home

freefilesync_6.11_windows_setup.exe

FreeFileSync

Open Source Developer, Zenju

The application freefilesync_6.11_windows_setup.exe, “FreeFileSync Setup” by Open Source Developer, Zenju has been detected as a potentially unwanted program by 5 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from app.fosshub.com and multiple other hosts.
Publisher:
Open Source Developer, Zenju  (signed and verified)

Product:
FreeFileSync

Description:
FreeFileSync Setup

Version:
6.11

MD5:
7c59ada9c6bbf7e88c2375b6997c9f31

SHA-1:
7ea82a39323fc3a536eed07fb0b2e9c70b894666

SHA-256:
57c74bdeb840f25e09aee373ca862df1796926ff812f0b931016087e6bf60924

Scanner detections:
5 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
11/23/2024 8:02:12 AM UTC  (today)

Scan engine
Detection
Engine version

AVG
OpenCandy
2015.0.3298

Dr.Web
Adware.OpenCandy.55
9.0.1.0310

ESET NOD32
Win32/OpenCandy (variant)
8.10680

Malwarebytes
PUP.Optional.OpenCandy
v2014.11.06.01

McAfee
Artemis!7C59ADA9C6BB
5600.6954

File size:
11.1 MB (11,617,504 bytes)

Product version:
6.11

Copyright:
Zenju - All Rights Reserved

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\freefilesync_6.11_windows_setup.exe

Digital Signature
Signed by:
Open Source Developer, Zenju

Authority:
Unizeto Technologies S.A.

Valid from:
9/5/2014 12:42:28 PM

Valid to:
9/5/2015 12:42:28 PM

Subject:
E=zenju@gmx.de, CN="Open Source Developer, Zenju", O=Open Source Developer, C=DE

Issuer:
CN=Certum Level III CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL

Serial number:
3402C75B8D745AF02AABEBC7659B40D7

File PE Metadata
Compilation timestamp:
2/24/2012 8:19:59 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
196608:Ge1FqgTub/HWTiRbrKhV6FKkXPBoZS4qf0vM4xYySHdsJwJOGOTl8jBmqVgH3F:fXqgTMHWT8HKhVSFBoZWyS9TQGylufV8

Entry address:
0x39E3

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, D8, 91, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B8, 80, 40, 00, 55, FF, 15, C0, 82, 40, 00, 6A, 08, A3, B8, 2E, 47, 00, E8, 37, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, D0, 2D, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 1C, 93, 40, 00, FF, 15, 84, 81, 40, 00, 68, 04, 93, 40, 00, 68, C0, AD, 46, 00, E8, 19, 27, 00, 00, FF, 15, B4, 80, 40, 00, 50, BF, A0, 30, 4C, 00, 57, E8, 07, 27, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
28 KB (28,672 bytes)

The file freefilesync_6.11_windows_setup.exe has been seen being distributed by the following 23 URLs.

http://app.fosshub.com/download/.../3ce93cec997cd54ea8276082c88affce

http://tcpdiag.dl.sourceforge.net/project/freefilesync/FreeFileSync/.../FreeFileSync_6.11_Windows_Setup.exe

http://downloads.sourceforge.net/project/freefilesync/FreeFileSync/.../FreeFileSync_6.11_Windows_Setup.exe

http://mirror13.fosshub.com/.../FreeFileSync_6.11_Win_Setup.exe

http://app.fosshub.com/download/.../05dec8e150992eecde1c149451a1f05e

http://app.fosshub.com/download/.../88a374801f86a24c4ccd0724662b8c24

http://app.fosshub.com/download/.../6b02cab8001bb1ff534d1e229ef5696d

http://mirror4.fosshub.com/.../FreeFileSync_6.11_Win_Setup.exe

http://app.fosshub.com/download/.../6c0456da7a7ff3feb001fcb8d9ce22b7

http://mirror6.fosshub.com/.../FreeFileSync_6.11_Win_Setup.exe

http://app.fosshub.com/download/.../93f93497c168cc61ec2e6f16fa7f2104

http://mirror8.fosshub.com/.../FreeFileSync_6.11_Win_Setup.exe

http://app.fosshub.com/download/.../55d6a8e1a252694f74aa71a4242fe63f

http://app.fosshub.com/download/.../f2d35cdcee5f099f481351d74aec13a5

http://app.fosshub.com/download/.../bf49088ea6a175c9de7357942133ac4d

http://app.fosshub.com/download/.../0193c29ef333ecce50cc7eb7f28712ce

http://mirror12.fosshub.com/.../FreeFileSync_6.11_Win_Setup.exe

http://app.fosshub.com/download/.../cd644da9e244024f6453f08084149d3b

http://app.fosshub.com/download/.../7869060ddab101740321e1249d916854

http://app.fosshub.com/download/.../e22f9f32e786d98bf8b9f783f72341f3

http://app.fosshub.com/download/.../25c7fc35365fa8942bfaee397d5b0f32

http://app.fosshub.com/download/.../6f5ae7f7a429aa969f372108f6a07475

http://app.fosshub.com/download/.../333252c6dc9821b66a909bf0b1e591f3

Remove freefilesync_6.11_windows_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.