» bsd-update.exe
Overview
Analysis
File Details
Downloads (2)

bsd-update.exe

DriverHive

Bootstrap Development, LLC

The application bsd-update.exe, “DriverHive Setup ” by Bootstrap Development has been detected as a potentially unwanted program by 3 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from localhost and multiple other hosts.

File name:

bsd-update.exe

Publisher:

Bootstrap Development, LLC. (signed by Bootstrap Development, LLC)

Product:

DriverHive

Description:

DriverHive Setup

Version:

3.0.7.1244

MD5:

a85d2642966186d0769963ce46d6b7ae

SHA-1:

c2ac3d30834ec364632e5755a57054372e3eb368

SHA-256:

73757ff05ddb553a8c1aca875c775e2075f551e0d9e0f8a86ce9e078a1ab5cc8

Scanner detections:

3 / 68

Status:

Potentially unwanted

Explanation:

Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:

12/27/2024 2:04:03 AM UTC (today)

Scan engine

Detection

Engine version

Dr.Web

Threat.Undefined

9.0.1.05190

ESET NOD32

Win32/OpenCandy potentially unsafe application

7.0.302.0

Reason Heuristics

PUP.OpenCandy.Installer (L)

16.12.9.16

File size:

6.6 MB (6,875,640 bytes)

Product version:

3.0.7.1244

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\temp\bsd-update.exe

Digital Signature

Signed by:

Bootstrap Development, LLC

Authority:

Symantec Corporation

Valid from:

1/15/2016 7:00:00 PM

Valid to:

5/24/2016 7:59:59 PM

Subject:

CN="Bootstrap Development, LLC", O="Bootstrap Development, LLC", L=Boulder, S=Colorado, C=US, SERIALNUMBER=20071493613, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Colorado, OID.1.3.6.1.4.1.311.60.2.1.3=US

Issuer:

CN=Symantec Class 3 Extended Validation Code Signing CA - G2, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:

599220844329B551B497CF0422CA30BF

File PE Metadata

Compilation timestamp:

6/19/1992 6:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

98304:j1TfPVenoCE7D5BjXRArEtNev2IMKIjaXhGTF2AyYEiYEtz7Qj/MkSbGpkVA2/Bk:R1gornRWceni2XhGTEeJQXRUJ2

Entry address:

0x9B24

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, A2, 95, FF, FF, E8, A9, A7, FF, FF, E8, D4, C9, FF, FF, E8, 1B, CA, FF, FF, E8, 0E, F3, FF, FF, E8, 75, F4, FF, FF, 33, C0, 55, 68, DB, A1, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, A4, A1, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 9B, FE, FF, FF, E8, 02, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 04, D0, FF, FF, 8B, 55, F0, B8, E4, CD, 40, 00, E8, 53, 96, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, E4, CD, 40, 00, B2, 01, B8... 
[+]

Entropy:

7.9983

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file bsd-update.exe has been seen being distributed by the following 2 URLs.

http://localhost:37848/continue?TiCredToken=4565&Source=WTP&URL=http://dl.bootstrapdevelopment.com/.../driverhivetrialsetup.exe

http://dl.bootstrapdevelopment.com/.../driverhivetrialsetup.exe

Remove bsd-update.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.