home

CDex-1.79-win32.exe

CDex

Georgy Berdyshev

The application CDex-1.79-win32.exe, “CDex - Open Source Digital Audio CD Extractor” has been detected as a potentially unwanted program by 9 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer, however the file is not signed with an authenticode signature from a trusted source. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars.
Publisher:
Georgy Berdyshev

Product:
CDex

Description:
CDex - Open Source Digital Audio CD Extractor

Version:
1.79.0.2015

MD5:
d0583f347e443c6193f07a3fa53f43af

SHA-1:
e1e718bb1f3bd67f5ada0f6e1eff34d8d9ade0b4

SHA-256:
5fd4adfd8ff0fb9c8d00981fa42046f0c4e96c57b04d09b5ef4809f4920b278f

Scanner detections:
9 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
11/23/2024 8:02:20 AM UTC  (today)

Scan engine
Detection
Engine version

AVG
OpenCandy
2016.0.3077

Dr.Web
Adware.OpenCandy.137
9.0.1.0166

ESET NOD32
Win32/OpenCandy.C potentially unsafe (variant)
9.11788

K7 AntiVirus
Unwanted-Program
13.205.16247

Malwarebytes
PUP.Optional.OpenCandy
v2015.06.15.11

Rising Antivirus
PE:Trojan.Win32.Generic.126771D8!308769240
23.00.65.15613

Trend Micro House Call
PAK_Generic.005
7.2.166

Trend Micro
PAK_Generic.005
10.465.15

VIPRE Antivirus
Opencandy
41152

File size:
12.6 MB (13,223,378 bytes)

Product version:
1.79.0.2015

Copyright:
© Georgy Berdyshev

Original file name:
CDex-1.79-win32.exe

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

File PE Metadata
Compilation timestamp:
10/7/2014 6:40:20 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
393216:Ysb5YyHmdGxyL3mv95MeHIR9qW6Iis40DBp:Ysb5NGdayL3ml5oDqrIiB0DBp

Entry address:
0x335A

Entry point:
81, EC, D8, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 09, A3, B8, 92, 42, 00, E8, 15, 2F, 00, 00, A3, 04, 92, 42, 00, 55, 8D, 44, 24, 38, 68, B4, 02, 00, 00, 50, 55, 68, A8, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, 00, 82, 42, 00, E8, 80, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, 6E, 2B, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
24 KB (24,576 bytes)

The file CDex-1.79-win32.exe has been seen being distributed by the following 35 URLs.

http://ftp-stahuj.centrum.cz/dl/86abba6866173709cf9091d692116dea/582833c5/stahuj/download/software/secured/c/cdex/.../CDex-1.79-win32.exe

http://dw.uptodown.com/dwn/UMGcP1G7flRU4FAPYFjwLeTbJTNPf1IFkKx1EF397zekDzlzWrUqFZM8OMNiLq6YNRUX7RS-LvpBD0k4Gql-boQlsDckstILteGv8pzCEsWjM3eRLnR6deLQa_hi-Tig/KfMYPLZD6knjw9y8vhnBrmLVmDb3Jq5xXVS4rFvgwMT44TwV1QFXohKNcx1a6WaerXV3SISV8OHSo37bgG-BClTQYNqn_YZay9INGbr0UXfxOxB1WrLzE5g58dh92ui-/.../

http://dw.uptodown.com/dwn/Sr2FxqJI9lSTJL4iB68HvZQFrYSj9H2nUP27fVRJKp6es__ugUrHfQ__8gNb3J09_zoSz-FoFqyekfGXuu0FkMwB6S_yDsipV8i65SYSDD_3HKvOEVgD7yCHYNXNIYtN/ccO6IWuGcpfYy8GG3beZ_YQwTBjHO6KQ187eHHSF2zEaaMSmd5PSrDLGlEloSgcWTm37-B4MXbIGoqmpVBrRPjsl7DeW7afxsTqNR-PiQN555jyOW1fQIGK2eaTTd13E/.../

http://ftp-stahuj.centrum.cz/dl/330ab1041438fc6a3415d7585b9ce675/58036609/stahuj/download/software/secured/c/cdex/.../CDex-1.79-win32.exe

http://r2.computerbild.de/exec/r2r.pl?m=w-cobi;u=http://d.computerbild.de/downloads/.../CDex-1.79-win32.exe

http://fs35.filehippo.com/8281/.../CDex-1.79-win32.exe

http://filehippo.com/download/file/.../

http://ftp-stahuj.centrum.cz/dl/98b9c1adad13eb5dd9f9544b29b52a55/5803a2ca/stahuj/download/software/secured/c/cdex/.../CDex-1.79-win32.exe

http://lb.cdn.m6web.fr/d/c/a/b4805b89846ad05ca4cc1aa8c33a05fd/56427018/soft/.../cdex_1-79_en_9645.exe

http://i.download.idg.pl/fannef/ad2765036a504ae4387e5e62e91d9745/56bcd74b//vol2/w95/multimedia/.../CDex-1.79-win32.exe

http://ftp-stahuj.centrum.cz/dl/bba0fd7283d7d72b6aadb019abd07d03/55d82eec/stahuj/download/software/secured/c/cdex/.../CDex-1.79-win32.exe

http://dw.uptodown.com/dwn/ScDFZ3WegwkmvB5Dph84Zk7rGunjYPUAWY0LAgDa9NQ7h3c_lURl7m228A5seE9bzlAlMxW1Fte0DFfQgYpUeGaReAMLyw8JsJ9B_GYHRJFtA4T-wgQ6uAmDZoc0N2lJ/.../

http://filehippo.com/download/file/.../

http://filehippo.com/pl/download/file/.../

http://lb.cdn.m6web.fr/d/c/a/950fe73feb93aa7f48b6e3c43505b999/56fd14ef/soft/.../cdex_1-79_en_9645.exe

http://www.majorgeeks.com/index.php?ct=files&action=download&

http://filehippo.com/es/download/file/.../

http://lb.cdn.m6web.fr/d/c/a/0538e1e621308e1275ccea65bc0eeb3b/571226b8/soft/.../cdex_1-79_en_9645.exe

http://192.168.1.8/moodle/mod/.../view.php?id=1028

http://lb.cdn.m6web.fr/d/c/a/b51369841aa587636420960049a4591c/570ba7e6/soft/.../cdex_1-79_en_9645.exe

http://dpcdn-s10.pl/.../CDex-1.79-win32.exe

http://s6297.chomikuj.pl/File.aspx?e=nLktArPFYvZYWGfSfvuRp5qsyXFs3K82DA9HuulBiT-6-GU6fLKJO1wKH-dBYRGriOW3_9SsCiwPq9mWYDhZqKzwJMNe2sALlgDL-znZuHRYJR6y2Vn58E9QZHBP6cU4gzxve0idkW5-MAn53Bg0zQ&pv=2

http://server1.downloadlod.com/.../cdex.exe

http://dpcdn-s02.pl/.../CDex-1.79-win32.exe

http://dw.uptodown.com/dwn/c-KNef5s6dYaBSCF1LpKlnWndC7zOdELJ_MtEiq9hCCT5h0pB15JsMztgrRUW-EEUo4MMAo_vAQg0UKKG76RMSFcljqDZ7Nt9iXUPcVhJg6NkVEDLOeS3-gz-_HJLtOA/OwwkwfLRHEhmgqOcynP5zIMkt9ElMhug3bfArRThwcZjoAw5QnWLcCrYYMfZG6PJ_u-_uETuKw2Cn5HcoLJMasH1xuqa5XGAYBWG0JcGJrK_QpGT1tRgeqInNfi1Xg0J/.../

http://filehippo.com/download/file/.../

http://softonet.pl/wyslij58066-1.html

http://www.programosy.pl/.../pobierz,cdex,2.html

http://dw6.uptodown.com/dwn/prPJIHnvqRCfPS51IscqoCI4asE5fnS7PrlDzO3tN3sjT-Jtm3c0yDt0bFZ5gVUGvJ7GM6VNmdqnaqS6X3KTyAkzfL3IMVxbVw6n_6nj7q4aKCfs_jMEFavmy5VUHEIE/EDV1y2PRjQg1lmE9vCgV13NGU2IApWP5EuaRa-IFvSWB5ZZclF90i7waUg6OC2d0NFNtqzXT_reQs0o8x0ltlUBXRIoV4Q7lVrr-aY86f3Nqj0cd3LxojPWdYU2hL4N2/.../cdex-1-79-multi-win.exe

http://dw.uptodown.com/dwn/Re4bjn_4r4rYpt1qqjQuPhQ_oR8V6rbMYjZN-R7xindBD_KtaetY2zFe_p_EB6He4ExTAcPOlec94JYcEjDrv8XyNEexEVZTqLzEgD99_P95sFX2L3j2Qsxd_HkV4CbA/GamleescGNmxWvuEfN1WAQUrngFoVnHCbw53rrdKux3GN2XoIr5gS5awlxK6bnXj3F6zyr_fIkQSENa5gxbS2VSFgz76PzbsHWqs-SmKjnqOnP22gsdztvBKcpm3knzC/.../

Latest 30 of 35 download URLs

Remove CDex-1.79-win32.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.