candy crush saga.exe

Stepan Rybin

The is the installer for the WebPick InstalleRex download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed without consent. The application candy crush saga.exe by Stepan Rybin has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from any-unix.xyz.
Publisher:
Stepan Rybin  (signed and verified)

MD5:
63defe9c017463cea09a7d0111b7933c

SHA-1:
ee1c3127d01d54698102e53c17cb2fc2b616c5a6

SHA-256:
843736e0e570935ecb4eeb133b9448c529d074717c41472e18ded9af913dfeb5

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
11/27/2024 5:45:50 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.WebPick.StepanRy (M)
16.4.30.8

File size:
471.7 KB (483,016 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\candy crush saga.exe

Digital Signature
Signed by:

Authority:
Unizeto Technologies S.A.

Valid from:
6/27/2014 2:07:40 PM

Valid to:
6/27/2015 2:07:40 PM

Subject:
E=rybin.step@yandex.ru, CN=Stepan Rybin, O=Stepan Rybin, C=UA

Issuer:
CN=Certum Code Signing CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL

Serial number:
47154C2151E9EB8DFA42C2C9E45BFC6C

File PE Metadata
Compilation timestamp:
1/1/2013 7:08:39 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
6144:g3CCtb9A7eqSHN3BT6mm0F6JcVuNRTYUwALVwYpSb9AIhiKkgakoQYm3O+78qlG0:gyC5xRttVhMiuHTYUlLVwnA/Xq+Clt

Entry address:
0x4540B

Entry point:
E8, CF, 1F, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 10, 02, 45, 00, E8, DF, 24, 00, 00, E8, 9C, 21, 00, 00, 0F, B7, F0, 6A, 02, E8, 62, 1F, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 28, 02, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
6.4331

Code size:
297.5 KB (304,640 bytes)

The file candy crush saga.exe has been seen being distributed by the following URL.

Remove candy crush saga.exe - Powered by Reason Core Security