» freeaudioeditor.exe
Overview
Analysis
File Details
Downloads (7)

freeaudioeditor.exe

Free Audio Editor 2015

TechEvolve GMBH

The application freeaudioeditor.exe, “Free Audio Editor 2015 Setup ” by TechEvolve GMBH has been detected as a potentially unwanted program by 9 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from cdn.goodfolderscentres.com and multiple other hosts.

File name:

freeaudioeditor.exe

Publisher:

Product:

Free Audio Editor 2015

Description:

Free Audio Editor 2015 Setup

MD5:

ff3019ddf0fdacb55ff2e76f5059abb4

SHA-1:

5441b4bb94b70268ec21ce3d66ab7c837519fcea

SHA-256:

228da16cc6b94f34a2b9da6009a637dd79d7f5ef7fd8f4a80ae08e24f4e92e51

Scanner detections:

9 / 68

Status:

Potentially unwanted

Explanation:

Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:

12/27/2024 9:25:43 PM UTC (today)

Scan engine

Detection

Engine version

Bkav FE

W32.HfsAdware

1.3.0.6979

Dr.Web

Trojan.InstallCore.280

9.0.1.0187

ESET NOD32

Win32/OpenCandy.C potentially unsafe (variant)

9.11289

Fortinet FortiGate

Riskware/OpenCandy

7/6/2015

McAfee

Artemis!5CF2169E6DD0

5600.6712

Norman

InstallCore.CERT

11.20150706

Reason Heuristics

Win32.Generic.TechEvolveGMBH.Installer.Meta

15.7.6.14

Trend Micro House Call

Suspicious_GEN.F47V0306

7.2.187

VIPRE Antivirus

InstallCore

41476

File size:

15.4 MB (16,128,384 bytes)

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\freeaudioeditor.exe

Digital Signature

Signed by:

TechEvolve GMBH

Authority:

VeriSign, Inc.

Valid from:

12/16/2012 1:00:00 AM

Valid to:

12/17/2015 12:59:59 AM

Subject:

CN=TechEvolve GMBH, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=TechEvolve GMBH, L=Beijing, S=Beijing, C=CN

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

50FF3D5C361AE9F52E4B0A3CF576C6EE

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

393216:U0lF+okILRs90QCCFPZSu/Awua1gr8y1zArL2a:UWFxkILRsmQCCLJowSrTArL

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Entropy:

7.9998

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file freeaudioeditor.exe has been seen being distributed by the following 7 URLs.

http://cdn.goodfolderscentres.com/c?x=uDi10OJphkMgkhpnABj48R3jM5AVGmgHgVWILxNb8/g=&c=zVRKnXKTXDbrDn soTEUijkzeq5UDWKJwQgaK/mqZ63xKmCADXwgAVNqW2TRslvYVIBRUzyJ5Oybcx8A/ax5UA==&downloadAs=FreeAudioEditor.exe&fallback_url=http://www.tsinginc.com/free-audio-editor.com/.../FreeAudioEditor_IS.exe

http://www.free-audio-editor.com/FreeAudioEditor.exe

http://www.taggiftflash.com/KFX2mAXNtots0TPLUiDgevOFAeFzDwDy5mTXBajSuUumfwdoPmQDpUEBTteO4wYX5vOsB2aZu2o QQk1w8y4Z2CbqN kRUPnEubXxfGT7NOQxbHOwpcEIAHlefl9_jRbMDUTREoabHk1H26eXrYvZttmUNq Q7QDoIwvK6a8iXJSPHkFYun4r3hJLiI6U1eBP jsZej0wziAuUZaNE28qz2e 6hEhoSgixOt1xhR3qmfrbk99Dr1tyH7s2cFTRHtkgG PnK91pMSqMk1ekKg256qQ_7NY3tmi1VGppHipi5DJtx6PgO72DpGW0sxoaml8V9NkUn7pllmxrr32GdhhtMJUzSVClmDm8XMUwUpuCAVC4anJcXO3GZ4B9WeA5iBvzc8FHiYwglJ5TojBe5Sa8HZgrIklXCjH2zgBMAQwzJN0uPhrRl0R lHTLZ6IdRGhIWy_khCYBx4Ro2NH5IoXI X70qoJQ==-G1UAAATEbTH9D_nhB7N0gywcREGLnrKQu6FQ2revA dYMVSH6MP1jXF8h93ZNTcBj0yrtKfztXj8WF5wLKEdrSsf

http://cdn.broadstoragecounter.com/c?x=PU5PNARlYBrUVu/I1d5VY5ghi3JR05 4Sey4XrL38J0=&c=u45I oJt/KgUiBCU80RZmNEX8lpyvsvGce5gino0wjFiDgxJTFVSXcz/kdwnBNw8uiwz9EZ6biJEUpUwEvqvvcBqzEnku4/8es7pL3D7mgMGE8Y9DT7y2omouE7NuMRJ&fallback_url=http://www.downloadonic.com/free-audio-editor.com/.../FreeAudioEditor_IS.exe&downloadAs=FreeAudioEditor.exe

http://tsinginc.com/free-audio-editor.com/.../FreeAudioEditor_IS.exe

http://www.bitssigncurrent.com/WVl6OTRQVWxVVUd4UVltMVpVM2swVEhSS1NrRkhaemh4U1ZwMmNYRjRWM3BNVUZWVlIwRmFaM1pMVVhWcFR6QWxNMFFtWXoxd2JrczRUakp0T0dadVQyWjNkV0ZoTkhSVmNtNUdialZMV0dZeU1VcEtNM3B5VG1abVkxcGxaVWh1TjFjbE1rSTJVbGQ1WmxCVFNYTkVUalpWUzJkckpUSkdVbXB4Y25SNmRFTmlVRnB0ZG5aNFNTVXlRa2h6WWpaVU4xSlNUbWxQZEZaS00zZEdTbk52UkhKSlJtdHpaRlpqUTNVbE1rWjRSa0puTkdzbE1rSklXRmw0TmpGbE5XWjNNM05RY2taamFubGpVRmhoT1dzM1ZqSnNRbnAzSlRORUpUTkVKbVU5TUNaa2IzZHViRzloWkVGelBVWnlaV1ZCZFdScGIwVmthWFJ2Y2k1bGVHVW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMEVsTWtZbE1rWjNkM2N1Wkc5M2JteHZZV1J2Ym1sakxtTnZiU1V5Um1aeVpXVXRZWFZrYVc4dFpXUnBkRzl5TG1OdmJTVXlSbVpwYkdWelpHOTNibXh2WVdRbE1rWkdjbVZsUVhWa2FXOUZaR2wwYjNKZlNWTXVaWGhs

http://gsf-cf.softonic.com/9a4/c78/.../FreeAudioEditor.exe

Remove freeaudioeditor.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.