home

qrnyehzs.exe

KPI Media Group

The file qrnyehzs.exe by KPI Media Group has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from intva31.printerboot.info and multiple other hosts.
Publisher:
KPI Media Group  (signed and verified)

MD5:
5a43fdf7e6c1725a245787c57ed6fbf9

SHA-1:
63ce41030df9af2dfb3d33f75f16252af49e3d7a

SHA-256:
ad97f3bc72af65f0f1b85df6c824584c19a8c6bb0e2619ec663bb1d6424be199

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/30/2024 9:07:43 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.DownloadAdmin.KPIMedia (M)
16.3.12.11

File size:
94.3 KB (96,512 bytes)

Common path:
C:\users\{user}\appdata\local\temp\qrnyehzs.exe.part

Digital Signature
Signed by:
KPI Media Group

Authority:
GoDaddy.com, Inc.

Valid from:
12/9/2015 6:34:38 AM

Valid to:
12/9/2016 6:34:38 AM

Subject:
CN=KPI Media Group, O=KPI Media Group, L=" Oakland ", S=California, C=US

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
5E43099D2166479B

File PE Metadata
Compilation timestamp:
2/9/2016 4:45:34 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
1536:3avIn5zCdzdMwdvCDggKwe2kYERFNcu8Ww1BsWjcdNkVzGZtBNFRJr:hJQbIqweXH8juNqzGZtpD

Entry address:
0x2E1D

Entry point:
E8, FC, 41, 00, 00, E9, 7F, FE, FF, FF, 55, 8B, EC, FF, 15, A4, F0, 40, 00, 6A, 01, A3, C4, 64, 41, 00, E8, 49, 47, 00, 00, FF, 75, 08, E8, DE, 46, 00, 00, 83, 3D, C4, 64, 41, 00, 00, 59, 59, 75, 08, 6A, 01, E8, 2F, 47, 00, 00, 59, 68, 09, 04, 00, C0, E8, AC, 46, 00, 00, 59, 5D, C3, 55, 8B, EC, 81, EC, 24, 03, 00, 00, 6A, 17, E8, 9C, BF, 00, 00, 85, C0, 74, 05, 6A, 02, 59, CD, 29, A3, A8, 62, 41, 00, 89, 0D, A4, 62, 41, 00, 89, 15, A0, 62, 41, 00, 89, 1D, 9C, 62, 41, 00, 89, 35, 98, 62, 41, 00, 89, 3D, 94...
 
[+]

Entropy:
6.4903

Code size:
56 KB (57,344 bytes)

The file qrnyehzs.exe has been seen being distributed by the following 33 URLs.

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=80433609&filename=adobe_flash_player.exe&cb=-1343045893&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=81520087&filename=adobe_flash_player.exe&cb=1474246520&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=80852923&filename=adobe_flash_player.exe&cb=1154206797&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=80125867&filename=adobe_flash_player.exe&cb=-1072800406&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=80805259&filename=adobe_flash_player.exe&cb=-1352659989&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=80930925&filename=adobe_flash_player.exe&cb=353860212&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=81503757&filename=adobe_flash_player.exe&cb=1267075143&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=81075115&filename=adobe_flash_player.exe&cb=-46426086&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=82031527&filename=Sandra&cb=2107989933&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=80917005&filename=adobe_flash_player.exe&cb=573765666&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=80134883&filename=adobe_flash_player.exe&cb=-1505870808&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=81977913&filename=adobe_flash_player.exe&cb=-1370864723&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=79998839&filename=adobe_flash_player.exe&cb=258077382&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=80231235&filename=adobe_flash_player.exe&cb=1328744162&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=81159377&filename=adobe_flash_player.exe&cb=1265991399&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=80884651&filename=adobe_flash_player.exe&cb=1944014620&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=80046915&filename=adobe_flash_player.exe&cb=1514958656&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=80977779&filename=adobe_flash_player.exe&cb=234290606&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=80107593&filename=adobe_flash_player.exe&cb=1034273456&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=80476237&filename=adobe_flash_player.exe&cb=632131776&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=80204843&filename=adobe_flash_player.exe&cb=739906907&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=80382221&filename=adobe_flash_player.exe&cb=-191656489&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=81871013&filename=adobe_flash_player.exe&cb=481302923&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=80495617&filename=adobe_flash_player.exe&cb=46893620&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=80217349&filename=adobe_flash_player.exe&cb=-1897597337&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=81816387&filename=adobe_flash_player.exe&cb=1871082633&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=80039593&filename=adobe_flash_player.exe&cb=-82636190&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=80125317&filename=adobe_flash_player.exe&cb=677636209&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=81027223&filename=adobe_flash_player.exe&cb=-1464993144&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.printerboot.info/dl-pure/1200543/.../?bc=1200543&checksum=81701019&filename=adobe_flash_player.exe&cb=405381172&hashstring=jb31216&usefilename=true&executableroutePath=1200375&stub=true

Latest 30 of 33 download URLs

Remove qrnyehzs.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.