ondisksetuppackage.exe

bncp co. ltd.

The executable ondisksetuppackage.exe has been detected as malware by 21 anti-virus scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from ondisk.co.kr.
Remove ondisksetuppackage.exe - Powered by Reason Core Security
Publisher:
bncp co. ltd.  (signed and verified)

MD5:
3f26bc8fec6f9734872ca16eeabcdde4

SHA-1:
0979c13e72cd7adcf92b2a4727d5970433c277db

SHA-256:
4e21057aea4d1e11a219955c8618bd724c5826b2b2921ff0d6946a6bd8850cef

Scanner detections:
21 / 68

Status:
Malware

Analysis date:
12/2/2016 11:24:58 PM UTC  (today)

Scan engine
Detection
Engine version

Bkav FE
W32.Clod6c2.Trojan
1.3.0.4959

Comodo Security
UnclassifiedMalware
18318

Dr.Web
Trojan.DownLoader9.63603
9.0.1.0161

Kingsoft AntiVirus
Win32.Troj.Undef.(kcloud)
331020.49267

McAfee
Artemis!3F26BC8FEC6F
5600.7103

McAfee Web Gateway
Artemis!3F26BC8FEC6F
7.7103

Norman
ShellCode.C
11.20140610

Rising Antivirus
PE:Trojan.Win32.Generic.13763BCB!326515659
23.00.65.14608

Trend Micro House Call
TROJ_GE.D6E51D90
7.2.161

Remove ondisksetuppackage.exe - Powered by Reason Core Security
File size:
8.5 MB (8,923,296 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\ondisksetuppackage.exe

Digital Signature
Signed by:

Authority:
VeriSign, Inc.

Valid from:
1/31/2011 6:00:00 PM

Valid to:
1/31/2013 5:59:59 PM

Subject:
CN=bncp co. ltd., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=bncp co. ltd., L=gumcheongu, S=seoul, C=KR

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
204E39D2FFC0BA7A4FD048624E95E61D

File PE Metadata
Compilation timestamp:
12/5/2009 4:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
196608:JHW+m5LoMP4lP/vu5AMOwdQ5jiIMXR6OpZy00OQ22xFMAXLeWVQrPAC+jdX:5W+mRoHPtMOuHzy00NxMACPA7xX

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Entropy:
7.9997

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file ondisksetuppackage.exe has been seen being distributed by the following URL.

Remove ondisksetuppackage.exe - Powered by Reason Core Security