home

downloadxpro.exe

DownloadX ActiveX Download Control 1.6

Software Development

The application downloadxpro.exe, “DownloadX ActiveX Download Control 1.6 Setup ” by Software Development has been detected as a potentially unwanted program by 4 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
Publisher:
DownloadXCtrl.com   (signed by Software Development)

Product:
DownloadX ActiveX Download Control 1.6

Description:
DownloadX ActiveX Download Control 1.6 Setup

Version:
1.6.8.0

MD5:
c6f23941b59e9e7aac2b34738cb54a5b

SHA-1:
cf9a3b471c1df63f3727b06b82a9a6600ef34a68

SHA-256:
13c0cb5bb600d2ee54921d459c7ba38680cb87b5f52425e842c2f66aa15f24e0

Scanner detections:
4 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
11/24/2024 6:54:18 AM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/OpenCandy (variant)
8.9827

Reason Heuristics
(M)
16.7.1.17

File size:
12 MB (12,618,728 bytes)

Product version:
1.6.8.0

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Digital Signature
Signed by:
Software Development

Authority:
Unizeto Technologies S.A.

Valid from:
11/25/2013 8:44:12 PM

Valid to:
11/25/2014 8:44:12 PM

Subject:
E=info@downloadxctrl.com, CN=DownloadXCtrl.com, OU=Software Development, O=Software Development, C=HR

Issuer:
CN=Certum Code Signing CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL

Serial number:
7EB2C518630B09F497BC4F2C845F248D

File PE Metadata
Compilation timestamp:
6/20/1992 5:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
196608:Qc/u6CLwS+ae3+5Q5b3PazHnrEN2PXK+vsnyxVmApuFHo37EiGqYonn76XFFJ75K:9upofbic2ZBVmWu9yPUoncfrsT

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9998

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file downloadxpro.exe has been seen being distributed by the following 16 URLs.

http://gsf-cf.softonic.com/cf9/a3b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69680154&instance=softonic_en&type=PROGRAM&Expires=1454303053&Signature=W~oraMw52xUXBRmnFWDYFzgYo2LUhnNqU2DKC7yU64w5lcaOdU5QDujWqdvWb2-rDPTAli3vtOj~BaK0PEvlhf2188bgTGtPIkFeMFVVi7fYrdaqcMI-dZu0RlWKtdSw2kseZXHpsU7ewUdWdm7r9it9GwmEVghggQwoyriQGSM_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=DownloadXPro.exe

http://gsf-cf.softonic.com/cf9/a3b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69680154&instance=softonic_en&type=PROGRAM&Expires=1447053172&Signature=Omc3fD4n57mlQvsGsNklq~g1VM3b0fYCiJ9vwrlWIb87eubvxTLvOACtYqXFVMZqlv~S3s6NbD~IcSruajc~0XmR8DUfahodg-Ue9XKCf2f4nIYiqWN8r5HdRtb90nfbylXy66lhzKhG52CJvWpBakcn-dSBo70zjkZwCI5pARg_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=DownloadXPro.exe

http://gsf-cf.softonic.com/cf9/a3b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69680154&instance=softonic_en&type=PROGRAM&Expires=1464704718&Signature=CqH-vu3lm8SEzOfoBH5nWXUvj2cu~mTm-IU95bvJgxte7R0evS7CJqRfbqG61q2ciA4Mwwt178OoixP6aO-ds1sWoTho7FNEcDgVP36SeM4mHCuF-aQJGJ2RV~T3nJvPWd0a5ZfM5szhP18TmSJ44f4r5oBzkHTcn9HxPwdUHfw_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=DownloadXPro.exe

http://gsf-cf.softonic.com/cf9/a3b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69680154&instance=softonic_en&type=PROGRAM&Expires=1464553523&Signature=KKpU74BGdZSAFxMHqu41aPG-EaREsmn-ZoDI6lISoEgD4kdWG9iMJGJfX6tpMrv8xGJC-AScBI7-k0dB5fFKoy71UtiLsIqh-Y0SYN8vv6vBjnae8oeh9xeZ1dDiB2M5O788zQOg6pSR-L8Q7zuWwuXX2hEuxX6gdlJ~HJrirdw_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=DownloadXPro.exe

http://gsf-cf.softonic.com/cf9/a3b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69680154&instance=softonic_en&type=PROGRAM&Expires=1462904917&Signature=iLSqxZa64m9zcHIzXRUKj~AoJzr7KdcwhKhIY-0zz8YT-kiVay9v8~FGXHmkhSJLdW81YYDQ6-7doahXLDdkTuRQCbkuBuKyDxKwtWm8KdhWdkhJfGtYDAnwb~yxlvGZdJKVA0sN~oewOTHK6ipM-~cD7apR~29Mm68vLBloCD4_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=DownloadXPro.exe

http://gsf-cf.softonic.com/cf9/a3b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69680154&instance=softonic_en&type=PROGRAM&Expires=1450550030&Signature=IoxVRTqfY92MohKjrrHxioAI6afA9QkwnKN2N6bqKG5tzKaYGtf-6BxaqPXYv346TsDdpahtJSijTaoGWidArwKx2K-PMg8QdWuAdNNxrJt3ZqLlwg71rieYvFuBePa3JeG3VMC-ogDzOsNDif0KmjXN2cdINiv8owuvTTPM1Ag_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=DownloadXPro.exe

http://gsf-cf.softonic.com/cf9/a3b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69680154&instance=softonic_en&type=PROGRAM&Expires=1463577501&Signature=CiXkNsEIvrhwSq5PAt~aN4PXPGRWu8MMXwYKIQ26aUahzn-PdLcKoyqKi8SLK4Ew1XnyHRaDp3coOFapcgLrlULhFQLFvHzfKcUdHr-jTzRffqSWXOeXI636Upc7eMcKi0tTLkzUQoxYU3-9xoxDxTjKK4blIqAq9BGHRGG~BBw_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=DownloadXPro.exe

http://gsf-cf.softonic.com/cf9/a3b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69680154&instance=softonic_en&type=PROGRAM&Expires=1462151846&Signature=DemmEe8TKCrUK7bahi7pGECdHQPAhzPboG7tRV6hl1ftqgwRXend1fB5pEDz3IIhhrNhe767-PClktkoMFFRZR6Dk5jAv5Okdr8B9PoKw90PvAgjtoxjz3xRPBHn3oSfe~3R1SAZ4-gwUhoa6cbMhJ9b0gSQsXJYBKGoXQnR02s_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=DownloadXPro.exe

http://gsf-cf.softonic.com/cf9/a3b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69680154&instance=softonic_en&type=PROGRAM&Expires=1450382311&Signature=Mhs-RP1PvYxo~8pMULeFXsfh5vzTs61HnzH7Da-HUZd9hWa1cpxBkT5DmlatQC7rKIbTNw6u5i7NspjaSoIDJCkHdcHMvPMIkcfB7libpXWStxhMfV4t6GNLv2n3zqkkISvwNIQK~SqJ3EqjH5teMVcGkGQfz2xQWuah2fokG4w_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=DownloadXPro.exe

http://files.downloadnow.com/s/software/13/74/33/.../DownloadXPro.exe

http://www.tucows.com/download/windows/.../DownloadXPro.exe

http://gsf-cf.softonic.com/cf9/a3b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69680154&instance=softonic_en&type=PROGRAM&Expires=1457322744&Signature=Qa4eCbcVmthAmFuGMlSOYfUrnttl9w5mThB47LZjSiaT1tObAv-qyD7rGPPmYBwJyoVi4~F9BYgDCE8kk2Qto2K3zSlY7WJWpxKz6yYk-rahTrKs2HESXneJ6jVxKXihSt8re-chbPdRUfGqhmuWHNcYgNxTJrfEFFq6PhcKhmY_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=DownloadXPro.exe

http://gsf-cf.softonic.com/cf9/a3b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69680154&instance=softonic_en&type=PROGRAM&Expires=1456388218&Signature=O0CCCVI8OgYQkDfsh7If4AAe99e4US00NWTpvPieuLjrEqxoP3iLU8fdxr9oI3eW6-3j0vnCfWYECc8MEC0nouD0eealmKIYJvqLzVvrnZgoTzAfqaXeCJIdstinsxqJ~MKDt-YimwNrD5wBJqXpQBhBu~kX0W1GPK91WkMuQEU_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=DownloadXPro.exe

http://www.lo4d.com/get-file/downloadx-activex-download-control/.../

http://gsf-cf.softonic.com/cf9/a3b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69680154&instance=softonic_en&type=PROGRAM&Expires=1452709505&Signature=hlHPRew-KQoOGg5XJwPWWZ7FJAJ2KivjhlxUTUJTiglJSXwC8ztVYsXFXoHK41dBZeQduPUA31z8HKOjTqa9igaFxgqzdiOWQesuJkL4JmNtlqv9Jz~7ANyz-BA2dEdrzckb18aZBa8JOjYUawQ9ndsZeMqPDGjyGz5AuX40RSc_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=DownloadXPro.exe

http://gsf-cf.softonic.com/cf9/a3b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69680154&instance=softonic_en&type=PROGRAM&Expires=1454745168&Signature=hMkZDvPuDdzpIWnFiSsIw72ELWLPqjSSANzxcbjNPXIDKRX1jBHy9ZBB95eYQdkmPYxM1RlexsMYoyQSVYBmLqX-Ciyr-yryn~KeblbJbtQZsEiZfG4-t9Y7dbC7nixS8-3LdBkkLNfmGAo9c0pgXcqdktr1wmugQpsu00dX7Fk_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=DownloadXPro.exe

Remove downloadxpro.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.