home

combat arms vip 1 march 2016.exe

Nexon Launcher

The executable combat arms vip 1 march 2016.exe has been detected as malware by 17 anti-virus scanners. The file has been seen being downloaded from doc-00-4g-docs.googleusercontent.com.
Product:
Nexon Launcher

Version:
1.0.0.0

MD5:
d5e4141c55b82c04a41d322579771557

SHA-1:
47eac9290340686dc6b65b52dd449d0c7e6936ca

SHA-256:
0fa904c9939a3e5400389c041e5963eb3486a8c47537762b6915616e5e1ae9bd

Scanner detections:
17 / 68

Status:
Malware

Analysis date:
4/26/2024 7:19:16 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
TR/Injector.778240.18
8.3.3.4

avast!
Win32:Trojan-gen
2014.9-160525

AVG
Inject3
2017.0.2733

Comodo Security
UnclassifiedMalware
24955

ESET NOD32
Win32/Injector.CTNR (variant)
10.13454

Fortinet FortiGate
W32/Injector.CTNR!tr
5/25/2016

K7 AntiVirus
Trojan
13.224.19541

Kaspersky
Trojan-Dropper.Win32.Dapato
14.0.0.159

McAfee
Artemis!D5E4141C55B8
5600.6389

Microsoft Security Essentials
Trojan:Win32/Dynamer!ac
1.1.12706.0

NANO AntiVirus
Trojan.Win32.Dapato.easviu
1.0.30.8213

Panda Antivirus
Generic Suspicious
16.05.25.07

Qihoo 360 Security
QVM11.1.Malware.Gen
1.0.0.1120

Rising Antivirus
Trjoan.Generic-cDf8aZJhqOE (Cloud)
23.00.65.16523

Sophos
Mal/Generic-S
4.98

Trend Micro
TROJ_GEN.R00XC0DE716
10.465.25

VIPRE Antivirus
Trojan.Win32.Generic
49210

File size:
760 KB (778,240 bytes)

Product version:
1.0.0.0

Original file name:
nexon_launcher.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\combat arms vip 1 march 2016.exe

File PE Metadata
Compilation timestamp:
4/3/1992 6:56:19 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:SSI0UvsOJhIySY6XZCW81ONNW3P0jcWkD5Sw:SmmshTd81yNwP0jcWy5h

Entry address:
0x121C70

Entry point:
60, BE, 00, B0, 4A, 00, 8D, BE, 00, 60, F5, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89...
 
[+]

Entropy:
6.4169

Packer / compiler:
UPX 2.90LZMA

Code size:
476 KB (487,424 bytes)

The file combat arms vip 1 march 2016.exe has been seen being distributed by the following URL.

https://doc-00-4g-docs.googleusercontent.com/docs/securesc/tvdgs60catbfnfrmc0pdphi6qcjqalm0/qiooa8knj12davsusp6e1o63ltep75hr/1464048000000/.../10920613332903971360/0BxuewbBIGr1pdklOU3pOcGg0RUU?e=download

Remove combat arms vip 1 march 2016.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.