home

daemon-tools-4.48.1.exe

DAEMON Tools Lite

Sevas-S LLC

The application daemon-tools-4.48.1.exe by Sevas-S has been detected as adware by 19 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from daemon-tools.downloadable.co and multiple other hosts.
Publisher:
Sevas-S LLC  (signed and verified)

Product:
DAEMON Tools Lite

Version:
1.0.0.0

MD5:
4d81c99b6e5f40e73ba517d724b04ea0

SHA-1:
80a34b52500ff64ae98ba5b85352cf9467b068c4

SHA-256:
30e098d0fdccdeb7fa9e622d5e6348f369b5976488790d6020ce334a86e56de9

Scanner detections:
19 / 68

Status:
Adware

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
12/25/2024 12:10:59 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AVG
Generic
2015.0.3381

Baidu Antivirus
Adware.Win32.OpenCandy
4.0.3.14815

Bkav FE
W32.Clod32f.Trojan
1.3.0.4613

Comodo Security
Application.Win32.OpenCandy.~WD
17377

Dr.Web
Adware.OpenCandy.39
9.0.1.0227

ESET NOD32
Win32/JoyDownloader
8.10250

IKARUS anti.virus
PUA.JoyDownloader
t3scan.1.7.5.0

K7 AntiVirus
Unwanted-Program
13.177.12109

Malwarebytes
PUP.Optional.OpenCandy
v2014.08.15.07

McAfee
Artemis!4D81C99B6E5F
5600.7037

nProtect
Adware/W32.Agent.486728
13.12.23.01

Reason Heuristics
PUP.SevasS.R
14.8.15.19

Rising Antivirus
PE:PUF.OpenCandy!1.9DE5
23.00.65.14813

Sophos
Generic PUA IA
4.98

Trend Micro House Call
Suspicious_GEN.F47V0720
7.2.227

Trend Micro
ADW_OPENCANDY
10.465.15

VIPRE Antivirus
Sevas-S Installer
32190

XVirus List
Win32.Detected
2.8.7

File size:
489.7 KB (501,424 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\daemon-tools-4.48.1.exe

Digital Signature
Signed by:
Sevas-S LLC

Authority:
VeriSign, Inc.

Valid from:
2/23/2014 1:00:00 AM

Valid to:
3/26/2015 12:59:59 AM

Subject:
CN=Sevas-S LLC, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Sevas-S LLC, L=Kyiv, S=Kyivska oblast, C=UA

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
4B35AC223F4DB03D3B4C5368983A4B53

File PE Metadata
Compilation timestamp:
5/20/2013 1:53:11 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:iKcAmcvir9knhrd7F9zQi23aQBLQw3t2LyzMqI/Z6:+Amxr9khx7bQi23a6LT4mZI/A

Entry address:
0x333E

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, A2, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 80, 40, 00, 55, FF, 15, AC, 82, 40, 00, 6A, 08, A3, 78, 4F, 43, 00, E8, A8, 2E, 00, 00, A3, C4, 4E, 43, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, F0, B1, 42, 00, FF, 15, 7C, 81, 40, 00, 68, 7C, A3, 40, 00, 68, C0, 3E, 43, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 81, 40, 00, BB, 00, F0, 43, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
24.5 KB (25,088 bytes)

The file daemon-tools-4.48.1.exe has been seen being distributed by the following 23 URLs.

http://daemon-tools.downloadable.co/get_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxLzYtbB4bJjsDqgvywtlIdNP0ykYrn2LTf40l8bOGKGCei1E/Y9wbNym4WPDE b CXqSx p7CT4yOfa7dPem3Ee6dVpwQBQXy tCzp1nMUs C3 WmjaSr9W2oe4YyUMK7MxJQoOMa/.../h0r5abh 1CaiCd0Lt5vuUXKquZOTkD50NuMeGtogfSB87KG6GQRlhgixyYgMRj7qRQfwqYiinls3NTHOu2AG3NvTInnl

http://daemon-tools.downloadable.co/get_file/wUiS4WnYccXBwj qXP7oQkEsm10kPjqnChOxat3Tv/FitCa /jk7jplSP0ykYrr NWHokQEFbT2RX7b4RPYlyPpqwsyPUVPNq3q6Hk20snm1mfHVvNKbm2BBs9Np10dJF3ykACx0lsM79WjwWGmLH/9Ow4TrMD0VL Bse0dIcL38FXB8ctyNf08wh/juEyUuO4/x2/9sVz2ouRnFnvV BZWve4GkaXtOion9RKtxjRZM54n5jVH9b6J9kS2tQMVf5NX/.../MW4hBIhIHbMpmsKiJGGInnl

http://daemon-tools.downloadable.co/get_file/wUiS4WnYccXBwj zXP7oQkEsml0kPj 1E1v4Y9bB9rpi/26nqGlxwJgEKU31PuKgamG3g15aMWmeT7jyRepp3v0/m5reGgiP yfmDVii8C6tgLbbrNPKziBZqtY6hF9QEy/5XmEy19EivSH5UHHZGehOw4TrND0VabsyPRNMOan9RCwgJJqbZAkpz6vmGDQhfJf5kuczBHvv hqW3qp D8u3ccauZnFf3MK HuJnlR8f/.../hS20CIxX78exUS2w8NHMy2VlJepRTsc3OH0porb2SEc 0Av0iIIYUD7qRQfwqYiinls3NTHOu2AG3NvTInnl

http://daemon-tools.downloadable.co/get_file/wUiS4WnYccXBwj zXP7oQkEsml0kPj 1E1v4Y9bB87pi/269qGt42doMLVXsK7H/NWH/mQBKOTqGGuqsW78xyas1jIbERVmD9HbyDUL3sH 2i/TRp9Kbm2FBs8pzkV4BXnGtGHksypd2uWjoUSCTQ7ZOiJ61JTxEYro4PRkNM738FXB9ctyKYgkpz6vlGDQkao6x2 s/HD/l7g6a3u1nR5i/.../MW4hBIhIHbMpmsKiJGGInnl

http://daemon-tools.pl.downloadable.co/get_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv I253eq ysyl4pHaAW7erC/NXK ykYMYzbRRLe6XOpon/pyz4WXAwaDqXakWVT8 3G9iP/D oiNzDwVvNFv3AkBSXK5DjZrld18tn7oUSCTQ7ZOiJ61JTxEYro4PRkNM738FXB9ctyKYgkpz6vlGDQkao6x2 4/.../SPsvxhcU6Yj1jFH7ba52nG sBcVPuJjnFyyroZrTkC4qdbJHV49 M3wporv SQhqzRyy3c9FFD7qRQfwqYiinls3NTHOu2AG3NvTInnl

http://daemon-tools.ru.downloadable.co/get_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjynEBrzYdXbsOh152P0sD4tl49bb1XsK7H NWG4xEZTcWmPEfv QeElyPpqxsyPBguD9GzyDkzl/D tgLbbr9PKkHFA4p8xg19QAC/kSmIk3YZrojnxGWmYQrZOnJa0amhZdf1tcERMIaS0XHl1aoiXcgkpz6vnGDQkeoXg2q4/CmOo5AOTye1nR5i/.../qRQfwqYiknls3NTHOu2AG3NvTInnl

http://daemon-tools.pt.downloadable.co/get_file/wUiS4WnYccXGwj 8XPavWwllklU1NSrzSU2vP4LO8bxpsSbjpnZ2w8UPMxKvPan3fHm6ykYNeiPVWby1E w9wr1gzM6cBwiS/CS7BkX9qjvm3 fa7dPbm3FKo5UiiBZIUny1XGEpwJZr7CC5UGGTUrhY2syiPTQNev9rewoEcKX0XGh es7cLVgoj6v2UX9xao6r2 w2BSqwsVDdxaY4Fpn esCkfXBbzcr F gklQ9BtMu90QmxK gphSflCc5f5NXvEiy07M N3nN/.../VRTsc3O3Ux9Ka1Fllrjxyi1s9PUCbjDB s4IjvhAUiNGCD4TRAgp6QInnl

http://daemon-tools.13-120-120.53f99b9a04766.dablecdn.com/get_file/Y1O6-0CZDBrGFj4frvH7yw/1408870825/13/17/1/.../daemon-tools-4.48.1.exe

http://daemon-tools.downloadable.co/get_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjynEBD1YNTRseh152b0sCgrn8kFbk3kYqn9PXOuyxdSNmmeTbD7Tac8gLNix8yPU13EonCmEQKo5yf8lvHPqtHGkH0e6cAiiBZIV3y1SWchhshw9Cr5USCTQ7ZOkZ61JTxEYrs4PRkIIaS0XHl1aoiXcgkpz6vnGDQkeoXg2q4/CGOo5AWTyKouFpn esCkfXVYzcr F gklQ9BtMu90QmxK gphSflCc5f5NXvEiy07M N3nN/O/.../44JDmzR1hemDP 2AV18vSInnl

http://daemon-tools.13-120-120.5400c1d3e6ad2.dablecdn.com/get_file/jNIsqyX12EeZXevwe1cSOQ/1409339363/13/17/1/.../daemon-tools-4.48.1.exe

http://daemon-tools.13-120-120.53efa61f90df3.dablecdn.com/get_file/GjEV2C16UpXf8WorsAkSZA/1408218159/13/17/1/.../daemon-tools-4.48.1.exe

http://daemon-tools.downloadable.co/get_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxLzYtbB4bJjsDqgvywtlIdNP0ykYr/2LSXlnAFKOSCGGeqtCuFmluQ/mtvZWFPNvDL8EkL/pnqh3r2EvNKbm2BBs9Np10dJF3ykACx0lsM79WjwWWmLA UI2sy4PTYEY/o4LBIdc/.../2zFYvP3bEsGgV1djWOHnl

http://daemon-tools.13-120-120.53f7f5ed67d61.dablecdn.com/get_file/PGJZqIZd43GWmjNNrfCVQA/1408762877/13/17/1/.../daemon-tools-4.48.1.exe

http://daemon-tools.downloadable.co/get_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv A8/yWn9np5iNENJ1XmarvuNDC2xF5KZDrQTvusW781wLNykJfIWlPP4munUxq0pX hj/3Pr8eN2TZZqtY6hV9QAin7Xms3hshq9CnwSGedUrcfwsTrJXFePKs5bBIMOb32VHptc43EJREwz/.../CGOo5xKPxb05FpnkesOqb3lb2cO1Guwv3BcX55q5yUrzLaB0nT6nEcQe5MSxUSCw54Ob2SYibaRCQpY2enUisOi1SUMizkrhnpgGTz7qRQfyoZD2k15wYy2apS5LgoWQInnl

http://daemon-tools.downloadable.co/get_file/wUiS4WnYccXGwj 8XPavWwllklU1NSrzSU2vP4LO8bxpsSbjpnZ2w8UPMxKvPan3fHm6ykYObT/YTqu1E/Y9wbNywMKPDE b/CXqTB jqnD8gfbbvNjakXFA4p8xg19QAC/kSmIk3YZrojnxGWmYQrZOnJa0amhZdf1tcERMIaS0XHx1apuGZkJg2bPvSywkfIX70u48DW 4uRnFn/V QsvpYsntZXJWzcC/.../zDU75oJD2nlZxLHmHsmgez9jUInnl

http://daemon-tools.es.downloadable.co/get_file/wUiS4WnYccXBwj sXP7oQkEsm10kPjqnChOxat7Zp7x1/269qG942ZxXcxO4L/.../3Pr8eN2TZZqtY6hV9QAin7Xms3hshq9CnwSGedUrcfwsHrJWJPKOBwegoEaqX2Unp3fczIJxIjh LuESw3O9ymw ZsBGi5uRnFnvV QNave4GkbntO3tO2XuMnlQ9MtNzvhhvybKBnliu0CIxX78exUS2w8NHMy2VlJepRTsc3OH0porb2SEc 0Av0iIIYUD7qRQfwqYiknls3NTHOu2AG3NvTInnl

http://daemon-tools.13-120-120.53fb48ef04ceb.dablecdn.com/get_file/ZvIv5Xs64RDHht5hfpAQ4w/1408980735/13/17/1/.../daemon-tools-4.48.1.exe

http://daemon-tools.downloadable.co/get_file/wUiS4WnYccXBwj zXP7oQkEsml0kPj 1E1v4Y9bB9rpi/26nqGlxwJgEL031LP/uNDC2wV5KM3GHWOOjEqdhmuU11s3eDQ6S9T2sXROq5yWiz6qO8prFlX1PqYsxnQAKAWSsSTR3ntF2vTnxGWmeSq4bkZm1aHBEerJxJRsFIemuAmh0O8TNLAkjjqH2GWUvfo/.../qRQfwqYiknls3NTHOu2AG3NvTInnl

http://daemon-tools.13-120-120.53fb4880d3e48.dablecdn.com/get_file/DYaHAZmUNu92V0pDyB_okw/1408980624/13/17/1/.../daemon-tools-4.48.1.exe

http://daemon-tools.downloadable.co/get_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv U8/zOh/jwnickFbk3lYqn4O2G3g15eOHHZU6n WuAlyOBqxcKdDwWZ/yn6D020sni1mbWI svT0mlIq4cxgVVQXzWtCTRnzZp97CC5UGGTUr1b2syiPTMNeu9rc00dOOz9VHl1apqfc0Z90rygTXl5O5j2z k9EGik5xKajvQvDpG3YoH3O2NXhsu8HuJnlR4f/.../44JDmzR1hemDP 2AV18vSInnl

http://daemon-tools.13-120-120.53fb64d301ba0.dablecdn.com/get_file/rJvQ5bqOSZzoeUCERrDAeA/1408987874/13/17/1/.../daemon-tools-4.48.1.exe

http://daemon-tools.downloadable.co/get_file/wUiS4WnYccXBwj zXP7oQkEsml0kPj 1E1v4Y9bB9bpi/269qGt42doMLVXsK7H NWHjg0ZTcWmLEfvgQetjnP4j1s3eDQ b7WyhWFT84XG iP6SpNjYm3Ef NZw3wQLETT7GDU2nsIr9DmuCzbEH JBjJi a3QVY/o4LBIddfajRHE8cs3ENBogjLPvUSwncpe2lf8 TWO7uEjOjvQvDpS3YpfmLygeitO2ROMlmx0d5ID6hV/7Zel/kya0VZYBu9WwAHPrsJuCzn11OukdWMBiZiNgrea5GRJ/.../rAAfh9cW4k1pnLHmHsmgez93XInnl

http://daemon-tools.downloadable.co/get_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv E8/yG6sGMxwdoEP0b1Y/j2OXmulgsEZjbOCeLkErc90b1k1s3eDQqb7XqwTB 17Wm00v/QqtnQkGJCppA3iBZIV3y1Smchhshq9CjwSGKbQK5Xi83iPSVEMe0gJEEFMqz8FXB8ctyIf08wh LuESw3eYfyw Z2BG2woAyWwKp D9G3csGkfSUNipziQ/.../zDU75oJD2nlZxLHmHsmgez9jUInnl

Remove daemon-tools-4.48.1.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.