home

updateneurowise.exe

Summit Index

The application updateneurowise.exe by Summit Index has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a separate (within the context of its own process) windows Service named “Update neurowise”.
Publisher:
Summit Index  (signed and verified)

Version:
1.0.6281.2442

MD5:
22c5ff9a5611b09f22747322dbd485bb

SHA-1:
0a079b793f5d9f45b3bc6b3e392169740c71ed15

SHA-256:
0cd720ed03468bf8d6ff9bb2d2894cd97fcd2a00da255980a21f4a88b7d08be2

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/30/2024 10:10:38 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Yontoo (M)
17.3.13.10

File size:
649.7 KB (665,280 bytes)

Product version:
1.0.6281.2442

Original file name:
neurowise2017031309.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\Program Files\neurowise\updateneurowise.exe

Digital Signature
Signed by:
Summit Index

Authority:
VeriSign, Inc.

Valid from:
6/6/2016 4:30:00 AM

Valid to:
6/7/2017 4:29:59 AM

Subject:
CN=Summit Index, O=Summit Index, L=San Diego, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
6F03794B9D940D09B9F5A06391E0CB1F

File PE Metadata
Compilation timestamp:
3/13/2017 12:51:31 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
11.0

.NET CLR dependent:
Yes

Entry address:
0xA22BE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.2049

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
641 KB (656,384 bytes)

Service
Display name:
Update neurowise

Type:
Win32OwnProcess


The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to a23-3-98-8.deploy.static.akamaitechnologies.com  (23.3.98.8:80)

TCP (HTTP):
Connects to a23-3-98-17.deploy.static.akamaitechnologies.com  (23.3.98.17:80)

TCP (HTTP):
Connects to a95-100-170-42.deploy.akamaitechnologies.com  (95.100.170.42:80)

TCP (HTTP):
Connects to a23-3-98-24.deploy.static.akamaitechnologies.com  (23.3.98.24:80)

TCP (HTTP):
Connects to a23-201-103-122.deploy.static.akamaitechnologies.com  (23.201.103.122:80)

TCP (HTTP):
Connects to a184-25-108-41.deploy.static.akamaitechnologies.com  (184.25.108.41:80)

TCP (HTTP):
Connects to a104-95-190-10.deploy.static.akamaitechnologies.com  (104.95.190.10:80)

Remove updateneurowise.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.