Part of what is found there is flagged modern-wizard.bmp for instance ->: http://f.virscan.org/modern-wizard.bmp.html
nsz4.tmp is part of adware and trojan Buzus etc. and is also found inside bankstealers.
And also this “nsdialogs.dll”: http://www.threatexpert.com/files/nsDialogs.dll.html
use of YARA shellcode - Matched shellcode byte patterns could lead to FPs in signed certified files.
I checked that file and got it via get in Malzilla then performed a avast scan on downloaded executable. To no avail.
See whether you get a similar result with the PUP scanner, will ye?
This is interesting read on MalwareBytes’s forum: https://forums.malwarebytes.org/index.php?showtopic=130155
Verdict fresh “bankstealer” malcode.
So DrWeb’s and our findings are coming into fruitition.
Let us see how detection is going to expand ;D
And again thanks for the assist
Maybe we are up to something here. Did you upload the file to virus AT avast dot com with a link to this thread?
We have a lot of users in that theater area of the globe, so they certainly will need protection against this malcode!
Thank you. That is the responsible way to go forward with this,
and that is what DavidR taught us all.
First report to avast then comment.
Well it could be undetected malware in the worst case scenario or at least a PUP detection with a ,low threat level.
It could also be a false positive on a a signed developer file (Pacifics Co.)
with most likely this FP depending on a detected packer.
In that case my best bet will be on YARA used.
