home

tmp1b5c.tmp.exe

Korea Contents Network 응용 프로그램

Korea Contents Network

The application tmp1b5c.tmp.exe, “Korea Contents Network MFC 응용 프로그램” by Korea Contents Network has been detected as adware by 36 anti-malware scanners. It is also typically executed from the user's temporary directory.
Publisher:
Korea Contents Network  (signed and verified)

Product:
Korea Contents Network 응용 프로그램

Description:
Korea Contents Network MFC 응용 프로그램

Version:
1, 0, 0, 1

MD5:
2d3dd660d5630a18bb3b38999289a907

SHA-1:
bca287828adfd9c36f3d1d3dea8e1b070337080b

SHA-256:
dd9d7192df1836278941784f8b7a0899b0b5cb6373fc7afed717d6e2cc8a46ce

Scanner detections:
36 / 68

Status:
Adware

Analysis date:
4/19/2024 8:29:58 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.Agent.OHW
466

Agnitum Outpost
PUA.CloverPlus
7.1.1

AhnLab V3 Security
PUP/Win32.UtilTop
2015.10.27

Avira AntiVirus
ADWARE/CloverPlus.ig.1
8.3.2.2

Arcabit
Adware.Agent.OHW
1.0.0.585

avast!
Win32:Adware-gen [Adw]
2014.9-151027

AVG
Generic5
2016.0.2944

Baidu Antivirus
Adware.Win32.CloverPlus
4.0.3.151027

Bitdefender
Adware.Agent.OHW
1.0.20.1500

Bkav FE
W32.HfsAdware
1.3.0.7383

Comodo Security
Application.Win32.CloverPlus.AE
23478

Dr.Web
Trojan.DownLoader9.13858
9.0.1.0300

Emsisoft Anti-Malware
Adware.Agent.OHW
8.15.10.27.09

ESET NOD32
Win32/AdWare.CloverPlus.AF (variant)
9.12467

Fortinet FortiGate
Riskware/CloverPlus
10/27/2015

F-Secure
Adware.Agent.OHW
11.2015-27-10_3

G Data
Adware.Agent.OHW
15.10.25

IKARUS anti.virus
PUA.CloverPlus
t3scan.1.9.5.0

K7 AntiVirus
Adware
13.212.17655

Kaspersky
not-a-virus:AdWare.Win32.CloverPlus
14.0.0.1213

Malwarebytes
Adware.KorAd
v2015.10.27.09

McAfee
Generic PUP.x
5600.6600

MicroWorld eScan
Adware.Agent.OHW
16.0.0.900

NANO AntiVirus
Trojan.Win32.ATRAPS.cumzdu
0.30.26.3947

nProtect
Adware.Agent.OHW
15.10.26.01

Panda Antivirus
Trj/CI.A
15.10.27.09

Qihoo 360 Security
Win32/Virus.Adware.334
1.0.0.1015

Quick Heal
AdWare.CloverPlus.r4 (Not a Virus)
10.15.14.00

Reason Heuristics
PUP.KoreaContentsNetwork (M)
15.10.27.9

Rising Antivirus
PE:Malware.Generic/QRS!1.9E2D [F]
23.00.65.151025

Sophos
Generic PUA LM (PUA)
4.98

Trend Micro House Call
ADW_CLOVERPLUS
7.2.300

Trend Micro
ADW_CLOVERPLUS
10.465.27

Vba32 AntiVirus
Hoax.Blocker
3.12.26.4

VIPRE Antivirus
Trojan.Win32.Generic
44830

ViRobot
Adware.Agent.670304[h]
2014.3.20.0

File size:
654.6 KB (670,304 bytes)

Product version:
1, 0, 0, 1

Copyright:
Copyright (C) 2011

File type:
Executable application (Win32 EXE)

Language:
Korean (Korea)

Common path:
C:\users\{user}\appdata\local\temp\tmp1b5c.tmp.exe

Digital Signature
Signed by:
Korea Contents Network

Authority:
Thawte, Inc.

Valid from:
1/13/2013 4:00:00 PM

Valid to:
4/15/2014 4:59:59 PM

Subject:
CN=Korea Contents Network, OU=IT Team, O=Korea Contents Network, L=Seocho-gu, S=SEOUL, C=KR

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
21EE4A0E6A9CF5DFE2A088CE59AC500C

File PE Metadata
Compilation timestamp:
2/26/2014 10:30:32 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:037h6cT888888888888W88888888888WsNN3SHXd4o8YUoYBWzWgdutXsdTgKjtP:67h6sNwj6WzWgduyJgKjTbOV6+YPl

Entry address:
0x15D0

Entry point:
55, 8B, EC, 6A, FF, 68, C0, 22, 40, 00, 68, 56, 17, 40, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 68, 53, 56, 57, 89, 65, E8, 33, DB, 89, 5D, FC, 6A, 02, FF, 15, 14, 21, 40, 00, 59, 83, 0D, 5C, 31, 40, 00, FF, 83, 0D, 60, 31, 40, 00, FF, FF, 15, 10, 21, 40, 00, 8B, 0D, 50, 31, 40, 00, 89, 08, FF, 15, 0C, 21, 40, 00, 8B, 0D, 4C, 31, 40, 00, 89, 08, A1, 08, 21, 40, 00, 8B, 00, A3, 58, 31, 40, 00, E8, 16, 01, 00, 00, 39, 1D, 70, 30, 40, 00, 75, 0C, 68, 52, 17, 40, 00, FF, 15, 58, 21...
 
[+]

Entropy:
7.7007

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
4 KB (4,096 bytes)

Remove tmp1b5c.tmp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.