» cnet_free-wma-mp3-converter_exe.exe
Overview
Analysis
File Details

cnet_free-wma-mp3-converter_exe.exe

CNET Download.com Installer

CBS Interactive, Inc.

The application cnet_free-wma-mp3-converter_exe.exe by CBS Interactive has been detected as a potentially unwanted program by 3 anti-malware scanners. The program is a setup application that uses the DownloadCom Spot Install installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. It is also typically executed from the user's temporary directory.

File name:

Publisher:

CBS Interactive (signed by CBS Interactive, Inc.)

Product:

CNET Download.com Installer

Version:

1.2.3.0

MD5:

02fba2733a9827d3f64e4eee77993d52

SHA-1:

75bb8a308599988680e59ed4e6a34c073490e941

SHA-256:

28bb825d946566d40efa0103b21359833fa044d77292d7c17d310696749f2ee8

Scanner detections:

3 / 68

Status:

Potentially unwanted

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

12/25/2024 2:11:54 PM UTC (today)

Scan engine

Detection

Engine version

ESET NOD32

Win32/InstallCore (variant)

8.6599

Reason Heuristics

Bundler.PPI.CBSInteractive.CC

14.8.1.0

Rising Antivirus

Suspicious

23.00.65.14228

File size:

443.5 KB (454,120 bytes)

Product version:

1.2.3.0

CBS Interactive

File type:

Executable application (Win32 EXE)

Bundler/Installer:

DownloadCom Spot Install

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\temp\{random}.tmp\cnet_free-wma-mp3-converter_exe.exe

Digital Signature

Signed by:

CBS Interactive, Inc.

Authority:

DigiCert Inc

Valid from:

7/8/2011 8:00:00 PM

Valid to:

7/12/2013 8:00:00 AM

Subject:

CN="CBS Interactive, Inc.", O="CBS Interactive, Inc.", L=San Francisco, S=California, C=US

Issuer:

CN=DigiCert High Assurance Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:

0203D2F5E7ABE93E2FC72BD3381C32C0

File PE Metadata

Compilation timestamp:

6/19/1992 6:22:17 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

6144:wA+SBz0oAt5c/572jwhhwVgS0YYljRKSVAQSeTrJQOcsPWWqXMsZ1RdHnW++PgqS:nBzKc/5721VghlVP1TlQEW5XvzjJqed

Entry address:

0xFE560

Entry point:

60, BE, 00, 00, 4A, 00, 8D, BE, 00, 10, F6, FF, C7, 87, 10, B7, 0B, 00, 7E, 0B, 1C, 4D, 57, 83, CD, FF, EB, 0E, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46... 
[+]

Entropy:

7.8594

Packer / compiler:

UPX v0.89.6 - v1.02 / v1.05 -v1.22 (Delphi) stub

Code size:

380 KB (389,120 bytes)

Remove cnet_free-wma-mp3-converter_exe.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.