home

nsw35ef.tmp

The file nsw35ef.tmp has been detected as a potentially unwanted program by 20 anti-malware scanners. It bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. The file has been seen being downloaded from osdsoft.com and multiple other hosts.
MD5:
faba4774c781e2b8f43658ac639b48ec

SHA-1:
1fe906964839dc7ef52ad00192fe6a2af980659a

SHA-256:
022ae61157563d40fed3c197ee232012f64fd5717818c7342dd9abdcdc8ff501

Scanner detections:
20 / 68

Status:
Potentially unwanted

Analysis date:
5/3/2024 10:03:29 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Heur.Zygug.6
5741139

Avira AntiVirus
TR/Agent.310784.48
8.3.2.2

Arcabit
Trojan.Zygug.6
1.0.0.526

Baidu Antivirus
Trojan.Win32.Dropper.bjpocn
4.0.3.15912

Bitdefender
Gen:Heur.Zygug.6
1.0.20.1275

Dr.Web
Trojan.Amonetize.6690
9.0.1.0255

Emsisoft Anti-Malware
Gen:Heur.Zygug
10.0.0.5366

ESET NOD32
Win32/Amonetize.II potentially unwanted (variant)
9.12230

Fortinet FortiGate
W32/Agent.BJPOCN!tr
9/12/2015

F-Secure
Gen:Heur.Zygug.6
5.14.151

G Data
Gen:Heur.Zygug
15.9.25

Kaspersky
Trojan-Dropper.Win32.Agent.bjpocn
15.0.0.543

Malwarebytes
PUP.Optional.Amonetize
v2015.09.12.01

McAfee
Artemis!FABA4774C781
5600.6645

MicroWorld eScan
Gen:Heur.Zygug.6
16.0.0.765

NANO AntiVirus
Riskware.Win32.Amonetize.dwslth
0.30.24.3283

Norman
Gen:Heur.Zygug.6
04.08.2015 10:30:46

Qihoo 360 Security
HEUR/QVM10.1.Malware.Gen
1.0.0.1015

Reason Heuristics
Threat.Win.Reputation.IMP
15.9.11.21

VIPRE Antivirus
Amonetize
43638

File size:
303.5 KB (310,784 bytes)

Common path:
C:\users\{user}\appdata\local\temp\nsw35ef.tmp

File PE Metadata
Compilation timestamp:
9/10/2015 7:32:58 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
6144:2ty48ASJXdAt62oyIHiZoBN+oRPxkQ8/u:Q4xJ2tcZCZmU4PR8/u

Entry address:
0xF319

Entry point:
E8, 1E, 4E, 00, 00, E9, 39, FE, FF, FF, 55, 8B, EC, A1, 64, 6D, 43, 00, 85, C0, 75, 1D, E8, B1, 3C, 00, 00, 6A, 1E, E8, 07, 3D, 00, 00, 68, FF, 00, 00, 00, E8, 2C, 33, 00, 00, A1, 64, 6D, 43, 00, 59, 59, 8B, 4D, 08, 85, C9, 75, 01, 41, 51, 6A, 00, 50, FF, 15, 58, A0, 42, 00, 5D, C3, 55, 8B, EC, 56, 8B, 75, 08, 83, FE, E0, 77, 6F, 53, 57, A1, 64, 6D, 43, 00, 85, C0, 75, 1D, E8, 69, 3C, 00, 00, 6A, 1E, E8, BF, 3C, 00, 00, 68, FF, 00, 00, 00, E8, E4, 32, 00, 00, A1, 64, 6D, 43, 00, 59, 59, 85, F6, 74, 04, 8B...
 
[+]

Entropy:
6.9418

Code size:
161.5 KB (165,376 bytes)

The file nsw35ef.tmp has been seen being distributed by the following 4 URLs.

http://osdsoft.com/.../Bundle.exe

http://d1pg43ots40sgg.cloudfront.net/bundle/YTDownloader_Amonetize/.../downloadb.exe

http://d1ykyz0mbyn4to.cloudfront.net/cl/inst/bundles/AnySent_Amonetize/.../downloadb.exe

http://dmrm038s4vkzd.cloudfront.net/cl/inst/bundles/YTDownloader_Amonetize/.../downloadb.exe

Remove nsw35ef.tmp - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.