home

apache_openoffice_incubating_3.4.1_win_x86_install_fr.exe

Application Installer

MICROMAX STUDIO, S.L.

The application apache_openoffice_incubating_3.4.1_win_x86_install_fr.exe, “Application Installer Setup ” by MICROMAX STUDIO, S.L has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from www.heartvaultbundles.com and multiple other hosts.
Publisher:
Application Generic   (signed by MICROMAX STUDIO, S.L.)

Product:
Application Installer

Description:
Application Installer Setup

Version:
4.0.4.1

MD5:
4077d56236ea1fa1581560184e6d79de

SHA-1:
76acf9e5687625e9f3699b55c50f163be0fe3301

SHA-256:
37e453a8f41c40e7735aee0ab82902367bc43d1eb4433d0ed5ec3b5afa33273b

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/24/2024 12:56:59 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.MICROMAXSTUDIO.Installer (M)
16.1.17.16

File size:
916.4 KB (938,344 bytes)

Product version:
3.6.8

Copyright:
Application Generic

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\apache_openoffice_incubating_3.4.1_win_x86_install_fr.exe

Digital Signature
Signed by:
MICROMAX STUDIO, S.L.

Authority:
GoDaddy.com, Inc.

Valid from:
9/1/2015 11:11:38 AM

Valid to:
9/1/2016 11:11:38 AM

Subject:
CN="MICROMAX STUDIO, S.L.", O="MICROMAX STUDIO, S.L.", L=Madrid, C=ES

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
79A6DBFB5606456E

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Fv//uCoylpB8bnLLFKqe+PO4efJOVGykH:Fv9BBSnL4kPrEcPO

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file apache_openoffice_incubating_3.4.1_win_x86_install_fr.exe has been seen being distributed by the following 18 URLs.

http://www.heartvaultbundles.com/c?x=I1g5OdneyJku0zWAmKQG8DoqB/bw6//6keSPNkBquXM=&c=F/b8ghPPMCcZwmAGyK7bMn2oXizB raC5RdaoGVW5cVuoYymCBkiTJvPly1PDG9kgEt4usp0fExCyGDOkl8B3VHTcmSHmuwMIpnmyJDq4p9shC0K7YSy4Eho3Tz/ANo1&fallback_url=http://res.hufftos.com/.../Apache_OpenOffice_incubating_3.4.1_Win_x86_install_fr.exe

http://www.purepackagesthread.com/c?x=9JNREX8yacvV4e WKRo/9MjYJEIE6TrSFECebMseFNA=&c=nanZ6UK0twmXV7o9H6yJGi3ttnyVpCZcBnOAUdegGjsr6q2nKzVlBmxKoOr21RP6BTfl3xve08X78fn43Tfle h8n/z9OLhkqTxtsvEvv5jgXEr/fR0I yupiFIVuOnXoBe6ZjwidaBUMrvqnmnOzA==&fallback_url=http://res.hufftos.com/.../Apache_OpenOffice_incubating_3.4.1_Win_x86_install_fr.exe

http://www.tourpackagebinaries.com/c?x=nMIxT3NhsIrLkoVzM/jKfnTJXjaKDYLSFWZajtnDXyQ=&c=zzYDmk5A9oL2lOrf37Ullt0ncmJmIucCG9Jq75iaQAwjO3g6t/3tlM6N46582Uj7CdGS5ctwhRD ptLEvyPH1mxObRhd1IeUbTBbpXtBkmVHuezWfNJFjL2ccTRunYSi&fallback_url=http://res.hufftos.com/.../Apache_OpenOffice_incubating_3.4.1_Win_x86_install_fr.exe

http://www.cleansignscapital.com/c?x=mRXGvAlVkf93oCOru63dfPHyj7HyixO NwUzB89x6cw=&c=BJncN9o5BEiWsWl1w4WIvVJ92CQHjxezT/Ht 1HajCB55ZtWeJmDVFkSeSTo91hvHNuHwqV2hLJpcSMiU 4YkLc/Yj3XD PEzIcHWnYqkROcZI5V6dNfACymxUvF50at&fallback_url=http://res.hufftos.com/.../Apache_OpenOffice_incubating_3.4.1_Win_x86_install_fr.exe

http://www.conceptsdownloadworld.com/c?x=6d47qDkod2TKmWrWoBIXhrI nUhBjqalVGoHh0TN6Os=&c=IB50WBRWvVec6BIEYkzPtK7cUKAJDcBFNloEMCKjYp6mYhaHiuQjfvyr2zi5feyfG7YBlKHDSDc hFz8f3KnerdyNC9hdP9Lw2dCVebGifDHTEY0RksJ0ABCXMRcVkI8&fallback_url=http://res.hufftos.com/.../Apache_OpenOffice_incubating_3.4.1_Win_x86_install_fr.exe

http://www.hosttagtours.com/c?x=qCDOD0EtAMsQQDUxb2psB hvMiuXLXWdz9icxxz1mX4=&c=dFbdTSJtAileJ3ql2fmlfgUi6Vcep hBlc/tr9k3d1uEN9rFJtuFf0ZhIfDv/Z5jMRgpI9YZo4UNdHym7ZJK/qunL7gATfZzSAsY3rSU9xiOzH 1LcvOT8og7fx7hw8/&fallback_url=http://res.hufftos.com/.../Apache_OpenOffice_incubating_3.4.1_Win_x86_install_fr.exe

http://www.toursstockclean.com/c?x=Zj86L7fQjZmLSX0VER3x 2w0wB/pObTHnOu8wKW8gkU=&c=EI6BSNccxaR2cFN1bB9vne6a/xUU6WGxCt1kgGXKktJego3kKxxOioxSedD8vzW1Jz9EYi3ktqQ3Tro40MSldC/E8/gqfdxkayivZKvz6WfKJqrLG/FhI/lQ97ANEIA8&fallback_url=http://res.hufftos.com/.../Apache_OpenOffice_incubating_3.4.1_Win_x86_install_fr.exe

http://www.tagfuncapital.com/c?x=pB2uG8QzcsV5ZFkg3ymvuwteDUyGsOQEOLDyCJECxEU=&c=pPEPAqqjojnlE/2 mc7n3P3EhRcIhAyRVPgyOVszutjKWWEwJ1xUbVcJdkTqnWVBQpen7jjrY2oZ1enusMEMuZ3O/nfFExuv 0A3XCz2 yuTDQ6z5DNfwJi1gPVLKT9A&fallback_url=http://res.hufftos.com/.../Apache_OpenOffice_incubating_3.4.1_Win_x86_install_fr.exe

http://www.towersworldbundles.com/c?x=Kn1NvA6NkTlkA/b w4PBJHonkiQ5 eU3EKdRrTrKwWk=&c=MRuBi3UXpvJekuM/d45LcIqdeLWFnAWEQJH/DtQMJbbQVS2gZAlVOcVwEzJEduO4G1WfNBRLWCN1e7Vx557EsLxuWpnIBgM/j0ArkqT1daxzFcNv9GgI2yQzk3s6tmw1&fallback_url=http://res.hufftos.com/.../Apache_OpenOffice_incubating_3.4.1_Win_x86_install_fr.exe

http://www.worldvaultdelivery.com/c?x=do/1F0WbTiSkP9lw/R6Iyg9Igu5KkqCNofKU5Q22/nE=&c=5jrojK0KbX7Yku0Z54Ng4mi3lblA0O/jXlKWWecGyko/dIvc7uxpNO8vmrbVznCTTRktO8YtsFhmAI3izSCMjCJc/7CSj75Xc7xr4sLAXIKmgfLK21qaaaeHuKa89Da2&fallback_url=http://res.hufftos.com/.../Apache_OpenOffice_incubating_3.4.1_Win_x86_install_fr.exe

http://www.apptoursbundle.com/c?x=nk1ksE4w8M7kT67fGLBtLfNNYvu/pBUrGN0tqRAecTA=&c=dvItiRDq24/oi/V1O1BHA7r1ZSQtzYBycMgAVZl8Qidmc8vWFrBJqD xkonGge3THUISu5N9O4e5vlj3ZkwrdFdKkuIxEI3VX27b1bvviKrB/PmUsGhQOsKOiaWVJk1W&fallback_url=http://res.hufftos.com/.../Apache_OpenOffice_incubating_3.4.1_Win_x86_install_fr.exe

http://www.laboratoryheartbest.com/c?x=TV1aRP33hCCLUsMfMPg4vtnXiQ7ug3ZSfV1ae0elq/c=&c=4zi/td5uR8kjJ0eArmx ytNNCEiyzDeXxGQheIbmvDVrohkeC4aDDbD2XPm9KYkdBSk6ENuIF3L W 0rYSm2mAM /7SsXeNYflGrpQHOv11J4bajXswGxUFasK/04dkH&fallback_url=http://res.hufftos.com/.../Apache_OpenOffice_incubating_3.4.1_Win_x86_install_fr.exe

http://www.apptoursbundle.com/c?x=cHAwEHr9a1o2RtoHrjHn5SXCf2CHm3dlVkAAs2SphLU=&c=pbicfnGZHTLK49gmJ1uj7oEgaaBp6uqoXh3JVAvn4Rg5Ka26kAshHS2E 8F/Ku7GCDxRj5YoKnNrRuOUhPP9X3HYebkv3yHwZJv9i702DtFq3jSflv5B3VdIS4Vk4OTA&fallback_url=http://res.hufftos.com/.../Apache_OpenOffice_incubating_3.4.1_Win_x86_install_fr.exe

http://www.packagedeliveryworld.com/c?x=j2yfELsuMt1veUsh0J x6XvA7WEvHwTObmjd BBykOQ=&c=ZxH2tCr7SUaIeFKUyi0BHi0gb4RZqiVUWCY9MsSAvtPoLz1YXrT87Jz8skLmJP2Er1kLwsoHhYgvy zy7BY8BpbVn6Ns3oG3215l8Fst1HQ2dvUcDpysaQS7HFO4yptT&fallback_url=http://res.hufftos.com/.../Apache_OpenOffice_incubating_3.4.1_Win_x86_install_fr.exe

http://www.conceptshostsoftware.com/c?x=2oWQ4rlfBnbLNkL030tJalhBHUz1sVhSBaUhCBcXiC8=&c=QPZ0rr0xieY18UIMKgdTVmsg2bM1bZaE07eD8tIYorLlu0Z7X0dkx5MI4JeuSkvBf8eAb5ElQ A92CIB5AOA3Z5YBLvSnKhtpFUbblWZ7IrRFBqY2oNQlw8bH0CeRxzT&fallback_url=http://res.hufftos.com/.../Apache_OpenOffice_incubating_3.4.1_Win_x86_install_fr.exe

http://www.conceptsdownloadworld.com/c?x=koSJ5DzhUOgjdXtlAmpvoIN8j7f0L3m4ypj odOlJFI=&c=M03O7igaecb5 EUeIFP/NQMUlrEwAiaojzySejwf2s4Vfnk2ZhHDBiWWzYuHSMgQCvqFwRCPaaQQ4lrFmWBbiKXLHWgfpj2Y4VsGAeJknu/iLNbJDqC6/A11wERW/ZUt&fallback_url=http://res.hufftos.com/.../Apache_OpenOffice_incubating_3.4.1_Win_x86_install_fr.exe

http://www.presentcontentcurrent.com/c?x=fwbOIX4BHw9U3mOcBx1/R2oShdm/NEg3PA7BC/14wjA=&c=N D84gqp2oAK7CEs HL98 O6vJ6G13ZiPuw3Z9oL XEpxAKMKqUJOyoBabzqS75YdZ3tHw4fqZT0goatLi4EiSDZqcsns5Pn6s6oCuMwEmwRxYpO1f7lSoI/J0fFjXxM&fallback_url=http://res.hufftos.com/.../Apache_OpenOffice_incubating_3.4.1_Win_x86_install_fr.exe

http://www.bundlesafequick.com/c?x=GeqNvy3AlBS0mdTnwYEijQ7U3lb9ATr7n 9IaMIrH9g=&c= rZSUvwFyS1/VnH7VZedJB79stAlhoS2/BVDFk8uxHV1uczFx8eMbdVg7taCYJ1mDxVL7v4Ul2HqiNQRoV AR7zOgt tHabRO7VnPxErFndboGWwFz3gb7sHAUg 1Ixm&fallback_url=http://res.hufftos.com/.../Apache_OpenOffice_incubating_3.4.1_Win_x86_install_fr.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.