» microsoft-office-professional-2007.exe
Overview
Analysis
File Details
Downloads (1)

microsoft-office-professional-2007.exe

Nos

Fanetet

The application microsoft-office-professional-2007.exe, “Nos Setup ” has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.

File name:

Publisher:

Fanetet

Product:

Nos

Description:

Nos Setup

Version:

3.4.1.2

MD5:

c9c50b6563b85009597730ec20d9bbef

SHA-1:

ba19841bf1b6f67524c61ac16e88a8adba4778dd

SHA-256:

936b172112f1efbb284cdaf39ff9615afc35852cbe72acd66f8acb9bc8caaa26

Scanner detections:

1 / 68

Status:

Potentially unwanted

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:

5/21/2024 2:21:18 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore (L)

16.8.5.20

File size:

1 MB (1,061,112 bytes)

Product version:

4.7.0

File wizard

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\microsoft-office-professional-2007.exe

File PE Metadata

Compilation timestamp:

6/20/1992 6:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:PqiYW7uFl5qjOjWBCSVmN489Oom3c1jxkWaVXFDmy:PjYPwjOjWBKjOFCxkWaLq

Entry address:

0xA5F8

Entry point:

60, 8A, EC, 31, F2, EB, 02, 85, F3, 0F, AF, C3, C7, C0, 36, 81, AD, 42, 40, FF, CF, 0F, AF, F9, 85, FF, 8B, D8, 3A, C2, 74, 08, 86, F7, 8D, 1D, 2A, 4B, AF, 62, E8, 40, 00, 00, 00, BF, 00, 00, 00, 00, 78, 07, C6, C1, 6E, FE, C2, FE, C7, 0F, AF, C2, 0F, AF, EE, 69, C7, BD, 83, 59, 44, 0F, AF, F0, 81, C7, 01, 00, 00, 00, 84, FD, 8B, ED, 04, A3, 84, DD, C7, C1, 78, 20, 11, 75, 0F, B7, DE, 81, FF, 3C, 04, 00, 00, 0F, 8C, C5, FF, FF, FF, 6B, F6, 00, B4, FC, 32, F1, FE, C3, F3, EB, 0A, 0C, 86, 8D, 2D, 02, 7D, A4... 
[+]

Entropy:

7.9364 (probably packed)

Code size:

39.5 KB (40,448 bytes)

The file microsoft-office-professional-2007.exe has been seen being distributed by the following URL.

http://www.factoryheadcentral.com/c?x=pgWORymAzWUtZSZ4nyhKQGU383c1HliSNuebXNhnc0A=&c=xyMRKjkXWdD1MJM0QVL80afxn3j1jWQ7EcWKqVPaCZ9XKULRW5goQ N1xwnkOokcYI27VcCxtUyT EPwFgFLJy/5eUF0Hp8ltv56 kx4ZFLx2AN8U8SDR5mqsxAQQvU1BpSrQXp53aTMdiJcA5vtZggroYcxoPvaYOj4G7sBAMg=&e=0&downloadAs=microsoft-office-professional-2007.exe&fallback_url=http://pf.benjaminstrahs.com/s/1467174636/en/4/.../46039-1800344-microsoft-office-professional-2007.exe

Remove microsoft-office-professional-2007.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.