home

nitro_pro9_x64.exe

The application nitro_pro9_x64.exe has been detected as a potentially unwanted program by 8 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer, however the file is not signed with an authenticode signature from a trusted source. The setup routine uses the RevenYou.Com Pay Per Install platform (OutBrowse) which bundles additional software offers inclduing toolbars, extensions, PC utilities as well as other PUPs. The file has been seen being downloaded from www10.zippyshare.com.
MD5:
2acf3ad8766a43204ca75778d0847d36

SHA-1:
f625ad84730f6a4a557d54f2e0d7ac8ae6b4717b

SHA-256:
16d1caea67d8e366a88a7fbeae9e80323b8439028be735a8fcaeb1be9001caa3

Scanner detections:
8 / 68

Status:
Potentially unwanted

Explanation:
Bundles additional adware offers during download and installation using the OutBrowse installer.

Analysis date:
4/24/2024 11:54:48 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Avira AntiVirus
PUA/Outbrowse.Gen
7.11.211.248

avast!
OutBrowse-E [PUP]
150203-1

ESET NOD32
Win32/OutBrowse.X potentially unwanted application
7.0.302.0

F-Prot
W32/Outbrowse.B2.gen
v6.4.7.1.166

McAfee
Program.Adware-OutBrowse
16.8.708.2

NANO AntiVirus
Trojan.Win32.OutBrowse.deinil
0.30.0.296

SUPERAntiSpyware
Trojan.Agent/Gen-Downloader
10040

Zillya! Antivirus
Adware.OutBrowse.Win32.2129
2.0.0.2077

File size:
973.9 KB (997,309 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\nitro_pro9_x64.exe

File PE Metadata
Compilation timestamp:
12/5/2009 11:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
24576:r9Zn113GiwllQiK1UBEZF7NWxwntNOpdZTC:Rv12LlMUBENWxwntwp/TC

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file nitro_pro9_x64.exe has been seen being distributed by the following URL.

http://www10.zippyshare.com/d/1127558/.../nitro_pro9_x64.exe

Remove nitro_pro9_x64.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.