home

322_9222tr_upcleaner.exe

Navigation network co.,limited

The application 322_9222tr_upcleaner.exe by Navigation network co.,limited has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from en.softonic.com.
Publisher:
Navigation network co.,limited  (signed and verified)

Version:
2.0.0.1

MD5:
c786d5a9157cb90e6081f7910878e2bc

SHA-1:
c58a18f2c193661204ceff106b646c751dc18830

SHA-256:
1281462afbcbdeeef3b893726ebfbf93452c40bd82934856efd11f189e5e3488

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
4/18/2024 4:25:56 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Navigationnetworkcolimited (M)
16.2.8.16

File size:
896.4 KB (917,904 bytes)

Product version:
2.0.0.1

Copyright:
Copyright (C) 2014

Original file name:
Download.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\programs\322_9222tr_upcleaner.exe

Digital Signature
Signed by:
Navigation network co.,limited

Authority:
VeriSign, Inc.

Valid from:
2/19/2014 5:00:00 AM

Valid to:
2/20/2016 4:59:59 AM

Subject:
CN="Navigation network co.,limited", OU=Software Department, OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Navigation network co.,limited", L=Hongkong, S=Hongkong, C=HK

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
2617E71F3DD61639E291AD2D048E1D8A

File PE Metadata
Compilation timestamp:
8/18/2015 9:08:00 AM

OS version:
6.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
24576:OTkJrlH0uaaNU7bf1W1GKTAcAk1Y3H7xj9DLbbt+GZclmMDtiQsIy:7ef1beAZWmesIy

Entry address:
0x572CC

Entry point:
E8, 30, E4, 00, 00, E9, 7F, FE, FF, FF, E8, 45, CD, 00, 00, 69, 48, 14, FD, 43, 03, 00, 81, C1, C3, 9E, 26, 00, 89, 48, 14, C1, E9, 10, 81, E1, FF, 7F, 00, 00, 8B, C1, C3, 55, 8B, EC, E8, 21, CD, 00, 00, 8B, 4D, 08, 89, 48, 14, 5D, C3, 55, 8B, EC, 8B, 45, 14, 56, 85, C0, 74, 3C, 83, 7D, 08, 00, 75, 13, E8, 64, 39, 00, 00, 6A, 16, 5E, 89, 30, E8, A5, 72, 00, 00, 8B, C6, EB, 25, 83, 7D, 10, 00, 74, E7, 39, 45, 0C, 73, 09, E8, 46, 39, 00, 00, 6A, 22, EB, E0, 50, FF, 75, 10, FF, 75, 08, E8, C5, D6, FF, FF, 83...
 
[+]

Entropy:
6.5441

Code size:
469 KB (480,256 bytes)

The file 322_9222tr_upcleaner.exe has been seen being distributed by the following URL.

http://en.softonic.com/sads/tracker.php?ev=c&co=TR&sid=a2db4f06fcdeffa9b4f355cda5ad482e&upv=e5adae144e11c0091c2bd3b2417bec60&z=results&sk=0&abp=0&params=F39B2A32BFC101987B1458170C278E032123FF0E09F5565AD6A3C9E074A2DA092AEB0BABE0F0781B76A3E5EF4D085DB55C599A23B11D2E5520E77B05DC951CE4A92BF9F4B215B1814C380B6694EB39DDB308622B005ED80C47A47EBABD7821F9310E093BC881FDD545DF81771F3B7E81AFC48B6A8F0DA72CAE3FE6A357E0EB410B0CA64D53D3F7B201A10BD56B2BEEBE867D3E1FE80C9E26A0BB8CFFFBB515A8362DA7C7DFF508CFFD25F8DBBA7C4F9B&h=F37C7C9F6BFD8C39890D7D7CF260D00AA981690A6ADC921A11EDB9C45B8825C7&directdownload=1&f=69710346&d=http://d5qlpohh1zul3.cloudfront.net/.../322_9222tr_Upcleaner.exe

Remove 322_9222tr_upcleaner.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.