home

daemon-tools-4.48.1.exe

DAEMON Tools Lite

Sevas-S LLC

The application daemon-tools-4.48.1.exe by Sevas-S has been detected as adware by 21 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from daemon-tools.pl.downloadable.co and multiple other hosts.
Publisher:
Sevas-S LLC  (signed and verified)

Product:
DAEMON Tools Lite

Version:
1.0.0.0

MD5:
c1e5f78a43781bb4a0748e250a48b475

SHA-1:
ce06b145d2e5806ce1341138827ef057cc8dd865

SHA-256:
ad5fc1c0c1cbd6fb01e82307e510e22d36ca4776e6cba88433757944beef62e0

Scanner detections:
21 / 68

Status:
Adware

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
11/14/2024 4:25:04 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

Avira AntiVirus
APPL/Downloader.Gen
7.11.170.232

AVG
Sevas
2015.0.3360

Baidu Antivirus
Adware.Win32.OpenCandy
4.0.3.1495

Bkav FE
W32.Clod32f.Trojan
1.3.0.4613

Comodo Security
Application.Win32.OpenCandy.~WD
17377

Dr.Web
Adware.OpenCandy.39
9.0.1.0248

ESET NOD32
Win32/JoyDownloader
8.10369

G Data
Win32.Adware.OpenCandy
14.9.24

IKARUS anti.virus
PUA.JoyDownloader
t3scan.1.7.5.0

K7 AntiVirus
Unwanted-Program
13.177.12109

Malwarebytes
PUP.Optional.OpenCandy
v2014.09.05.03

McAfee
Artemis!C1E5F78A4378
5600.7016

nProtect
Adware/W32.Agent.486728
13.12.23.01

Reason Heuristics
PUP.SevasS.R
14.9.5.15

Rising Antivirus
PE:PUF.OpenCandy!1.9DE5
23.00.65.14903

Sophos
Generic PUA IA
4.98

Trend Micro House Call
TROJ_GEN.F47V0317
7.2.248

Trend Micro
ADW_OPENCANDY
10.465.05

VIPRE Antivirus
Sevas-S Installer
32820

XVirus List
Win32.Detected
2.8.7

File size:
493.4 KB (505,208 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\daemon-tools-4.48.1.exe

Digital Signature
Signed by:
Sevas-S LLC

Authority:
VeriSign, Inc.

Valid from:
2/23/2014 2:00:00 AM

Valid to:
3/26/2015 1:59:59 AM

Subject:
CN=Sevas-S LLC, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Sevas-S LLC, L=Kyiv, S=Kyivska oblast, C=UA

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
4B35AC223F4DB03D3B4C5368983A4B53

File PE Metadata
Compilation timestamp:
5/20/2013 2:53:11 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6144:PL2cIeeCNVlQ+jJ2qoTabv/fbH/VAdZY3VXNRipGS+IlEOcS+On1UnbDuGvRMGyt:PKcAqXQ+d2Ro3ydZYh3IlHcG1ibPvwgc

Entry address:
0x333E

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, A2, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 80, 40, 00, 55, FF, 15, AC, 82, 40, 00, 6A, 08, A3, 78, 4F, 43, 00, E8, A8, 2E, 00, 00, A3, C4, 4E, 43, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, F0, B1, 42, 00, FF, 15, 7C, 81, 40, 00, 68, 7C, A3, 40, 00, 68, C0, 3E, 43, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 81, 40, 00, BB, 00, F0, 43, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
24.5 KB (25,088 bytes)

The file daemon-tools-4.48.1.exe has been seen being distributed by the following 22 URLs.

http://daemon-tools.pl.downloadable.co/get_file/wUiS4WnYccXBwj zXP7oQkEsml0kPj 1E1v4ZtbB4Kt2tCersGMrwdoKLEfhab/8N3e3g15ZMmmeT7DkWOlmivwimNSWRAaQ/SXqWBei5SThlrGO8YWbg2gIq5Y6kRUbAGSsSTR2ntEo/CvoUSCTQrZOl4TzPHQNb7MgaEFRZ/.../rAAfh9cW4k1pnLHmHsmgez93XInnl

http://daemon-tools.downloadable.co/get_file/wUiS4WnYccXGwj 8XPavWwllklU1NSrzSU2vP4LO8bxpsSbjpnZ2w8UPMxKvPan3fHm ykYHcXGHWOOgEqdwmuc0m4HeFQfS9S74BlSj4Tj/16SY65uEg2gIq5QyiUcWBSP6VWBo0Jx2omjoUSCTRrZOnY hbnVSerJrJRkLM6bwXnt/.../hS2kA91Wrc25SWut94Ob2SYhbaRCV49 M3wporv SQhqzRyy3c9FFD7qRQfwqYiknls3NTHOu2AG3NvTInnl

http://daemon-tools.downloadable.co/get_file/wUiS4WnYccXBwj qXP7oQkEsm10kPjqnChOxat7Zp6dy/269qGl42docJgTtbLHuaSrglUZTcWmOGOO1TORinuY 2YLCWFDS4ivmCE7puWXqw6DDpZrSkGNBs8FpwBUeBT/iSGJnn4Aj/ynwSDfIFeEDltqlaGhbK6s5bBIJOb2hCSYrLYzcLVgojqv2FiI3c8b40ucnSDDuoFGMlvxmFpO/cNClLHtf1dPkRL02lF4f74LvjF/.../kSa0Vocdt4XuUXKwuZCUmywnZ7VATYc2enUguvDkRE5zhU 61t5PUCbjDB s4IjvhAUiNGCD4TRAgp6QInnl

http://daemon-tools.13-120-120.5410d12a87af0.dablecdn.com/get_file/lfIxoYPRvjB-z72P5bvaPg/1410391866/13/17/1/.../daemon-tools-4.48.1.exe

http://daemon-tools.pt.downloadable.co/get_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxLzYtbB4bJjsDqgvywtlIdNP0ykYr32LSb0gA0aZ3GHQuOmHLQ3wLBhzMCfDE b/CXqTx jqnDmgfTSpZrSkmlZ4cxkkV4BXnWtGD93lNEivSH5UHHfGehOw4TrND0VabsyPRNMOaz9RCMmLNzFZREghrPlFTQuO4/w2/.../9ys2AWnMLcxyHP6QNJZ8MOzXXj35tnFiCdjbbBJV9JiZSt28vCsXhBjhAS0089PUCbjDB s4IjvhAUiNGCD4TRAgp6QInnl

http://daemon-tools.13-120-120.540612525128c.dablecdn.com/get_file/JeiY4pOVRA6leQJE98oS8A/1409687650/13/17/1/.../daemon-tools-4.48.1.exe

http://daemon-tools.13-120-120.5411d9ea94ccc.dablecdn.com/get_file/GesqL2dnA6B237Wo0Pn5kw/1410459642/13/17/1/.../daemon-tools-4.48.1.exe

http://daemon-tools.pt.downloadable.co/get_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjymGBz3adrXtOh152f0sDcx2dBNJ0DtevylYSfjhxdKOSCGGOO1Qexj0bIjzsSXFQ2W7SS7BkD9qi3g16GE7MvT0mlJq4c0h0dJF3ykACw2zZc79XLwW2CSA7ZdyM3zY25EKOVjZl1Nb738FXB esTcckp30f66D2J6J9mxw Z2BGqwoByWyO1nR5i etCvbXFO1IK3HuM230RB/4O h1vyfKt3lz6tQMVf5NX/.../MW4hBIhIHbMpmsKiJGGInnl

http://daemon-tools.13-120-120.541342c2e1328.dablecdn.com/get_file/f6f1i6jJwDXnSBRBTOnWZg/1410552018/13/17/1/.../daemon-tools-4.48.1.exe

http://daemon-tools.downloadable.co/get_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEhv4cpqK4fE9rm/9qHpzydscJgTtabv2LSflgxQEYyrJWbW1E/.../XpMuN2SMS48AiiAxIVXKmCjtwlsMo CC5UGeTUuoFlJLzPHQNaro4PUxeZvKoCGc7J5GSZQYmkqXsDCc7Lc2nw Z2BG woAyQwKs5RoC2M8isZWNY29O2XuMnlQ9VtNzvhhvybaBnli6mEcQe5MSxUTqw54ObwyYhZL0AT4c3KyZ65PCsXhBjhASx0M9PUCbjDB s4IjvhAUiNGCD4TRAgp6QInnl

http://daemon-tools.13-120-120.541395cf0a109.dablecdn.com/get_file/v4bMM-Y_Oi6Hs0yYwZBp7w/1410573279/13/17/1/.../daemon-tools-4.48.1.exe

http://daemon-tools.es.downloadable.co/get_file/wUiS4WnYccXBwj zXP7oQkEsml0kPj 1E1v4YtbB8ack5ib0o2JgyskFbk3kYqm6ZieuyxdSMWmeGuunCr50yb9q1pDCW1jEvT3zT0z1smm7j fa7dPbm3EL MEiiBZIV3y1Czx1hshq9C3wSDbRAOUendXqbj0GbLgyKh8MMajwXTl1ec7ENE97z G4Q29gOtng2q4/D2uwoA6eyaIzWo/5L53yLGNXnMu F/.../Mz4SXvquYPEy3l9OOheAdtiZTw tPyjFQRgkEP4gs9PUCbjDB s4IjvhAUiNGCD4TRAgp6QInnl

http://daemon-tools.13-120-120.54062f3d2877a.dablecdn.com/get_file/gzIRqUlu-3zFYErFXlByPQ/1409695053/13/17/1/.../daemon-tools-4.48.1.exe

http://daemon-tools.pt.downloadable.co/get_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEhv4cp K4fE9tG//oWMxwd8EPxG NO7uNDC2wldSIDfdTrT4RqhznOY8h9uZGQiZ4S7mWQ6iqnD8gfPbvIyQ0ToJ9Ic72l9DUHauDDdwlMYo9WjwWGmLH/9Ow4TrMD0VL Bse0dIcL38FXB8ctyXf08wh LuECw3eYLg2q4/DWOo8gObjvQvDpG3YsOsb2NXnMu F/.../JHkHy288YOb2SYibaRHQZY2enUisOi1SUMizkrhnpgGTz7qRQfyoZD2k15wYy2apS5LgoWQInnl

http://daemon-tools.13-120-120.541475879d9f4.dablecdn.com/get_file/AZLLoaD-DLVxZOMiLeb_7A/1410630551/13/17/1/.../daemon-tools-4.48.1.exe

http://daemon-tools.13-120-120.54147127819cf.dablecdn.com/get_file/QSwgh7ftp42spBd_luU95Q/1410629431/13/17/1/.../daemon-tools-4.48.1.exe

http://daemon-tools.pl.downloadable.co/get_file/wUiS4WnYccXBwj sXP7oQkEsm10kPjqnChOxat/Zp7pvuXf14WJwwckPKlXsK7H/NWH/mQBKOTqGGuqsW78xyas2m5rJUk6D9GzyDkzlvH tgLbbrNPK1SdZqtY6gl9QVWSsSTR0lMk7qnK5Gj/ICfkelNXqdD0GarMge0labvCpSz4gJ5KNNBBhhqfuAHNtONywhP8 V2O7tlvPmv1lAJC0e4Gka3tOiZjhSPsv3BcX7oLv2QmtM/.../F0nkybPVJRo4veSZ3ounkFxlrnBey189PUCbjDB s4IjvhAUiNGCD4TRAgp6QInnl

http://daemon-tools.13-120-120.541672feccc82.dablecdn.com/get_file/cyn7OqYWRFUWu2wdzxtsGw/1410760974/13/17/1/.../daemon-tools-4.48.1.exe

http://daemon-tools.downloadable.co/get_file/wUiS4WnYccXGwj 8XPavWwllklU1NSrzSU2vP4LO8bxpsSbjpnZ2w8UPMxKvPan3fHm6ykYNeiPVWby1E w9wr1hxMGbBwWW/CS7BkT9qiT8mf6SpN7SgyQS/8FvxBZQXzWtCTRnzZp97CC5UGGTUr1b2syiPTQNevlrewoEcKX0XGh es7cLVgoj6v2VH9xao6x2 4/HGi4skjE3/VvDoD KZa8ZChW3sK2XuMilQ9DstSp2BrqZel/.../44JDmzR1hemDP 2AV18vSInnl

http://daemon-tools.13-120-120.5414878d04593.dablecdn.com/get_file/nrF477whjrJuBxX5K-YDKw/1410635164/13/17/1/.../daemon-tools-4.48.1.exe

http://daemon-tools.downloadable.co/get_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv A8/yan9np5ktEPLkykYrj2LTPllEZTcWmPEfumGrUlyPpqwsyPUVPNq3q6Hk20snm1mfHVvNKbm2BBs8xp10dJF3ylACx0k9EivSH8UHHMCPwFipLzPG4Nab0zLx4MNq7xVXE8cs/.../MW4hBIhIHbMpmsKiJGGInnl

http://daemon-tools.pt.downloadable.co/get_file/wUiS4WnYccXBwj zXP7oQkEsml0kPj 1E1v4YdzZp7dvriWi8yE3iYccJgTtabn2LSftlQkHbH7IRLb7W6c8gLNkztTLXlDE7SS7BkT0smnr2qCM8YfF1TwU/dYth0tGXGimFGs9wdEivSH4UHHdBK5Xi83gPSUGerJxJRsFIeyuAmh0IcTPJRBhhqfuAHB6JNGnk/8 TWO4uEjLmO1nR5i etDuNiVO1IK3HuM2nh8V/.../ug4IDUD7qRQfwqYiinls3NTHOu2AG3NvTInnl

Remove daemon-tools-4.48.1.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.