» nacl64.exe
Overview
Analysis
File Details
Programs (1)

nacl64.exe

Oxy

FINEDREAM INVEST LTD

This adware is a web browser extension that will inject advertising in the browser in the form of unwanted banners and text-links which may link to malware sites and install unwanted software. The application nacl64.exe by FINEDREAM INVEST has been detected as adware by 2 anti-malware scanners. This file is typically installed with the program Oxy version 1.0 by Escolade Solutions LTD which is a potentially unwanted software program. It is part of the Brightcircle group of web-extensions that inject advertisements in the browser.

File name:

nacl64.exe

Publisher:

Escolade Solutions LTD (signed by FINEDREAM INVEST LTD)

Product:

Oxy

Version:

24.0.1302.0

MD5:

4fc3f84fd77baeefb0fe88e70e63eb66

SHA-1:

15d02621c5392a5256146a8766992db946331775

SHA-256:

2aa6b0695a4388c3d9f4b9287a4b84752d523c47121673580857998f08cb22ff

Scanner detections:

2 / 68

Status:

Adware

Analysis date:

4/27/2024 2:31:59 AM UTC (today)

Scan engine

Detection

Engine version

avast!

Win32:Adware-BGS [PUP]

2014.9-140130

Reason Heuristics

PUP.FINEDREAMINVEST.G

14.8.7.22

File size:

1.2 MB (1,246,080 bytes)

Product version:

24.0.1302.0

Original file name:

nacl64.exe

File type:

Executable application (Win64 EXE)

Common path:

C:\users\{user}\appdata\local\oxy\application\24.0.1302.0\nacl64.exe

Digital Signature

Signed by:

FINEDREAM INVEST LTD

Authority:

COMODO CA Limited

Valid from:

10/1/2013 1:00:00 AM

Valid to:

10/2/2014 12:59:59 AM

Subject:

CN=FINEDREAM INVEST LTD, O=FINEDREAM INVEST LTD, STREET=11 ROSEMONT ROAD HAMPSTEAD, L=LONDON, S=HAMPSTEAD, PostalCode=NW3 6NG, C=GB

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00C5ED3DAB73641CD0D161EE50202FB462

File PE Metadata

Compilation timestamp:

8/26/2013 10:00:31 PM

OS version:

5.2

OS bitness:

Win64

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

24576:tI0peGzDJV17DeNERjHxHDwjyYyaKsHpH1R5vYD7oggkuCJ8N:eIzDJVlXHxjweYyaDJH1DE7rgk2

Entry address:

0xA7CE4

Entry point:

48, 83, EC, 28, E8, 4B, DC, 00, 00, 48, 83, C4, 28, E9, 52, FE, FF, FF, CC, CC, 48, 89, 0D, 09, 71, 0A, 00, C3, 48, 89, 5C, 24, 08, 48, 89, 6C, 24, 10, 48, 89, 74, 24, 18, 57, 48, 83, EC, 20, 48, 8B, E9, 48, 8B, 0D, EA, 70, 0A, 00, FF, 15, AC, 88, 02, 00, 48, 8B, F8, 48, 85, ED, 75, 18, E8, B3, 29, 00, 00, BB, 16, 00, 00, 00, 89, 18, E8, B7, E9, FF, FF, 8B, C3, E9, AB, 00, 00, 00, 83, 65, 00, 00, 48, 85, C0, 75, 7E, 48, 8D, 0D, 34, F1, 04, 00, FF, 15, 16, 85, 02, 00, 48, 8B, F0, 48, 85, C0, 74, CA, 48, 8D... 
[+]

Entropy:

6.4054

Code size:

827.5 KB (847,360 bytes)

The file nacl64.exe has been discovered within the following program.

Oxy version 1.0 by Escolade Solutions LTD

Distributed by FINEDREAM INVEST LTD, this is a bundled adware program.

www.product-placements.com

85% remove it

Remove nacl64.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.