home

daemon-tools-4.48.1.exe

DAEMON Tools Lite

Innovative Systems LLC

The application daemon-tools-4.48.1.exe by Innovative Systems has been detected as adware by 7 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from daemon-tools.downloadable.co and multiple other hosts.
Publisher:
Innovative Systems LLC  (signed and verified)

Product:
DAEMON Tools Lite

Version:
1.0.0.0

MD5:
64f657c4954ece5c5fcbb0c6466bf6be

SHA-1:
e8be19261ddfbcfcc8b72ee4fa8d0bcfbcee973c

SHA-256:
ce739802859b55b71b78e4948918108b1346a1a6865f9eb6e830028f86ef2fe7

Scanner detections:
7 / 68

Status:
Adware

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
11/15/2024 1:32:14 AM UTC  (today)

Scan engine
Detection
Engine version

AVG
Generic
2015.0.3403

ESET NOD32
Win32/JoyDownloader
8.10130

Malwarebytes
PUP.Optional.OpenCandy
v2014.07.25.05

McAfee
Adware-OpenCandy.a
5600.7059

Reason Heuristics
PUP.InnovativeSystems.R
14.7.25.5

Trend Micro House Call
Suspici.F184F561
7.2.206

VIPRE Antivirus
Opencandy
31472

File size:
489.7 KB (501,416 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\daemon-tools-4.48.1.exe

Digital Signature
Signed by:
Innovative Systems LLC

Authority:
VeriSign, Inc.

Valid from:
5/19/2014 2:00:00 AM

Valid to:
5/20/2015 1:59:59 AM

Subject:
CN=Innovative Systems LLC, O=Innovative Systems LLC, L=Dnepropetrovsk, S=Dnepropetrovska oblast, C=UA

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
450EACFE8D673E82864CE46BC1A92FCA

File PE Metadata
Compilation timestamp:
5/20/2013 1:53:11 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6144:JL2cIeeCZZJQhYLV8cWHTRALpOTXK4qquWyvfWIIHkAqL3ImB6b1hcpMWoPw:JKcA2ZJQax8/F+4jUfhI6IP1heMBo

Entry address:
0x333E

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, A2, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 80, 40, 00, 55, FF, 15, AC, 82, 40, 00, 6A, 08, A3, 78, 4F, 43, 00, E8, A8, 2E, 00, 00, A3, C4, 4E, 43, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, F0, B1, 42, 00, FF, 15, 7C, 81, 40, 00, 68, 7C, A3, 40, 00, 68, C0, 3E, 43, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 81, 40, 00, BB, 00, F0, 43, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
24.5 KB (25,088 bytes)

The file daemon-tools-4.48.1.exe has been seen being distributed by the following 12 URLs.

http://daemon-tools.downloadable.co/get_file/wUia6yjQOMnI2nu1Wf6vCxAt2100NSqjHAr5I9bRv/FyqXf14WJzwckPP0ykYrj2LTXllEZTcWmPEfumGrUlyPpqwsyPUkTRpm2tHk2usnq7i/PRp9/YlWBA4p8ziUcBDSK1AWd/lcAivSH5UHHZGehOw4TrND0VabsyPRNMOaz9RCMmLNzFZREghrPlETQuO4/.../9jVzXvoFGMlv1vDoDpIZfzMC9Bm57iQao5mwMR5Zb8kw2wO7h 1CanA8VPup74AyW4 tTSxj4rJLxCR44vbS527b35AF4 0UrzxdYJ

http://daemon-tools.downloadable.co/get_file/wUiS4WnYccXBwj sXP7oQkEsm10kPjqnChOxat/Zp6BvuXf1 2JzyNBNJ0bnYqmoZjD8nAURdyHQCeLkErQ1yas0lZPAWFKMu3CnUAXlszi1if/D6p3KmiBBoJ8igkdJF3yjACwjzZ987CC5UGGaSq4ImZK8aGkaLOZtc1sSN7HzXmR ZpuGcwkpz6viGDRwMMWrk7gnBTCws17Pm/.../8 k0wynKelnnG sAMVPrp7vUXKquZKaiC0iZ6RIBo47M211777zSFhzhVW61ddWFyjzDU75oJD2nlZxLHmHsmgez9jQInnl

http://daemon-tools.downloadable.co/get_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PTK1HBzga5/Zt kksibsqSt4zNEcah65POS7fGG3g15eOHHZU6n WuAlyOBqxcKdAAmS/.../44JDmzR1hemDP 2AV18vSInnl

http://daemon-tools.downloadable.co/get_file/wUiS4WnYccXBwj sXP7oQkEsm10kPjqnChOxat7Zp7x1/269qG942ZxXcxO4L/juNDC2w15KcTrYCeL ErQ0yPpqxcaXFVjIvG kXQ y ietgLbbr9vSgzca9Mhv3UgGCyn7SSx 18kq9Dm6AzeLS/9Wy83zNjUHerJxJR4FIfmoCi4qOtzFZREghrPgFjQuO4/x2/9sVz2ouRnFnvV BZGve4GkbXtOm4WvFqounhcH7Jr2zlL ZLgg32z/.../MW4hBIhIHbMpmsKiJGGInnl

http://daemon-tools.downloadable.co/get_file/wUia6yjQOM3I2mmuF6G5QwMsilYkNHutHBLgNoWP4PE9rm/8oWJgn4pbcBi5df jYC//3VBGNmuSGvfyUOAlyPpqx8yPR1XF7SS7BkX9qnq9i fa7dPbm3ES MEiiBZIVny1Cz1nn4Aj/SHoHDrNUrcfwsTrJTYFaKs5bBIJOb2iHjomOpvcLUIojaXkFCAhfYL10eZ2BGi6uEibxbwsWMP0NYDyfXof1cC/.../twzkhIstbgyQenMulnnG sAMVPrZ7vUXKwuZCTkW8qYbxRE9thbSphounkFxhrnBK0xdYJ

http://daemon-tools.downloadable.co/get_file/wUiS4WnYccXGwj 8XPavWwllklU1NSrzSU2vP4LO8bxpsSbjpnZ2w8UPMxKvPan3fHm9wF5KZjrPW7X2UfB1n6trh8ycBQaDq36tURmppT/g1KmSvNKbm2BBs9Zp10dJDXymCTU2nsUj7H2lBjfMAq5Xi83jPSUDbKs5bBIMOb2uDy5tc43EJBEwjaL2GWUve4/.../44JDmzR1hemDP 2AV18vSInnl

http://daemon-tools.es.downloadable.co/get_file/wUiS4WnYccXBwj sXP7oQkEsm10kPjqnChOxat3Tv/FitCa /jk7jplSP0ykYrr NWHokQEFbT2RX7b4RPYlyPpqwsyPUkTRpm2tHk2usnq7i/LVr9/YkmpA4p80iUcUDSryGDU2nsEq9DmuCzbEH JBjJi a3QabKc2JwYOLfq/A2h0O8TILAl00/2wR2Q3c8b40 cnCm2ouRnFn/V RMvpYsntZXJWzcC/Hfsv3BcX55qizkrzLaBynT7hWpEJsYD4UXKquZKaiHV5M6RIBo4/.../CsXhBihATzjolWGHXrBw744JDmzR1hemDP 2AV18vSInnl

http://daemon-tools.downloadable.co/get_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PTK1HBzga5/ZtOM8/zGn4SgumpJLbxv1Y/j2PnG20gAJZz7TRfTjR prgKtrh8yZDR7HpnOtHk20snm8geeF/4yFzj1W5cpv3xZfUGijAiB0ipZhqznxGWmaSq4akZPzPHQNa7MgLhoPIaS0XHh1aoqKNBBhhqDuACc3c8b40 cnUSqouRnFm/V Q8vjJJ3pLGNXnMu F/tnxkkH5tH3jFvzLaB2nT7/.../2zFYvP3bEv2IV29DXMnnl

http://daemon-tools.13-120-120.53cd3f12c0ad7.dablecdn.com/get_file/yjPWHFX_5wJHJLqGJ2ihyQ/1405963554/13/13/1/.../daemon-tools-4.48.1.exe

http://daemon-tools.downloadable.co/get_file/wUia6yjQOMnI2niiRfO4HBAtwV03OziiER7xZdnQvqA872/s5ixgwJgELE31aan3fHm/ykYYazeeEKqtG78lwrtg1s3eDQ b7XahWFT8 3G9gefQrcvT0mlKoZ8i1wwBFCr2Q3s3yNEivSH7WGmLFO0JlZi/KnNYN VxPRNMOaz9RDkmLNzFfxEjj6qnGCIvatOrjbgnBSqwsFnFjqs9Uc/iLt/qMC4AnNy5A 0sgRwLuMCon1O7ZKl/.../V91Wrc24SWvosZGCkW8qYbxRE9thbSphounkFxhrnBK0xdYJ

http://download.dablecdn.com/get_file_for_cdn/13/13/1/.../daemon-tools-4.48.1.exe

http://daemon-tools.downloadable.co/get_file/wUia6yjQOMzI2muzUbjxCgglkkU3PTi1E1v4Y9bB9bpi/269qGt42doMLVXsK7H/.../mQBKOTqGGuqsW78xyas2m5rJUk6D9GzyDkzlvH tgLbbrdPKyDofs55ziVdIRnekGDU2nsEj7G SGjaSr1W2sbzPHQNbLMgeUFTZr38FXB9e8Tcckp30f66D2J6J9mxzOkrCmGks0Sa1Kp D9G3dsi8OjkchoPoD J9lRwR7Y75ilj8ZqJ 1CanA8VPup74AyW4 tTSxj4rJLxCR44vbS527b35AF4 0UrzxdYJ

Remove daemon-tools-4.48.1.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.