home

freefilesync_7.8_windows_setup.exe

FreeFileSync

Open Source Developer, Zenju (Florian BAUER)

The application freefilesync_7.8_windows_setup.exe, “FreeFileSync Setup” by Open Source Developer, Zenju (Florian BAUER) has been detected as a potentially unwanted program by 13 anti-malware scanners. This is a setup and installation application and has been known to bundle potentially unwanted software. This file is typically installed with the program Toolwiz Time Freeze 2016 by ToolWiz. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars.
Publisher:
www.FreeFileSync.org  (signed by Open Source Developer, Zenju (Florian BAUER))

Product:
FreeFileSync

Description:
FreeFileSync Setup

Version:
7.8

MD5:
ed63b56fdd78a0e2efab84e4cb218136

SHA-1:
12dbd4e6e7901ffb738a3c12b27278b5ed92c68e

SHA-256:
dbf2189bc56c5132b771021dfe0c097bd65b94def937a1b5e3876ac9c1da58c8

Scanner detections:
13 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
12/26/2024 4:34:21 PM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Adware.OpenCandy.182
9.0.1.02

ESET NOD32
Win32/OpenCandy.A potentially unsafe (variant)
10.12804

Fortinet FortiGate
Riskware/OpenCandy
1/2/2016

G Data
Win32.Application.OpenCandy
16.1.25

K7 AntiVirus
Unwanted-Program
13.212.18299

Malwarebytes
PUP.Optional.OpenCandy
v2016.01.02.02

McAfee
Artemis!D1AA57C77275
5600.6533

Qihoo 360 Security
HEUR/QVM20.1.Malware.Gen
1.0.0.1077

Reason Heuristics
PUP.OpenCandy.Installer (L)
16.1.2.2

Rising Antivirus
PE:Malware.RDM.21!5.1B [F]
23.00.65.151231

Trend Micro House Call
ADW_OPENCANDY
7.2.2

Trend Micro
ADW_OPENCANDY
10.465.02

VIPRE Antivirus
OpenCandy (PUA) (not malicious)
46212

File size:
10.7 MB (11,269,040 bytes)

Product version:
7.8

Copyright:
Zenju - All Rights Reserved

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\freefilesync_7.8_windows_setup.exe

Digital Signature
Signed by:
Open Source Developer, Zenju (Florian BAUER)

Authority:
Unizeto Technologies S.A.

Valid from:
8/11/2015 7:43:03 AM

Valid to:
8/10/2016 7:43:03 AM

Subject:
E=zenju@gmx.de, CN="Open Source Developer, Zenju (Florian BAUER)", O=Open Source Developer, C=DE

Issuer:
CN=Certum Level III CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL

Serial number:
1A92CE3E55B64BACCE47710EB787079F

File PE Metadata
Compilation timestamp:
12/27/2015 1:26:01 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
196608:XCQcNgoogvEg4aT/r7sLUYY5OMMe1Ya7t7/H5oYkH1sqsOUSU6kynIJ:XCBXZXtTj7s4YYRaa7dH6H1sTOQ

Entry address:
0x33B6

Entry point:
81, EC, D4, 02, 00, 00, 55, 56, 6A, 20, 33, ED, 5E, 89, 6C, 24, 0C, 68, 01, 80, 00, 00, C7, 44, 24, 0C, 30, A2, 40, 00, 89, 6C, 24, 18, FF, 15, B4, 80, 40, 00, FF, 15, B0, 80, 40, 00, 66, 3D, 06, 00, 74, 11, 55, E8, 69, 31, 00, 00, 3B, C5, 74, 07, 68, 00, 0C, 00, 00, FF, D0, 53, 57, 68, B0, A3, 40, 00, E8, E6, 30, 00, 00, 68, A8, A3, 40, 00, E8, DC, 30, 00, 00, 68, 9C, A3, 40, 00, E8, D2, 30, 00, 00, 6A, 09, E8, 37, 31, 00, 00, 6A, 07, E8, 30, 31, 00, 00, A3, 64, A2, 42, 00, FF, 15, 44, 80, 40, 00, 55, FF...
 
[+]

Entropy:
7.9989  (probably packed)

Code size:
24.5 KB (25,088 bytes)

The file freefilesync_7.8_windows_setup.exe has been discovered within the following program.

Toolwiz Time Freeze 2016  by ToolWiz
www.Toolwiz.com
About 4% of users remove it
 
Powered by Should I Remove It?

The file freefilesync_7.8_windows_setup.exe has been seen being distributed by the following 7 URLs.

http://filehippo.com/download/file/.../

http://lb.cdn.m6web.fr/d/c/a/14dd9491cc029a63d62c1292ea6b1b6b/56b61f1d/soft/.../freefilesync_7-8_fr_313032.exe

https://doc-14-84-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/ctkhfqk7c4741cjs65c6tjc9nr9mbj62/1452304800000/00596995306655459898/.../0B1aq3hyKWR7yVEdjMW4zd1ltbDQ?e=download

http://dl.cdn.chip.de/downloads/.../FreeFileSync_7.8_Windows_Setup.exe

http://winfuture-mobi.digidip.net/visit?url=http://dlgbit.winfuture.de/18f53e7e389d4a56fd98c766afa30e64/568a369a/software/.../FreeFileSync_7.8_Windows_Setup.exe

http://www.freefilesync.org/download2/.../FreeFileSync_7.8_Windows_Setup.exe

https://doc-14-84-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/nmag7er2gc37it7hrmilibjnjluqscv7/1452348000000/00596995306655459898/.../0B1aq3hyKWR7yVEdjMW4zd1ltbDQ?e=download

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to a2ss35.a2hosting.com  (66.198.240.22:80)

Remove freefilesync_7.8_windows_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.