nbw.exe

NeoBook 5.8.4

NeoSoft Corp.

The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
Publisher:
NeoSoft Corp.   (signed by NeoSoft Corp.)

Product:
NeoBook 5.8.4

Description:
NeoBook 5

Version:
5.8.4

MD5:
2460d3e0308afc877d2a963cb7d777d8

SHA-1:
7bf55640ff4227269b0c8d3bba9d6893f9ac00b5

SHA-256:
60078dcf243efb368415eb0dd5bc4007a9a41237da161e1e26a2e1f25bac00a9

Scanner detections:
2 / 68

Status:
Clean  (2 probable false positive detections)

Explanation:
These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:
4/24/2024 9:09:52 AM UTC  (today)

Scan engine
Detection
Engine version

NANO AntiVirus
Trojan.Win32.Diztakun.djhljp
0.30.8.659

Vba32 AntiVirus
Trojan.Diztakun
3.12.26.3

File size:
12.1 MB (12,720,472 bytes)

Product version:
5.8.4

Copyright:
©2013 NeoSoft Corp.

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\downloads\nbw.exe

Digital Signature
Signed by:

Authority:
VeriSign, Inc.

Valid from:
4/3/2013 2:00:00 AM

Valid to:
4/4/2014 1:59:59 AM

Subject:
CN=NeoSoft Corp., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=NeoSoft Corp., L=Bend, S=Oregon, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
2594B3CEDA5DBD5227204744ADE6800F

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
393216:hgLHN/9RBL36gryBoeh9xMZjVS2cdufmJ0N:hgLt/9Rl6guLxMZjVnNmJ0N

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file nbw.exe has been seen being distributed by the following 12 URLs.

http://gsf-cf.softonic.com/7bf/556/.../file?SD_used=0&channel=WEB&fdh=no&id_file=16466&instance=softonic_es&type=PROGRAM&Expires=1479359831&Signature=NhY59WnqbNZVJlTS1F9ZV9cWewDDrq-0BNiMDkbhrDmBS-AnY1VethjaREdPm-Db4vq-Ur0XuIAuj0bebgDMwPEyBAHIkyqM1a1QEa3s4JLRnpXu~pI~jS8Fz2pMTn0An6uEH3UGSk1bSs1Fp7NGFDyEy4EqGXICimPbNPxFBk8_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=nbw.exe

http://global-shared-files-lw.softonic.com/7bf/556/.../nbw.exe

http://gsf-cf.softonic.com/7bf/556/.../file?SD_used=0&channel=WEB&fdh=no&id_file=16466&instance=softonic_es&type=PROGRAM&Expires=1482819461&Signature=AIc7V5JmTGsVwW65dnk9cJiHtb5SxevUUgXJzzRbhVNFnZEDTS9Z0RYZWHpGSLnc0NdIBS8fpF~tHFaQOK1KKrj1YncZlhcnBJefM-mMD2hROfcLkNF92gc4XqEkrDmb5QsQ6coC~Bn7MmLfE4gBVxhhKUv982w7Kjmqz8LIOgc_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=nbw.exe

http://gsf-cf.softonic.com/7bf/556/.../file?SD_used=0&channel=WEB&fdh=no&id_file=16466&instance=softonic_es&type=PROGRAM&Expires=1443007976&Signature=JRFq5xszz8xmDwwHfKz8-Nv5t6RQVZ5VG8AZcNzTkzmo1dKJdkDNpuhQuomSfSaU0EBO36C98wMIuJSqCFBHBhHLC9RB~KjqJoja6RmdP15ch88d8MCSbzroTRD98rAFRwaL20w55CjT0ub0ZVzKnnUgmy9tO~ofFmeU4UvN5Kk_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=nbw.exe

http://gsf-cf.softonic.com/7bf/556/.../file?SD_used=0&channel=WEB&fdh=no&id_file=16466&instance=softonic_es&type=PROGRAM&Expires=1471612063&Signature=RB-bCuWMcoLHgMTHXUTcWNQA9Pk3a9tHYAv-lThqJzp~thR3rX~sv2IqXHXgwqHpf8Fguqeijf20ht9IL~tX27WZ89y2Ls~axMPZYgKi9quakUf0EIVytTq~qHvmMQ8z0wRe6gH~j0Qijzfy9A7IB-VoM3cYT0kyx3lEv1BDk2U_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=nbw.exe

http://gsf-cf.softonic.com/7bf/556/.../file?SD_used=0&channel=WEB&fdh=no&id_file=16466&instance=softonic_es&type=PROGRAM&Expires=1434086123&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=QBNM06TT1dUmLCPn8bYdtqYYJJqcMv2bTpw7lR4hGttoO5C2vtiNrxiLsM5iO37OuYbDPgbJIVuRJZT9reQvPNIInVq4ZB-8TVOkf1cqpigKn-u~0eh2Ewa21L7cEbCOIXaJulQuklz6S2R~F9BHEgE42eQJdpj9XLJ3vdlopcc_&filename=nbw.exe

http://gsf-cf.softonic.com/7bf/556/.../file?SD_used=0&channel=WEB&fdh=no&id_file=16466&instance=softonic_es&type=PROGRAM&Expires=1478872972&Signature=EdbygfvH0nGQhRTujMonCzST3Z2eQZgvcfjiTeF0cHNp8IuERhJpa0b1NWC5n5JAklqz7vgJ9-UB1JVXz7MES2VrXXDAZsac23scYSCEvFCncRviczQL7mbAComoSPon9jhv-5ZPZxV5tUwthaF2lLasw8cHc8yPHsHxEbNb4JA_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=nbw.exe

Scan nbw.exe - Powered by Reason Core Security