home

business_dynamics_systems_thinking_and_modeling_for_a_complex_world_downloader.exe

SmileFiles Installer

CandyMandy LLC

The application business_dynamics_systems_thinking_and_modeling_for_a_complex_world_downloader.exe by CandyMandy has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup and installation application and has been known to bundle potentially unwanted software. The file has been seen being downloaded from d.failsmail.com.
Publisher:
http://smile-files.com  (signed by CandyMandy LLC)

Product:
SmileFiles Installer

Version:
1, 0, 624, 1

MD5:
1a54e65769fd0d76f0e74b3c6b7c1018

SHA-1:
1d4575234c299c7ae19fac34cbc4ffb85e7b6518

SHA-256:
3c96f4856555a69812ab3e65eaea001e9e7cfd1c3cc21fe673db9109142a5859

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
11/14/2024 9:26:07 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.CandyMandy.Installer (M)
15.12.11.16

File size:
3.9 MB (4,083,336 bytes)

Product version:
1.0.0.1

Copyright:
Copyright http://smile-files.com (C) 2014

Original file name:
SmileFiles.exe

File type:
Executable application (Win32 EXE)

Language:
English

Common path:
C:\users\{user}\downloads\business_dynamics_systems_thinking_and_modeling_for_a_complex_world_downloader.exe

Digital Signature
Signed by:
CandyMandy LLC

Authority:
CandyMandy LLC

Valid from:
3/25/2015 6:18:45 AM

Valid to:
3/24/2016 6:18:45 AM

Subject:
CN=CandyMandy LLC, OU=CandyMandy LLC, O=CandyMandy LLC, S=London, C=UK

Issuer:
CN=CandyMandy LLC, C=UK, S=London, L=London, E=admin@candy.com, OU=CandyMandy LLC, O=CandyMandy LLC

Serial number:
100001

File PE Metadata
Compilation timestamp:
4/3/2015 11:50:01 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
98304:JdRbQymJyWOVkioADVSitskl0o4HYCDyAM8nlZb9Hjgg+P99:JdRbbMydRkkl07rtM8nlFGVPH

Entry address:
0x75DF0C

Entry point:
9C, C7, 04, 24, 8D, 1E, AF, D3, 54, 88, 04, 24, C7, 04, 24, EB, 2E, 52, CA, 60, C6, 44, 24, 04, F1, 60, 88, 54, 24, 04, 8D, 64, 24, 40, E9, DD, 35, 08, 00, 39, D0, E8, 5A, 84, FF, FF, E9, B5, B4, 01, 00, 60, F7, D0, E8, 8F, B2, 01, 00, EE, 88, 2A, 94, 0A, 68, C2, D9, EC, 73, 72, 32, D2, 7F, BD, FF, 65, DB, 65, DB, 4D, 6F, A5, 1B, AD, 73, B5, 2B, 85, E7, 4D, 6F, A1, 1F, A5, E7, 75, EB, 45, EC, 4E, 7E, 6E, EF, 41, 5E, 62, D4, E4, 45, DB, C4, F8, 4E, 5F, 52, B8, 3B, E5, 98, 7D, 09, A5, 1C, 8F, 2E, 1A, 03, 75...
 
[+]

Entropy:
7.9937  (probably packed)

Code size:
796.5 KB (815,616 bytes)

The file business_dynamics_systems_thinking_and_modeling_for_a_complex_world_downloader.exe has been seen being distributed by the following URL.

http://d.failsmail.com/j5GHQnHZp151x Z7c9awLmffpmxBuao/c6muZE6giD11pYswCbGHPw2ZgjtPtJgNSfeTCEDLmEB1i5AfVo15WGmDdxsm1n0Ie8U5TXLLJrF7xSChIXV74jI5LL9qOxSqbypV9hBkR/4US0T7VysX1xx9U8EbQ2bfD1RYkk8OIt8XTy6KsxY93/VrJdD5TGy35lk0o EuPL 4JzKivDwFoMEvCqLMJBuimwE dg9EI/xPxmO0QsmhdlZTcnODPKs1xy4zvteuMr3WrzK lajM/xa4GaN6Ph4vrn/.../3RYBHizy8btcs0T6HMBU 4xVAF2cFSBdXIDQneYEoL3zxHIcJvGCLFPxt9m3elPpNn828xKrJhPQ==

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.