popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

Emotet Gen1 NSIS Generic Malware Malicious Library ASPack UPX Malicious Packer Admin Tool (Sysinternals etc ...) Anti_VM PE File OS Processor Check PE32 DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 6, 2021, 1:23 p.m. Oct. 6, 2021, 1:48 p.m.
Size 295.9KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 790abe77329f408bb3cd8782d0592be0
SHA256 1a0e2480076fc22a18ad51c79af447258a2615da953058a46b938d84ca6603a4
CRC32 1B3F1ED9
ssdeep 6144:k98mjyU9avHM2nVm+cTc0xvklLAFz8LxBg5:Q1avsRo0xvkEJ5
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • NSIS_Installer - Null Soft Installer

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49206 -> 51.195.17.68:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 51.195.17.68:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 51.195.17.68:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49227 -> 51.195.17.68:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49227 -> 51.195.17.68:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49227 -> 51.195.17.68:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 34.98.99.30:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 34.98.99.30:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 34.98.99.30:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49222 -> 3.223.115.185:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49222 -> 3.223.115.185:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49222 -> 3.223.115.185:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49218 -> 192.185.0.218:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49218 -> 192.185.0.218:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49218 -> 192.185.0.218:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 77.222.61.114:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 77.222.61.114:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 77.222.61.114:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 198.54.117.218:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 198.54.117.218:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 198.54.117.218:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 5.181.216.107:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 5.181.216.107:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 5.181.216.107:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 207.148.248.143:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 207.148.248.143:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 207.148.248.143:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 34.98.99.30:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 34.98.99.30:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 34.98.99.30:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49225 -> 207.148.248.143:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49225 -> 207.148.248.143:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49225 -> 207.148.248.143:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49220 -> 195.149.84.101:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49220 -> 195.149.84.101:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49220 -> 195.149.84.101:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49224 -> 209.15.40.102:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49224 -> 209.15.40.102:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49224 -> 209.15.40.102:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

file C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section CODE
section DATA
section BSS
suspicious_features GET method with no useragent header suspicious_request GET http://www.cbspecialists.com/b6a4/?h0Gl9hf=evtpUE4huYbesJcHMcONCfRNSBT00PmI2ZEopGNqYdx8ef/JxfONVVxMCDT+WEjswdimTH7J&MXEL9=XbiptfYxWjcdj6k0
suspicious_features GET method with no useragent header suspicious_request GET http://www.42shenmao.com/b6a4/?h0Gl9hf=/YLPVle51s/wMjptNjSN7dsoOectpdxamVjEBuIIjQO2gjITNfwF/374CWCNKQU8LkxY9Lpe&MXEL9=XbiptfYxWjcdj6k0
suspicious_features GET method with no useragent header suspicious_request GET http://www.kedaiherbalalami.com/b6a4/?h0Gl9hf=AClaEyNViDSune13/YZUUjazMao4yP2qoW92J+V8GQKrmRmlM8SyMJgG/BS9WoJI+nFJwME4&MXEL9=XbiptfYxWjcdj6k0
suspicious_features GET method with no useragent header suspicious_request GET http://www.asteroid.finance/b6a4/?h0Gl9hf=qLtgNToSswb6CMFxrgf7fmc+nXqwhZnGR9zX0c9pvpxyA4sUtmU5qGoaAQCzoAft52FbUOHw&MXEL9=XbiptfYxWjcdj6k0
suspicious_features GET method with no useragent header suspicious_request GET http://www.cabalzi.com/b6a4/?h0Gl9hf=vCEfkciNsJLnQ6NTKgmnH0RKiXqKx4X1OsBfXMLmCHhcM6UjpXRp9mu9MO0KT8GS97XSNDdh&MXEL9=XbiptfYxWjcdj6k0
suspicious_features GET method with no useragent header suspicious_request GET http://www.starlangue.com/b6a4/?h0Gl9hf=g69R7dbOA8vG6mackXWbpFQiI3jHqcSgcWnxdpV03totRPt41IlhRiyddP1MDY+gUZ8Ltk0r&MXEL9=XbiptfYxWjcdj6k0
suspicious_features GET method with no useragent header suspicious_request GET http://www.aryadesigningstudio.com/b6a4/?h0Gl9hf=yCgAN4tsczShp29S318tv4ZltSNu4XfQYE5+ktzl6CIAkzW36D9NAkECVM5DnUVdw2E5gUoj&MXEL9=XbiptfYxWjcdj6k0
suspicious_features GET method with no useragent header suspicious_request GET http://www.khadarelhodge.com/b6a4/?h0Gl9hf=ISFOGxfdiE1PPsNkkPhd2vjxQRkX0rrnM8iioAzdPJooWlLmYfY3DJnTJL0my3ntIGXVziQO&MXEL9=XbiptfYxWjcdj6k0
suspicious_features GET method with no useragent header suspicious_request GET http://www.shuangyashanpower.com/b6a4/?h0Gl9hf=VB2wfkl4CXJnVTEEGMGPXmuuPrI7urt4dwMiQOsc4hS9dMr3PM8JoDhoprhFz887WFewqIR9&MXEL9=XbiptfYxWjcdj6k0
suspicious_features GET method with no useragent header suspicious_request GET http://www.maximumsale.com/b6a4/?h0Gl9hf=jUXSBmmEOkRVD/snHUZVGd++nKvIB5C3Qlbp0N4c/DnjLwT5QCEf4v32ZuriMDGEoBVryIv8&MXEL9=XbiptfYxWjcdj6k0
suspicious_features GET method with no useragent header suspicious_request GET http://www.helpmovingandstorage.com/b6a4/?h0Gl9hf=WCQPk6OV774AQmQZK5qr8VSUgSKsV6/gws8DuEwnniOEFY0oNuiFQFr5fT8XTvC//aYnyiLC&MXEL9=XbiptfYxWjcdj6k0
request POST http://www.cbspecialists.com/b6a4/
request GET http://www.cbspecialists.com/b6a4/?h0Gl9hf=evtpUE4huYbesJcHMcONCfRNSBT00PmI2ZEopGNqYdx8ef/JxfONVVxMCDT+WEjswdimTH7J&MXEL9=XbiptfYxWjcdj6k0
request POST http://www.42shenmao.com/b6a4/
request GET http://www.42shenmao.com/b6a4/?h0Gl9hf=/YLPVle51s/wMjptNjSN7dsoOectpdxamVjEBuIIjQO2gjITNfwF/374CWCNKQU8LkxY9Lpe&MXEL9=XbiptfYxWjcdj6k0
request POST http://www.kedaiherbalalami.com/b6a4/
request GET http://www.kedaiherbalalami.com/b6a4/?h0Gl9hf=AClaEyNViDSune13/YZUUjazMao4yP2qoW92J+V8GQKrmRmlM8SyMJgG/BS9WoJI+nFJwME4&MXEL9=XbiptfYxWjcdj6k0
request POST http://www.asteroid.finance/b6a4/
request GET http://www.asteroid.finance/b6a4/?h0Gl9hf=qLtgNToSswb6CMFxrgf7fmc+nXqwhZnGR9zX0c9pvpxyA4sUtmU5qGoaAQCzoAft52FbUOHw&MXEL9=XbiptfYxWjcdj6k0
request POST http://www.cabalzi.com/b6a4/
request GET http://www.cabalzi.com/b6a4/?h0Gl9hf=vCEfkciNsJLnQ6NTKgmnH0RKiXqKx4X1OsBfXMLmCHhcM6UjpXRp9mu9MO0KT8GS97XSNDdh&MXEL9=XbiptfYxWjcdj6k0
request POST http://www.starlangue.com/b6a4/
request GET http://www.starlangue.com/b6a4/?h0Gl9hf=g69R7dbOA8vG6mackXWbpFQiI3jHqcSgcWnxdpV03totRPt41IlhRiyddP1MDY+gUZ8Ltk0r&MXEL9=XbiptfYxWjcdj6k0
request POST http://www.aryadesigningstudio.com/b6a4/
request GET http://www.aryadesigningstudio.com/b6a4/?h0Gl9hf=yCgAN4tsczShp29S318tv4ZltSNu4XfQYE5+ktzl6CIAkzW36D9NAkECVM5DnUVdw2E5gUoj&MXEL9=XbiptfYxWjcdj6k0
request POST http://www.khadarelhodge.com/b6a4/
request GET http://www.khadarelhodge.com/b6a4/?h0Gl9hf=ISFOGxfdiE1PPsNkkPhd2vjxQRkX0rrnM8iioAzdPJooWlLmYfY3DJnTJL0my3ntIGXVziQO&MXEL9=XbiptfYxWjcdj6k0
request POST http://www.shuangyashanpower.com/b6a4/
request GET http://www.shuangyashanpower.com/b6a4/?h0Gl9hf=VB2wfkl4CXJnVTEEGMGPXmuuPrI7urt4dwMiQOsc4hS9dMr3PM8JoDhoprhFz887WFewqIR9&MXEL9=XbiptfYxWjcdj6k0
request POST http://www.maximumsale.com/b6a4/
request GET http://www.maximumsale.com/b6a4/?h0Gl9hf=jUXSBmmEOkRVD/snHUZVGd++nKvIB5C3Qlbp0N4c/DnjLwT5QCEf4v32ZuriMDGEoBVryIv8&MXEL9=XbiptfYxWjcdj6k0
request POST http://www.helpmovingandstorage.com/b6a4/
request GET http://www.helpmovingandstorage.com/b6a4/?h0Gl9hf=WCQPk6OV774AQmQZK5qr8VSUgSKsV6/gws8DuEwnniOEFY0oNuiFQFr5fT8XTvC//aYnyiLC&MXEL9=XbiptfYxWjcdj6k0
request POST http://www.cbspecialists.com/b6a4/
request POST http://www.42shenmao.com/b6a4/
request POST http://www.kedaiherbalalami.com/b6a4/
request POST http://www.asteroid.finance/b6a4/
request POST http://www.cabalzi.com/b6a4/
request POST http://www.starlangue.com/b6a4/
request POST http://www.aryadesigningstudio.com/b6a4/
request POST http://www.khadarelhodge.com/b6a4/
request POST http://www.shuangyashanpower.com/b6a4/
request POST http://www.maximumsale.com/b6a4/
request POST http://www.helpmovingandstorage.com/b6a4/
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2240
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72952000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2240
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 12288
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x732d4000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2624
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ae0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Program Files (x86)\Microsoft Office\Office12\DSSM.EXE
file C:\Program Files (x86)\Hnc\HncUtils\HncUpdate.exe
file C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateCore.exe
file C:\Program Files (x86)\Microsoft Office\Office12\REGFORM.EXE
file C:\Python27\Lib\site-packages\setuptools\cli-32.exe
file C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\ODSERV.EXE
file C:\Python27\Scripts\easy_install.exe
file C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
file C:\MSOCache\All Users\{90120000-0030-0000-0000-0000000FF1CE}-C\ose.exe
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\t32.exe
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\w32.exe
file C:\Program Files (x86)\Hnc\Common80\HimTrayIcon.exe
file C:\Program Files (x86)\Hnc\Hwp80\HwpFinder.exe
file C:\Program Files (x86)\Microsoft Office\Office12\SELFCERT.EXE
file C:\Program Files (x86)\Microsoft Office\Office12\PPTVIEW.EXE
file C:\Program Files (x86)\Microsoft Office\Office12\MSPUB.EXE
file C:\Program Files (x86)\EditPlus\editplus.exe
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\t64.exe
file C:\Program Files (x86)\Hnc\Hwp80\HwpPrnMng.exe
file C:\Users\test22\AppData\Local\Temp\nsl64EE.tmp\tkxaz.dll
file C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE
file C:\Program Files (x86)\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE
file C:\MSOCache\All Users\{90120000-006E-0412-0000-0000000FF1CE}-C\DW20.EXE
file C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateComRegisterShell64.exe
file C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateBroker.exe
file C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler64.exe
file C:\util\TCPView\Tcpvcon.exe
file C:\Program Files (x86)\Google\Chrome\Application\65.0.3325.181\Installer\chrmstp.exe
file C:\Program Files (x86)\Hnc\Common80\HncReporter.exe
file C:\Program Files (x86)\Microsoft Office\Office12\1042\ONELEV.EXE
file C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file C:\Program Files (x86)\Hnc\Hwp80\HncPUAConverter.exe
file C:\Program Files (x86)\Microsoft Office\Office12\MSTORE.EXE
file C:\Program Files (x86)\Hnc\HncDic80\HncDic.exe
file C:\Program Files (x86)\Microsoft Office\Office12\MSTORDB.EXE
file C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\ACECNFLT.EXE
file C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdate.exe
file C:\Program Files (x86)\Hnc\Hwp80\Hwp.exe
file C:\Program Files (x86)\Microsoft Office\Office12\MSQRY32.EXE
file C:\util\dotnet4.5.exe
file C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\winamp58_3660_beta_full_en-us[1].exe
file C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
file C:\Program Files (x86)\Microsoft Office\Office12\INFOPATH.EXE
file C:\Program Files (x86)\Microsoft Office\Office12\GrooveMigrator.exe
file C:\Program Files (x86)\Hnc\PDF80\x64\HNCE2PPRCONV80.exe
file C:\Program Files (x86)\Hnc\Common80\him\HJIMESV.EXE
file C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateOnDemand.exe
file C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\OINFOP12.EXE
file C:\Program Files (x86)\Hnc\Common80\OdfConverter.exe
file C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe
file C:\Users\test22\AppData\Local\Temp\nsl64EE.tmp\tkxaz.dll
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\winamp58_3660_beta_full_en-us[1].exe
file C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default) reg_value C:\Windows\svchost.com "%1" %*
Process injection Process 2240 called NtSetContextThread to modify thread in remote process 2624
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1638384
registers.edi: 0
registers.eax: 4313264
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000218
process_identifier: 2624
1 0 0
Bkav W32.NeshtaB.PE
Lionic Virus.Win32.Neshta.tn9H
Elastic malicious (high confidence)
DrWeb Win32.HLLP.Neshta
MicroWorld-eScan Trojan.Generic.30226180
FireEye Generic.mg.790abe77329f408b
CAT-QuickHeal W32.Neshta.C8
ALYac Trojan.Generic.30226180
Cylance Unsafe
Zillya Virus.Neshta.Win32.1
Sangfor Virus.Win32.Neshta.a
K7AntiVirus Virus ( 00556e571 )
K7GW Virus ( 00556e571 )
Cybereason malicious.7329f4
BitDefenderTheta AI:FileInfector.D5C3B0640E
Cyren W32/Neshta.OBIX-2981
Symantec W32.Neshuta
ESET-NOD32 Win32/Neshta.A
APEX Malicious
Paloalto generic.ml
ClamAV Win.Trojan.Neshuta-1
Kaspersky Virus.Win32.Neshta.a
BitDefender Trojan.Generic.30226180
NANO-Antivirus Trojan.Win32.Winlock.fmobyw
Avast Win32:Apanas [Trj]
Tencent Virus.Win32.Neshta.a
Ad-Aware Trojan.Generic.30226180
TACHYON Virus/W32.Neshta
Emsisoft Trojan.Generic.30226180 (B)
Comodo Win32.Neshta.A@3ypg
Baidu Win32.Virus.Neshta.a
VIPRE Virus.Win32.Neshta.a (v)
TrendMicro PE_NESHTA.A
McAfee-GW-Edition BehavesLike.Win32.HLLP.dc
Sophos Mal/Generic-R + W32/Neshta-D
SentinelOne Static AI - Malicious PE
Jiangmin Virus.Neshta.a
Avira W32/Neshta.A
Antiy-AVL Trojan/Generic.ASVirus.20D
Kingsoft Win32.Infected.neshta.nl.(kcloud)
Gridinsoft Virus.Win32.Neshta.oa
Microsoft Virus:Win32/Neshta.A
ViRobot Win32.Neshta.Gen.A
ZoneAlarm Virus.Win32.Neshta.a
GData Win32.Virus.Neshta.D
Cynet Malicious (score: 100)
AhnLab-V3 Win32/Neshta
Acronis suspicious
McAfee W32/HLLP.41472.e
MAX malware (ai score=81)