home

nef to jpg distribué par getnow.exe

Interactive Install

IMINENT TECHNOLOGY SRL

This is the SIEN AppScion Installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application nef to jpg distribué par getnow.exe by IMINENT TECHNOLOGY SRL has been detected as a potentially unwanted program by 13 anti-malware scanners. The program is a setup application that uses the SIEN SuperInstall installer. The file has been seen being downloaded from stapi.maxrevinstaller.com.
Publisher:
Live Soft Action S. R. L.   (signed by IMINENT TECHNOLOGY SRL)

Product:
Interactive Install

Version:
8.31.4.2

MD5:
a14b024d0921b54d7c65be2e95bdd86e

SHA-1:
0d705f0649073c4e7e0fd94b0392d1660184f72b

SHA-256:
9ade5c1c1f8e3b7811ff8d8a5347738eb520fd757fe45a300e1e38c7345c4700

Scanner detections:
13 / 68

Status:
Potentially unwanted

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
4/27/2024 2:07:09 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

Avira AntiVirus
APPL/Downloader.Gen
7.11.170.42

AVG
Generic
2015.0.3387

Dr.Web
Adware.Downware.6682
9.0.1.0245

ESET NOD32
Win32/GetNow.B potentially unwanted application
8.7.0.302.0

G Data
Win32.Application.Getnow
14.8.24

herdProtect (fuzzy)
variant of konica minolta maxxum 9xi user guide provided through pdfretriever.com.exe (PUP)
2014.10.12.17

IKARUS anti.virus
PUA.Getnow
t3scan.1.6.1.0

Malwarebytes
PUP.Optional.LiveSoftAction
v2014.08.10.06

McAfee
LiveSoftAction
5600.7019

NANO AntiVirus
Riskware.Win32.Downware.ddubbf
0.28.2.61861

Reason Heuristics
Threat.Win.Reputation.IMP
14.9.2.17

VIPRE Antivirus
Threat.4150696
31208

File size:
727.2 KB (744,632 bytes)

Product version:
8.31.4.2

Copyright:
(c) Live Soft Action S .R .L . All rights reserved.

Original file name:
Setup.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
SIEN SuperInstall

Language:
English (United States)

Common path:
C:\users\{user}\downloads\nef to jpg distribué par getnow.exe

Digital Signature
Signed by:
IMINENT TECHNOLOGY SRL

Authority:
GlobalSign nv-sa

Valid from:
7/15/2014 3:59:54 PM

Valid to:
7/16/2015 3:59:54 PM

Subject:
CN=IMINENT TECHNOLOGY SRL, O=IMINENT TECHNOLOGY SRL, L=Bucuresti, C=RO

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112117283610FD537B23B681DB2FB2853FE5

File PE Metadata
Compilation timestamp:
7/31/2014 10:52:08 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:8LInoKjH18tf4iD0rmsWq3DbCgnfLxsgvGvMiko6v/azLla+YqkYUy90iu:C4omHWB4ioye3DeyWvaoAac+o9yFu

Entry address:
0x1B13E0

Entry point:
60, BE, 00, 40, 51, 00, 8D, BE, 00, D0, EE, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B...
 
[+]

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:
632 KB (647,168 bytes)

The file nef to jpg distribué par getnow.exe has been seen being distributed by the following URL.

http://stapi.maxrevinstaller.com/api/.../setup.exe

Remove nef to jpg distribué par getnow.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.