home

910-arw6.exe

NowSmart Limited

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from ftp-stahuj.centrum.cz and multiple other hosts.
Publisher:
NowSmart Limited  (signed and verified)

MD5:
d2f0730f701e100f17e7239c93105ecc

SHA-1:
2e5600259a792791e9facbcd9c11e15cee8af94d

SHA-256:
08e5ea9692a78333ab1152991846d91a42d71c5d00ab86cfa916bc04a5dbdfdb

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 10:06:17 PM UTC  (today)

File size:
3.8 MB (3,963,032 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Digital Signature
Signed by:
NowSmart Limited

Authority:
WoSign, Inc.

Valid from:
1/19/2011 1:00:00 AM

Valid to:
1/19/2014 12:59:59 AM

Subject:
CN=NowSmart Ltd., OU=WoSign Class 3 Code Signing, O=NowSmart Limited, L=HONGKONG, S=HONGKONG, C=CN

Issuer:
CN=WoSign Code Signing Authority, O="WoSign, Inc.", C=US

Serial number:
7FC08A6E306CF094303415F8882ABDB8

File PE Metadata
Compilation timestamp:
12/5/2009 11:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
98304:KPFL4DPGKyBm2oEijkxwoE9tZXBlxnH/C8j0E:KPFLmGEjGwh9tZRlxH/Cc3

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file 910-arw6.exe has been seen being distributed by the following 23 URLs.

http://ftp-stahuj.centrum.cz/dl/13f2e4bcb9814c4d686e4464d36b9c00/586d5428/stahuj/download/software/secured/a/audio-record-wizard/.../arw6.exe

http://ftp-stahuj.centrum.cz/dl/674d94d4add5f54087528f4e123d236c/56926a70/stahuj/download/software/secured/a/audio-record-wizard/.../arw6.exe

http://ftp-stahuj.centrum.cz/dl/9ebd5799061be399db1c34687aacf4cc/58500138/stahuj/download/software/secured/a/audio-record-wizard/.../arw6.exe

http://ftp-stahuj.centrum.cz/dl/0df56cbce76d6b63b864383720196d88/58146c44/stahuj/download/software/secured/a/audio-record-wizard/.../arw6.exe

http://ftp-stahuj.centrum.cz/dl/3744845a6b3c522e20308043e803db36/5835ab92/stahuj/download/software/secured/a/audio-record-wizard/.../arw6.exe

http://ftp-stahuj.centrum.cz/dl/fd4fab7c790a71e7ba415d01ef90b698/56435268/stahuj/download/software/secured/a/audio-record-wizard/.../arw6.exe

http://ftp-stahuj.centrum.cz/dl/9445ecf9635637afeb62fab971895df5/57da4f5b/stahuj/download/software/secured/a/audio-record-wizard/.../arw6.exe

http://ftp-stahuj.centrum.cz/dl/667383343d751cd2663b00ab87c6a074/583978ee/stahuj/download/software/secured/a/audio-record-wizard/.../arw6.exe

http://ftp-stahuj.centrum.cz/dl/2502d55233f4e699b1eb9b550ae293a9/57deb7c9/stahuj/download/software/secured/a/audio-record-wizard/.../arw6.exe

http://ftp-stahuj.centrum.cz/dl/043a4b8c2cab3cbbeb5af3613b98ad41/58162d03/stahuj/download/software/secured/a/audio-record-wizard/.../arw6.exe

http://ftp-stahuj.centrum.cz/dl/94a9012e7362af30586742b31309853c/57cb49cb/stahuj/download/software/secured/a/audio-record-wizard/.../arw6.exe

http://ftp-stahuj.centrum.cz/dl/f784c16ae3d3ff7965ad696ffd4a68ee/57b5bd38/stahuj/download/software/secured/a/audio-record-wizard/.../arw6.exe

http://ftp-stahuj.centrum.cz/dl/cc242ed2a4132a608d00fa1d0706295d/559199ee/stahuj/download/software/secured/a/audio-record-wizard/.../arw6.exe

http://ftp-stahuj.centrum.cz/dl/a96446a6d4b730748703c8df10341b07/574ec605/stahuj/download/software/secured/a/audio-record-wizard/.../arw6.exe

http://ftp-stahuj.centrum.cz/dl/d504b87ba181e7ab705a7bb5aca8c690/56ed3ff0/stahuj/download/software/secured/a/audio-record-wizard/.../arw6.exe

http://ftp-stahuj.centrum.cz/dl/5f87514592ae5d38d9ed0ca49e9e3d11/5783716a/stahuj/download/software/secured/a/audio-record-wizard/.../arw6.exe

http://ftp-stahuj.centrum.cz/dl/5fcea952cf2558c4c7fa5f8a874625e4/5777d8bd/stahuj/download/software/secured/a/audio-record-wizard/.../arw6.exe

http://ftp-stahuj.centrum.cz/dl/6327281f482d9a5bbde561f12a8cf4b6/568145a4/stahuj/download/software/secured/a/audio-record-wizard/.../arw6.exe

http://dw.uptodown.com/dwn/jf9kmJULPVt2eFMe1TTlCaqmZ6szAOwOS3k-Wv3NGUvESOxt0KuFdtfEmbDFKzaRE4xGyfmLQVzn1GVxpZBGPTmzcenhPNjwGCGk9iqd-0ZfxZjNgF1RRIakBcIcaf90/NwZZNm1jBe5PPrVakT5mULR-XAQ7Lq_xeK9m0RnaSN3HV0xX85uZZL7mQ3ZholGH16IFc3d31fShNW5s4MuleBpFMiNBjZuBrEaJrxoD0ryxShiyXypTmum2T2czWlKx/.../

http://ftp-stahuj.centrum.cz/dl/c50dd2d58ee97e628e7987ea2785b9ca/569e5fe2/stahuj/download/software/secured/a/audio-record-wizard/.../arw6.exe

http://ftp-stahuj.centrum.cz/dl/5f568867033f1c4132ea1eeb16e325b6/56a13f9d/stahuj/download/software/secured/a/audio-record-wizard/.../arw6.exe

http://ftp-stahuj.centrum.cz/dl/018b14cc05a8f51f3728e15c1cc82af6/55e9cb74/stahuj/download/software/secured/a/audio-record-wizard/.../arw6.exe

http://ftp-stahuj.centrum.cz/dl/2a3224c0b695bc5e1627d5f5fdf47175/552a414f/stahuj/download/software/secured/a/audio-record-wizard/.../arw6.exe

Scan 910-arw6.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.