winssn.exe

Korea Contents Network

The application winssn.exe by Korea Contents Network has been detected as adware by 32 anti-malware scanners.
Remove winssn.exe - Powered by Reason Core Security
Publisher:
Korea Contents Network  (signed and verified)

Version:
2013.12.30.1

MD5:
18090b87ced93a72504579e8e52cf78d

SHA-1:
f10998d885d1413d0a70610cb91375c0ee80b42f

SHA-256:
1d2acad504e62474e36e8e32c21ab767c51f7c55dd51521ec75d3676aaaa470c

Scanner detections:
32 / 68

Status:
Adware

Analysis date:
12/3/2016 4:56:52 PM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.Helper
2014.06.03

Avira AntiVirus
TR/Graftor.134869
7.11.152.200

Antiy Labs AVL
Trojan/Win32.SGeneric
0.1.0.1

CMC Antivirus
Hoax.Win32.BadJoke.ScreenFlicker!O
1.1.0.977

Comodo Security
ApplicUnwnt
18418

ESET NOD32
Win32/AdWare.Kraddare.JP (variant)
8.9886

Fortinet FortiGate
Riskware/Kraddare
6/10/2014

IKARUS anti.virus
Trojan.Graftor
t3scan.1.6.1.0

McAfee
Artemis!18090B87CED9
5600.7103

McAfee Web Gateway
Heuristic.BehavesLike.Win32.Suspicious-BAY.S
7.7103

Reason Heuristics
PUP.KoreaContentsNetwork.G
14.6.10.16

Trend Micro House Call
TROJ_GEN.F47V0217
7.2.161

VIPRE Antivirus
Trojan.Win32.Generic
29892

Remove winssn.exe - Powered by Reason Core Security
File size:
1.2 MB (1,287,808 bytes)

Product version:
2013.12.30.1

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\screenscicon\winssn.exe

Digital Signature
Authority:
Thawte, Inc.

Valid from:
1/13/2013 6:00:00 PM

Valid to:
4/15/2014 6:59:59 PM

Subject:
CN=Korea Contents Network, OU=IT Team, O=Korea Contents Network, L=Seocho-gu, S=SEOUL, C=KR

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
21EE4A0E6A9CF5DFE2A088CE59AC500C

File PE Metadata
Compilation timestamp:
12/30/2013 2:06:08 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:8nfRUGpsFWCSjGXJN2lnTzLjKhplwDTfWf1o7TlBbY4Sb:88WHj64TzqhnIzWtAHbeb

Entry address:
0x3A5001

Entry point:
60, E8, 03, 00, 00, 00, E9, EB, 04, 5D, 45, 55, C3, E8, 01, 00, 00, 00, EB, 5D, BB, ED, FF, FF, FF, 03, DD, 81, EB, 00, 50, 3A, 00, 83, BD, 88, 04, 00, 00, 00, 89, 9D, 88, 04, 00, 00, 0F, 85, CB, 03, 00, 00, 8D, 85, 94, 04, 00, 00, 50, FF, 95, A9, 0F, 00, 00, 89, 85, 8C, 04, 00, 00, 8B, F0, 8D, 7D, 51, 57, 56, FF, 95, A5, 0F, 00, 00, AB, B0, 00, AE, 75, FD, 38, 07, 75, EE, 8D, 45, 7A, FF, E0, 56, 69, 72, 74, 75, 61, 6C, 41, 6C, 6C, 6F, 63, 00, 56, 69, 72, 74, 75, 61, 6C, 46, 72, 65, 65, 00, 56, 69, 72, 74...
 
[+]

Entropy:
7.6449

Packer / compiler:
ASPack v2.12

Code size:
2.6 MB (2,745,856 bytes)

Remove winssn.exe - Powered by Reason Core Security