home

nsh6f1b.tmp

IMALI – N.I. MEDIA LTD

The file nsh6f1b.tmp by IMALI – N.I. MEDIA has been detected as adware by 25 anti-malware scanners. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from direct.downthat.com.
Publisher:
IMALI – N.I. MEDIA LTD  (signed and verified)

MD5:
6eeffc36c55ead6cd6d6fccbc4cd8973

SHA-1:
cbace8d83c083aab6a875ca874aa525cf2f25634

SHA-256:
c18156dac0824c8488b82b37f263599e7d04ecca2c295fe19aebe5dfe00714cf

Scanner detections:
25 / 68

Status:
Adware

Analysis date:
4/27/2024 3:10:22 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Graftor.179625
6300826

Agnitum Outpost
PUA.Imali
7.1.1

AhnLab V3 Security
PUP/Win32.Imali
2015.03.30

Avira AntiVirus
ADWARE/Adware.Gen7
3.6.1.96

avast!
Win32:Adware-gen [Adw]
2014.9-150401

AVG
Generic
2016.0.3155

Bitdefender
Gen:Variant.Adware.Graftor.179625
1.0.20.445

Clam AntiVirus
Win.Adware.Agent-41601
0.98/21511

Dr.Web
Adware.Downware.10517
9.0.1.091

Emsisoft Anti-Malware
Gen:Variant.Adware.Graftor.179625
9.0.0.4799

ESET NOD32
Win32/Adware.Imali.B application
7.0.302.0

Fortinet FortiGate
W32/Generic.B!tr.dldr
3/30/2015

F-Prot
W32/S-a1c3fe71
v6.4.7.1.166

F-Secure
Gen:Variant.Adware.Graftor
5.13.68

G Data
Gen:Variant.Adware.Graftor.179625
15.3.25

K7 AntiVirus
Adware
13.202.15427

Kaspersky
HEUR:Trojan-Downloader.Win32.Generic
14.0.0.2268

McAfee
Trojan.Artemis!6EEFFC36C55E
16.8.708.2

MicroWorld eScan
Gen:Variant.Adware.Graftor.179625
16.0.0.267

NANO AntiVirus
Riskware.Win32.Downware.dpqfgl
0.30.8.659

Panda Antivirus
Trj/Genetic.gen
15.03.30.09

Reason Heuristics
PUP.IMALI
15.3.30.9

Sophos
Generic PUA ML
4.98

Trend Micro House Call
TROJ_GEN.R0C1H09CT15
7.2.89

VIPRE Antivirus
Threat.4150696
38552

File size:
514.2 KB (526,536 bytes)

Common path:
C:\users\{user}\appdata\local\temp\nsh6f1b.tmp

Digital Signature
Signed by:
IMALI – N.I. MEDIA LTD

Authority:
GlobalSign nv-sa

Valid from:
12/29/2014 8:24:00 AM

Valid to:
12/30/2015 8:24:00 AM

Subject:
E=contact@imalimedia.net, CN=IMALI – N.I. MEDIA LTD, O=IMALI – N.I. MEDIA LTD, L=Ramat Gan, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11215FB4642CA96492ED635B137D682A42C4

File PE Metadata
Compilation timestamp:
3/29/2015 1:53:31 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:BnHyjaOyD6KPgb/D6wq8TrRXNk3C/FIbqvaPF:hCRD6wq8TrRXNk3C/FYPF

Entry address:
0x15B36

Entry point:
E8, 23, 6B, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, 04, 85, 42, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, C8, 80, 42, 00, C9, C2, 08, 00, FF, 35, D4, 47, 45, 00, FF, 15, A0, 80, 42, 00, 85, C0, 74, 02, FF, D0, 6A, 19, E8, BD, 63, 00, 00, 6A, 01, 6A, 00, E8, D4, 2E, 00, 00, 83, C4, 0C, E9, 99, 2E, 00, 00...
 
[+]

Entropy:
5.6317

Code size:
156 KB (159,744 bytes)

The file nsh6f1b.tmp has been seen being distributed by the following URL.

http://direct.downthat.com/.../bundle_353.exe

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to ec2-52-1-45-42.compute-1.amazonaws.com  (52.1.45.42:80)

Remove nsh6f1b.tmp - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.