» psemu3-bios.exe
Overview
Analysis
File Details
Downloads (6)

psemu3-bios.exe

The application psemu3-bios.exe has been detected as a potentially unwanted program by 21 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer, however the file is not signed with an authenticode signature from a trusted source. The setup routine uses the RevenYou.Com Pay Per Install platform (OutBrowse) which bundles additional software offers inclduing toolbars, extensions, PC utilities as well as other PUPs. The file has been seen being downloaded from doc-14-2g-docs.googleusercontent.com and multiple other hosts.

File name:

psemu3-bios.exe

MD5:

1d1934bb747bbef4824b05ff5e8fe77c

SHA-1:

f691860660e38eab78f88ca521c51d6f6c6b33ed

SHA-256:

363ea6aee866042602ffbe13b2b84a9a23a824338472cdf9ad49d71f9be86202

Scanner detections:

21 / 68

Status:

Potentially unwanted

Explanation:

Bundles additional adware offers during download and installation using the OutBrowse installer.

Analysis date:

11/24/2024 12:24:22 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Dropped:Application.OutBrowse.B

971

AhnLab V3 Security

PUP/Win32.OutBrowse

2014.06.08

Baidu Antivirus

Adware.Win32.OutBrowse

4.0.3.1468

Bitdefender

Dropped:Application.OutBrowse.B

1.0.20.795

Bkav FE

W32.GenericStrictorL.Trojan

1.3.0.4959

Dr.Web

Adware.Downware.2081

9.0.1.0159

ESET NOD32

Win32/OutBrowse

8.9909

Fortinet FortiGate

Riskware/OutBrowse

6/8/2014

F-Secure

Dropped:Application.OutBrowse.B

11.2014-08-06_1

G Data

Dropped:Application.OutBrowse

14.6.24

K7 AntiVirus

Trojan

13.1712333

Kaspersky

not-a-virus:Downloader.NSIS.OutBrowse

14.0.0.3742

McAfee

Artemis!1D1934BB747B

5600.7105

MicroWorld eScan

Dropped:Application.OutBrowse.B

15.0.0.477

NANO AntiVirus

Trojan.Win32.Generic.cthmwf

0.28.0.60100

Panda Antivirus

Trj/CI.A

14.06.08.03

Quick Heal

Downloader.NSIS.r5 (Not a Virus)

6.14.14.00

Sophos

Generic PUA PG

4.98

Trend Micro House Call

TROJ_GEN.R047H07DE14

7.2.159

Vba32 AntiVirus

Downloader.OutBrowse

3.12.26.0

VIPRE Antivirus

Trojan.Win32.Generic

30042

File size:

965.4 KB (988,554 bytes)

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Language:

Turkish (Turkey)

Common path:

C:\users\{user}\downloads\psemu3-bios.exe

File PE Metadata

Compilation timestamp:

12/6/2009 12:50:52 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

24576:yhI7mcC0Wa3k3p8SJiJYWJipUi7vcJ3YONye1tVAwjbPQl7y:JilQkZpJiGWJipU+EGOA4tVh/PS7y

Entry address:

0x30FA

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00... 
[+]

Packer / compiler:

Nullsoft install system v2.x

Code size:

23.5 KB (24,064 bytes)

The file psemu3-bios.exe has been seen being distributed by the following 6 URLs.

https://doc-14-2g-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/tsv1af2dh99lbani63ethfejs4861lb1/1402927200000/02389099468332117340/.../0BwElGBuh7RFGQlJQVWRMT3JrejQ?h=16653014193614665626

https://doc-0k-34-docs.googleusercontent.com/docs/securesc/0ka3s5tf40v2s3cl200inrnj17fg961a/60c27vmv5eiho8jb4t3mlr42pc2h4epq/1402862400000/02389099468332117340/.../0BwElGBuh7RFGQlJQVWRMT3JrejQ?h=16653014193614665626&nonce=2vga05vchsp8c&user=12715966334689346964&hash=bc4m9s94p2v1om0ltigo3n5fro6m5j6s

https://docs.google.com/nonceSigner?nonce=2vga05vchsp8c&continue=https://doc-0k-34-docs.googleusercontent.com/docs/securesc/0ka3s5tf40v2s3cl200inrnj17fg961a/60c27vmv5eiho8jb4t3mlr42pc2h4epq/1402862400000/02389099468332117340/.../0BwElGBuh7RFGQlJQVWRMT3JrejQ?h=16653014193614665626&hash=7c12501m6oelm4nplcetj0s28tgk97i2

https://doc-0c-6o-docs.googleusercontent.com/docs/securesc/m30a7i4336vlnof2jvelaf7v9bmehksm/h42a573a9s63l0egj6ggbipa6tr08jto/1402286400000/02389099468332117340/.../0BwElGBuh7RFGQlJQVWRMT3JrejQ?h=16653014193614665626

https://drive.google.com/uc?id=0BwElGBuh7RFGQlJQVWRMT3JrejQ

Remove psemu3-bios.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.