home

bcbcabfdgcdf.exe

OTOPIA soft

This is the OutBrowse Revenyou installer which bundles offers for additional third party applications that may be unwanted and installed without consent. The application bcbcabfdgcdf.exe by OTOPIA soft has been detected as adware by 17 anti-malware scanners. The program is a setup application that uses the OutBrowse Revenyou installer. According to AVG, this software downloads additional adware offers during setup. It is also typically executed from the user's temporary directory.
Publisher:
OTOPIA soft  (signed and verified)

Version:
2015.121.109.5

MD5:
0c4782c14da89f2a46e5bae0f9250792

SHA-1:
b8a09e3c2f46cdb756a6798fed6ea1ec6d87b4eb

SHA-256:
31a2cddd83a243403b5705100bb99611f7c00485f3937c6f58f3e95b38241145

Scanner detections:
17 / 68

Status:
Adware

Explanation:
Bundles additional adware offers during download and installation using the OutBrowse installer.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/24/2024 6:30:11 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.OutBrowse
7.1.1

AhnLab V3 Security
PUP/Win32.OutBrowse
2015.01.21

AVG
Downloader
2016.0.3113

Baidu Antivirus
PUA.Win32.OutBrowse
4.0.3.15510

Dr.Web
Trojan.KillFiles.22265
9.0.1.0130

ESET NOD32
Win32/OutBrowse.BA (variant)
9.11048

Fortinet FortiGate
Riskware/OutBrowse
5/10/2015

herdProtect (fuzzy)
variant of bcbcabfdbcfe.exe (Adware)
2015.8.7.23

K7 AntiVirus
Unwanted-Program
13.192.14775

Kaspersky
not-a-virus:Downloader.NSIS.OutBrowse
14.0.0.2062

McAfee
Artemis!83AF962999C6
5600.6769

NANO AntiVirus
Trojan.Win32.KillFiles.dmtzdt
0.30.0.65070

Panda Antivirus
Generic Suspicious
15.05.10.01

Qihoo 360 Security
HEUR/QVM10.1.Malware.Gen
1.0.0.1015

Reason Heuristics
Threat.Outbrowse.Bundler
15.5.10.9

Trend Micro House Call
Suspicious_GEN.F47V0120
7.2.219

VIPRE Antivirus
Trojan.Win32.Generic
37190

File size:
822.7 KB (842,424 bytes)

Product version:
2015.121.109.5

Copyright:
Copyright (C) 2015

Original file name:
20151211095.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
OutBrowse Revenyou

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\bcbcabfdgcdf.exe

Digital Signature
Signed by:
OTOPIA soft

Authority:
thawte, Inc.

Valid from:
1/20/2015 2:00:00 AM

Valid to:
12/18/2015 1:59:59 AM

Subject:
CN=OTOPIA soft, O=OTOPIA soft, L=Dublin, S=Dublin, C=IE

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
147E36526551746AA73B8CB9252C7C3A

File PE Metadata
Compilation timestamp:
1/21/2015 12:15:59 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
24576:0o5S1D5svi7drotuH+6q/seuKOo/vcsHllP/fJ6Fye:V5S1D5sK71otuH+L/shKOoXhDP/B6Fye

Entry address:
0x854B5

Entry point:
E8, F0, AC, 00, 00, E9, 89, FE, FF, FF, CC, 8B, FF, 55, 8B, EC, 83, EC, 18, 53, 8B, 5D, 0C, 56, 8B, 73, 08, 33, 35, 40, FA, 4B, 00, 57, 8B, 06, C6, 45, FF, 00, C7, 45, F4, 01, 00, 00, 00, 8D, 7B, 10, 83, F8, FE, 74, 0D, 8B, 4E, 04, 03, CF, 33, 0C, 38, E8, 4C, A4, FF, FF, 8B, 4E, 0C, 8B, 46, 08, 03, CF, 33, 0C, 38, E8, 3C, A4, FF, FF, 8B, 45, 08, F6, 40, 04, 66, 0F, 85, 19, 01, 00, 00, 8B, 4D, 10, 8D, 55, E8, 89, 53, FC, 8B, 5B, 0C, 89, 45, E8, 89, 4D, EC, 83, FB, FE, 74, 5F, 8D, 49, 00, 8D, 04, 5B, 8B, 4C...
 
[+]

Code size:
636 KB (651,264 bytes)

Remove bcbcabfdgcdf.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.