

t3scan.2.0.127

K7 AntiVirus

Virus

13.170.9337

Kaspersky

Virus.Win32.Neshta

14.0.0.2832

Malwarebytes

Trojan.Agent

v2014.12.07.12

McAfee

W32/HLLP.41472.e

5600.6923

Microsoft Security Essentials

Virus:Win32/Neshta.A

1.163.1557.0

MicroWorld eScan

Win32.Neshta.A

15.0.0.1023

NANO AntiVirus

Virus.Win32.Neshta.cdby

0.26.0.53954

Norman

Neshta.C

11.20141207

nProtect

Virus/W32.Neshta

13.08.21.03

Panda Antivirus

W32/Neshta.A

14.12.07.12

Qihoo 360 Security

Virus.Win32.Neshta.B

1.0.0.1015

Quick Heal

W32.Neshta.A

12.14.12.00

Rising Antivirus

Win32.Netsha.a

23.00.65.141205

Sophos

W32/Bloat-A

4.91

SUPERAntiSpyware

Trojan.Agent/Gen-FlyStudio

10192

Total Defense

Win32/Neshta.A

37.0.10498

Trend Micro House Call

PE_NESHTA.A

7.2.341

Trend Micro

PE_NESHTA.A

10.465.07

Vba32 AntiVirus

Virus.Win32.Neshta.a

3.12.22.3

VIPRE Antivirus

Virus.Win32.Neshta.a

20730

ViRobot

Win32.Neshta.B

2011.4.7.4223

Zillya! Antivirus

Virus.Neshta.Win32.1

2.0.0.1952

File size:

1.5 MB (1,603,616 bytes)

Product version:

4,0,0,64871

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\downloads\programs\pc_faster_setup_mini_056.exe

Digital Signature

Signed by:

Baidu Online Network Technology (Beijing)Co., Ltd

Authority:

VeriSign, Inc.

Valid from:

4/24/2012 2:00:00 AM

Valid to:

4/25/2015 1:59:59 AM

Subject:

CN="Baidu Online Network Technology (Beijing)Co., Ltd", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Baidu Online Network Technology (Beijing)Co., Ltd", L=Beijing, S=Beijing, C=CN

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

3BDB1994B98BBB19AB55A42337FA4F5C

File PE Metadata

Compilation timestamp:

4/9/2014 4:37:52 AM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

24576:xPQ6n0gc8pxutyD3H2RXG8N5gjTEVhDAYZpUi1m9mT:PayD3H2tTNmjT6xh4mT

Entry address:

0xB940A

Entry point:

E8, 68, FE, 00, 00, E9, 79, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 55, 8B, EC, 57, 56, 8B, 75, 0C, 8B, 4D, 10, 8B, 7D, 08, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, A4, 01, 00, 00, 81, F9, 00, 01, 00, 00, 72, 1F, 83, 3D, 6C, 2F, 54, 00, 00, 74, 16, 57, 56, 83, E7, 0F, 83, E6, 0F, 3B, FE, 5E, 5F, 75, 08, 5E, 5F, 5D, E9, 2D, FF, 00, 00, F7, C7, 03, 00, 00, 00, 75, 15, C1, E9, 02, 83, E2, 03, 83, F9, 08, 72, 2A, F3, A5, FF, 24, 95, 94, 95, 4B, 00, 90, 8B, C7, BA, 03, 00, 00... 
[+]

Code size:

1 MB (1,061,376 bytes)

The file pc_faster_setup_mini_056.exe has been seen being distributed by the following 2 URLs.

http://dl-vip.pcfaster.baidu.com.eg/PC_Faster_Setup_Mini_056.exe

http://download.pcfaster.baidu.com.eg/PC_Faster_Setup_Mini_056.exe

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):

Connects to host-105.203.253.104.etisalat.com.eg (105.203.253.104:80)

Remove pc_faster_setup_mini_056.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.