{"id":3454,"date":"2014-12-05T19:46:41","date_gmt":"2014-12-05T19:46:41","guid":{"rendered":"http:\/\/www.freefixer.com\/b\/?p=3454"},"modified":"2018-05-29T12:01:15","modified_gmt":"2018-05-29T12:01:15","slug":"imali-n-i-media-td-legit-or-malware","status":"publish","type":"post","link":"https:\/\/www.freefixer.com\/b\/imali-n-i-media-td-legit-or-malware\/","title":{"rendered":"IMALI – N.I. MEDIA TD – Detection Rate: 1\/54 – Legit or malware?"},"content":{"rendered":"

Hi there! Just a quick post this Friday evening. Did you see a file, such as setup.exe, on your system signed by IMALI – N.I. MEDIA TD<\/strong>? Then read on..<\/p>\n

You can see who the signer is when double-clicking on an executable file. IMALI – N.I. MEDIA TD appears in the publisher field in the dialog that pops up.<\/p>\n

\"IMALI<\/a><\/p>\n

It is also possible to check a digital signature by looking at a file’s properties. Here’s a screenshot of the IMALI – N.I. MEDIA TD certificate.<\/p>\n

\"IMALI<\/a><\/p>\n

The detection rate is only 1\/54, that is 2%. The setup.exe file is detected as suspected of Trojan.Downloader.gen.h<\/strong> by VBA32. What do you think, is it a false positive or should the other anti-virus programs detect it?<\/p>\n

\"IMALI<\/a><\/p>\n

Did you also find a IMALI – N.I. MEDIA TD file? Do you remember where you downloaded it?<\/p>\n

Thank you for reading.<\/p>\n

Update 2015-01-28<\/strong>: Found another file signed by IMALI – N.I. MEDIA TD. It’s called\u00a0ESy1Avb1ax.exe<\/a> and it is detected by 7\u00a0of the 57\u00a0anti-virus programs at VirusTotal:<\/p>\n

\"IMALI<\/a><\/p>\n

 <\/p>\n

Update 2015-02-16<\/strong>: Found another file, with a slightly different publisher name: “IMALI \u2013 N.I. MEDIA LTD<\/strong>“. The publisher is located in\u00a0Ramat Gan<\/strong>, Israel<\/strong> according to the certificate. These are the detections (8<\/span>\/57):<\/p>\n