home

net framework 4.5.1.exe

Microsoft .NET Framework

The application net framework 4.5.1.exe has been detected as a potentially unwanted program by 37 anti-malware scanners. This is a setup program which is used to install the application. It uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from dotnetframework.1800download.com.
Product:
Microsoft .NET Framework

Version:
1.0.0.0

MD5:
c39b9d156d2d0c004cef0b2bd9dd1b2b

SHA-1:
ad9c891bde9ee93c8424de9d09add0ff9677634a

SHA-256:
a2f793e1fe31e2a1c3e3abedd46d2cd72dfa7f65aed18d391f821a3b4afd2853

Scanner detections:
37 / 68

Status:
Potentially unwanted

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
4/20/2024 12:46:48 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Win32.Sality.3
6217246

Agnitum Outpost
Win32.Sality.BL
7.1.1

AhnLab V3 Security
Win32/Kashu.E
2015.04.01

Avira AntiVirus
W32/Sality.AT
3.6.1.96

avast!
SaliCode
150319-1

AVG
Win32/Sality
2014.0.4311

Baidu Antivirus
Virus.Win32.Sality.$Emu
4.0.3.1541

Bitdefender
Win32.Sality.3
1.0.20.455

Bkav FE
W32.Sality.PE
1.3.0.6379

Comodo Security
Virus.Win32.Sality.gen
21608

Dr.Web
Win32.Sector.30
9.0.1.05190

Emsisoft Anti-Malware
Win32.Sality
9.0.0.4799

ESET NOD32
Win32/Sality.NBA virus
7.0.302.0

F-Prot
W32/Sality.gen2
4.6.5.141

F-Secure
Win32.Sality.3
5.13.68

G Data
Win32.Sality
15.4.25

IKARUS anti.virus
Virus.Win32.Sality
t3scan.1.8.9.0

K7 AntiVirus
Virus
13.202.15449

Kaspersky
Virus.Win32.Sality
15.0.0.543

Malwarebytes
PUP.Optional.OpenCandy
v2015.04.01.06

McAfee
Program.Artemis!C7BEF8B9B4FE
16.8.708.2

Microsoft Security Essentials
Threat.Undefined
1.195.519.0

MicroWorld eScan
Win32.Sality.3
16.0.0.273

NANO AntiVirus
Virus.Win32.Sality.beygb
0.30.8.659

Norman
Win32.Sality.3
03.12.2014 13:20:04

nProtect
Virus/W32.Sality.D
15.04.01.01

Panda Antivirus
W32/Sality.AA
15.04.01.06

Quick Heal
W32.Sality.U
4.15.14.00

Rising Antivirus
PE:Win32.KUKU.kt!1591113
23.00.65.15330

Sophos
Mal/Sality-D
4.98

Total Defense
Win32/Sality.AA
37.0.11524

Trend Micro House Call
PE_SALITY.RL
7.2.91

Trend Micro
PE_SALITY.RL
10.465.01

Vba32 AntiVirus
Virus.Win32.Sality.bakc
3.12.26.3

VIPRE Antivirus
Threat.4721115
38882

ViRobot
Win32.Sality.Gen.A[h]
2014.3.20.0

Zillya! Antivirus
Virus.Sality.Win32.20
2.0.0.2123

File size:
491.7 KB (503,488 bytes)

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\net framework 4.5.1.exe

File PE Metadata
Compilation timestamp:
5/20/2013 1:53:00 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:b+uqZChYqYOivGOV9UNyXcYS/enemrdRZJLT0:BEChpYheOVu0rS/qewvLo

Entry address:
0x331C

Entry point:
69, F9, 74, 40, 69, 1F, 68, 32, B4, B0, 00, 68, 95, DC, 75, 00, 8D, 3D, 5F, 51, 8C, F1, C7, C6, E9, F3, A0, 6A, 2D, 2C, 63, 8D, 70, 75, 08, 10, F7, 69, D0, 86, D6, 79, 9B, 80, D0, 30, 89, FB, 81, ED, E2, D2, 37, 13, 1A, F3, 3A, D5, 6A, 00, 59, 10, E6, 85, CE, 81, F1, E6, 9C, 00, 00, 04, 44, 81, E9, CF, 08, 00, 00, 0F, BF, FE, 45, 33, F1, F3, 4B, F3, BF, AB, 25, 44, DA, 31, DD, 69, D5, 38, 7F, A8, 07, 2A, FA, 0F, B7, EF, 69, C5, 78, 55, 8D, 47, F6, C3, 02, 81, FF, DF, AE, 00, 00, 71, 08, 81, E7, 4F, 56, 25...
 
[+]

Code size:
24 KB (24,576 bytes)

The file net framework 4.5.1.exe has been seen being distributed by the following URL.

http://dotnetframework.1800download.com/get_azure_file/.../SHoHDrNUrcfwsHrJTUFaboxKwoEcKX0XGgmIZrcLVgojqv2ESU3c8b41 cnWyH66xiajvQ1DpO5csWqZ3Zb38K2XuMlnxcHudG zQSpJ 83yz6tQMVc682pFyat7cTUzG5xOuMEGsZmK3RguuGtD1o42gS7lNdBGT7gAw3ypYjvhAUnNGCb 3gfntPUOmDvHB J1708ewm9

Remove net framework 4.5.1.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.