home

universe_sandbox_2.exe

Nemi

Morava Group

The application universe_sandbox_2.exe, “Nemi Setup ” by Morava Group has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.bulksharetown.com.
Publisher:
Hakomanak   (signed by Morava Group)

Product:
Nemi

Description:
Nemi Setup

MD5:
c7dfe7333ffc3a5668091a70dedf17d2

SHA-1:
0dec262c0c9016e1e88c258558fc99b112885dbe

SHA-256:
3964d8d7cf7d429582d57ae8a5435a588dec50634e5c4644d4f4ba02f6319fbc

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/24/2024 7:31:32 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore (M)
17.3.4.0

File size:
1.1 MB (1,154,800 bytes)

Product version:
5.4.0

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\universe_sandbox_2.exe

Digital Signature
Signed by:
Morava Group

Authority:
GlobalSign nv-sa

Valid from:
3/7/2016 12:28:01 AM

Valid to:
3/8/2017 12:28:01 AM

Subject:
CN=Morava Group, O=Morava Group, L=Towson, C=US

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121A83F14C1C6D435814D1A4B9EC949DB5C

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9828

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file universe_sandbox_2.exe has been seen being distributed by the following URL.

http://www.bulksharetown.com/.../NXKg60lTSEtp0csDnmYXp775aPCG2C2ik53TE1ZvluIH9DzyjRtFyDUhe9ZfKK0t5eg4sr4V0Zycox0 k5Kump8xHEzRXq91 XpNajfQGNVnIZrZlVWvqcC5ZeMXlt8ItH eX1xdmwZLJGkr9IYNJfvNGLvnvfs=&downloadAs=universe_sandbox_2.exe&fallback_url=Fallback URL

Remove universe_sandbox_2.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.