home

apache-openoffice-12754-dp.exe

Installer application

dobreprogramy sp. z o.o.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application apache-openoffice-12754-dp.exe, “Installer application Setup ” by dobreprogramy sp. z o.o has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download the free Apache OpenOffice but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Installer Soft Program   (signed by dobreprogramy sp. z o.o.)

Product:
Installer application

Description:
Installer application Setup

Version:
4.6.4.0

MD5:
525763d4d70982fb66feb3225c34f0f9

SHA-1:
50f56ab5a59af2e4c67c6ffdf1e5c49292c5b5a3

SHA-256:
a9c7f5ba84c851e0f68bffbcd1144063735be2e673be560d53e88ba0171c4572

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/27/2024 5:53:15 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.dobreprogramyspzoo.Installer (M)
16.2.13.17

File size:
939.6 KB (962,128 bytes)

Product version:
1.1

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\apache-openoffice-12754-dp.exe

Digital Signature
Signed by:
dobreprogramy sp. z o.o.

Authority:
GlobalSign nv-sa

Valid from:
2/13/2015 5:34:27 PM

Valid to:
2/14/2016 5:34:27 PM

Subject:
CN=dobreprogramy sp. z o.o., O=dobreprogramy sp. z o.o., L=Wroclaw, C=PL

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121B4F3A4313F8A58B614202F80129EBC93

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:vK0MnOP4OXqwVfMacL/BLLpQ/VWVSiPmBuJFTs9QOY4I:v1mOuacL/VLh/PmBuDTslE

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file apache-openoffice-12754-dp.exe has been seen being distributed by the following 3 URLs.

http://www.dashdownloadscenters.com/c?x=c1BWBbj81nPs 8QLnRArzlkxrpOZUT26zmoeSP0vpCw=&c=pp17vqT9XIC8fsJngy9NSqo2QLWjIz33CMHdx8h580qhRfLLVZdcXRAI2/kdNMOW7CUCuToY9upyqsrlcNCjOA5yaenFlF4H63b1o95Fd9 YfRodhz4vx7V1E46Aq9tX18ZUbsLNdn4fHn9gFhB2tQ==&fallback_url=http://storage.dobreprogramy.pl/.../Apache_OpenOffice_4.1.2_Win_x86_install_pl.exe&downloadAs=Apache-OpenOffice-12754-dp.exe

http://www.metaquickbundles.com/c?x=iScEnzCh2ryivorjTYjT5xd8BNTJ032pajBOZbr6VZM=&c=vAS uMEKTtQIIfu9NNxKkY oqBjrkoa 5uhm4mUos hepTJQ64cHuMBZ8MxoeBvuUS4inE4zWLmTb3XoREYsQ/KtL6u Blu4hHZyePeJsUJYoXHClZJYlPrlXOH2HEv3csVh3cvfALgjP8H7 VGXWg==&fallback_url=http://storage.dobreprogramy.pl/.../Apache_OpenOffice_4.1.2_Win_x86_install_pl.exe&downloadAs=Apache-OpenOffice-12754-dp.exe

http://www.farmnowapplications.com/c?x=OQ6PkqB5/THh8eqP9yVtoLi8a8qpq9LjBKkdtP6a/A8=&c=hU7Wh73swnl0U/XDyjX1VOwsuwaCmQUY/CxzrDIrJCzMxlZGEYhfSPlE c9LL5IRN77tgO6ChIJPz8wAjBdjpBDLtfzQwADHXJ74m4d/ /Ztw5RN0cVO7vomxtd7ODzFqKRQphvMxowlG7ts4cWYHw==&fallback_url=http://storage.dobreprogramy.pl/.../Apache_OpenOffice_4.1.2_Win_x86_install_pl.exe&downloadAs=Apache-OpenOffice-12754-dp.exe

Remove apache-openoffice-12754-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.