home

freeocrtoword.exe

Kakalume

Huaxinwantong Beijing Technology Ltd

The application freeocrtoword.exe, “Kakalume Setup ” by Huaxinwantong Beijing Technology has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.taggiftflash.com and multiple other hosts.
Publisher:
Huaxinwantong Beijing Technology Ltd  (signed and verified)

Product:
Kakalume

Description:
Kakalume Setup

MD5:
c4b754c808b6eedf29d2c2f021c7ce7e

SHA-1:
5ceeba1118ff370c1d0e29b6ab86ff9a77a04e39

SHA-256:
a8147d2bb06d33b22aba31043711821fa0c411126e31725fbd114e95dbd41e9e

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/6/2024 9:23:15 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Huaxinwa.Installer.Meta (M)
16.4.25.20

File size:
920.8 KB (942,856 bytes)

Product version:
5.4

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\freeocrtoword.exe

Digital Signature
Signed by:
Huaxinwantong Beijing Technology Ltd

Authority:
COMODO CA Limited

Valid from:
3/24/2016 7:00:00 AM

Valid to:
3/25/2017 6:59:59 AM

Subject:
CN=Huaxinwantong Beijing Technology Ltd, O=Huaxinwantong Beijing Technology Ltd, STREET="Dong Balizhuang 54, Building 2", L=BeiJing, S=BeiJing, PostalCode=100025, C=CN

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00C31292C6449E082B3FBF99E310243E2E

File PE Metadata
Compilation timestamp:
6/20/1992 5:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:O6BlAcWnMHpp1wd/N9DEtfnjmXDkLqBCihLCtF7CRPe6rcVj:O6fSnM3GFNAMrMihLGF7CRNrch

Entry address:
0xAA98

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 2E, 86, FF, FF, E8, 35, 98, FF, FF, E8, 9C, 9B, FF, FF, E8, B7, 9F, FF, FF, E8, 56, BF, FF, FF, E8, ED, E8, FF, FF, E8, 54, EA, FF, FF, 33, C0, 55, 68, 69, B1, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 32, B1, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, D0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, C2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, 24, 93, FF, FF, 8D, 55, F0, 33, C0, E8, 66, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9383

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
40.5 KB (41,472 bytes)

The file freeocrtoword.exe has been seen being distributed by the following 20 URLs.

http://www.taggiftflash.com/c?x=VGbGw6ocYec226o2oIwBvqALL73GXEM9AHXngob2dX4=&c=1HEQH 9Xm2FLRZNfMwOFo6gf5SbcQHt1cSKrVyP/pBedMFugFY0dU9RquLo939wARIlqqGCjRciOLisfvYtC05 ju3K3oGlVXVfoDv e6qOS6D4Caf35gf3iYXrNZeFYiy2l43N99KHE1enV1EC4Ftc1BfIxmBLIYeFjG Ggh0EvjWR2IyE/5377uPLaJ3qj&e=0&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.taggiftflash.com/c?x=2zqoItqd/x5AABnD2UTrqD5ja1jv3aVgxdJW6ddn5s8=&c=oVVy5B2ULwexv9l1KB3VCoDxdYyKUtZ5UHMHLteand/VvAFCDrRyFNjdxsB1nx48d13j63EBZdxoPnVvriVf6k3ZiEQwMpzsDECT9RD0wpHHHVa K2MCKH/O/YiDrHBIZB4tM1wa 5tzSBGqs9ubBqQr1J8ROeyhiY6cmJt/FCI=&e=0&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.taggiftflash.com/c?x=VG2eb5pxzieNLDY 03pfBILnuKrNQHHimsWgdzd6baY=&c=hLcDDJ6BRAolTYEouZ 2sFsmNjhfq1LyF3zSkeK8uE ng2nS0iJmTP6PLcq9xtuVRdn0fLcTheeQlTXuASOucgFvbQGrwgm5l2H29H04D0TV1SMI Yq4N2mpBOpsl9eFMYXny7i7c7oI0GxGsvA 6S/oj6s/WCUz2D/0ctcBOr0=&e=0&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.taggiftflash.com/WVl6OTRQV3RNZEhNNU9ITmtNbEZoTlhFeloyZEhlbXN4WjBSS1dVdG5XR28yYVVGQ2VqTTNTM0pSU2s1ck5XOGxNMFFtWXoxdWVEUTVOU1V5Umt4Q2VrcExaRU5oU2twRlpYTlNURVZOVGpWMFJXZ3haU1V5Umt0YVNGSnNOM1pvTUZOM0pUSkdiMlZyTjBOVWJuRlZiRFZaWlZFeWRtUnpORFpNYkhVMlRFNUhUMGcyZGt3MGEycDVjV2RZSlRKR1NXMUNlRGRZVlVsUFpXNHpOVEV4YldSVU5qUTVUbWhqWmtkblNtbEVTa28wYlRaNmJGTmxTa2RRUTJGemFYUnBkV2hvWlhOR2VVNVdlRTR5WTA0bE1rSjRXRE5uSlRORUpUTkVKbVU5TUNaa2IzZHViRzloWkVGelBVWnlaV1ZQUTFKMGIxZHZjbVF1WlhobEptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTkJKVEpHSlRKR2QzZDNMbVJ2ZDI1c2IyRmtiMjVwWXk1amIyMGxNa1p2WTNKMGIzZHZjbVF1WTI5dEpUSkdabWxzWlhOa2IzZHViRzloWkNVeVJrWnlaV1ZQUTFKMGIxZHZjbVJmU1ZNdVpYaGw=

http://www.taggiftflash.com/c?x=GeN1tkxDff6d xKJd2ATrWNtr8hJu9VCXSG84L8gXMc=&c=p SxZOMicMlkX0wFZJ js9CqhfTraKchtHp9hb7xFCX2zqfS6DutGVQTHqfDklxO/2Lz8g/5aA7VCb0L9nBpjNC1at qWVT5lC6uDG sOsTiX KY98CpXsEb/9XyiKuG5yr2CC1PlID/F2FOUxVr 1XhKWqxk9jRVS5LKW1h/n8=&e=0&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.taggiftflash.com/c?x=NZ1GwlumdgK4QwKc WAGBvIXHbqtcTk0pgN91 s2svE=&c=qvbZXluuNqej6pN76KWFtkwrMkouvLO4S8uK8LIAo2ke6xGPFPdsq0VtLLhNGMz4n6p2vSLqzc1hYHMybWSSwLgC3l0VKZuQONRE0tIwKBuycizjkm94HGWdE1oN3tR1WXeQnLAVakaz89Q094AEHyxic8OO4TzNz85TV3F96yo=&e=0&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.taggiftflash.com/c?x=EmYpjmsR2ZKa6pz03uRckXi8DHWSMbzYFYNIvG1TdPI=&c=ukRHXPEVt1Gl2fLbn0E0NJyU9bUFC7EpIeTSdgD4trPwH51onewZEuXgoCKgPIdGg GTBvIo0CokHm CkvIrPUxp8UHDuqbgWg9an49onggUOEEiVSaSRSCKAdilu97CnvqJ2fuODDJOhC1P20dZ7RvQkm WPr1G56pc46IZGNY=&e=0&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.taggiftflash.com/c?x=uFxLKT KJ8GSH3Wnvon8ftw1eRl45fCpZm7RiwVA vk=&c=zqhCMN730sWmddKcDuuGPWr8sRlYfgzu6YKbVdGkIBqoBRVBqsagAf2pnUS01TfvyX474jnZeiY9idVCV94mnXZb23c2U86 Vlqy HAfSzX0qV8m419nzNYG/TJhtnjT9JkuAZQZWK7J1shf1vLfROpabnVLpuy6jdzYoYSlhU0=&e=0&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.taggiftflash.com/c?x=v504QcGgRX0ZyoHbwHyWwuhj3URhZUxRW98t9LUJpqk=&c=LCBbZYXNfoHF2daZYqCTjVVqRJ6Uq4FzN993YAcsT6Qrl5HdWqZQOiOFSU IQVqMWV8zJmAKk3vIqgs2PWK49KFZOkDHKJ47EMJRZbxK2Ug E3vm eDLDwsIzFqHA1s1q6pqgBHqOFQ34hlR2LH9yB84IsOfeDlPlNeD1GpJvZ8buvD7o3boJj0ZLEQgjW8a&e=0&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.taggiftflash.com/c?x=7viFZa40oIJtY2yZjuN6kbIDfW2/eNKS9Gqzm5Jw9co=&c=HRmU/xht3Cx7sWCzmZ0tnN1yLf7OTkh5K MWlpsUhoD5Oacc1vOzoksBtAQMnmGBbkXlQd8GHbVXgVgpmXRH7SoOJEraMRpjhyjl6Q9kir17r9QqW0/JBFUIErle4V0o3JM37Q7ie96Fc2DAK56rryUYHKMVKj58RfwQus2/U8=&e=0&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.centralvaultapps.com/WVl6OTRQVTk2T1hoVFpGTk1WR2hzV1dzMVQxbElXVTkxTkRoTFEyRjFjbGgzVVNVeVJuUXlkMGhGYWxadVJEaG1PQ1V6UkNaalBWUnhSbFV3YjFoSFkyNXVUVFFsTWtJeEpUSkNiM0UyVjFCaFkwTnhKVEpHWTNWalRWaFRSR3hFYXpGR1FXOU5hazVWTlZGYVNtdGlNMUJtUVdKSloxTnBPRkJ6TlZCU1psQTBOMEYyT0ZKTlpVOGxNa0pSYjJGRVRpVXlRbWN4WkUxTGVrMUlaamREZGtkVVdEWlJRMEl3TkVKSmRrZFBNbUV4TVdkWVptNVJNRE54ZG5CblRsZGFVblZaT0V3NWNVTnlTSFYzYjJSUmJuTm1RVzBsTWtKc1p5VXpSQ1V6UkNabFBUQW1aRzkzYm14dllXUkJjejFHY21WbFQwTlNkRzlYYjNKa0xtVjRaU1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6UVNVeVJpVXlSbmQzZHk1a2IzZHViRzloWkc5dWFXTXVZMjl0SlRKR2IyTnlkRzkzYjNKa0xtTnZiU1V5Um1acGJHVnpaRzkzYm14dllXUWxNa1pHY21WbFQwTlNkRzlYYjNKa1gwbFRMbVY0WlE9PQ==

http://www.taggiftflash.com/c?x=tJLpY7y11KOVJbZdMTUTPczbIa/WSRyYjPOhNYaFRDk=&c=hmjdgjV5RF18TRXIH35MYjMZ9AWwVQ79Z6vyrItMpTDEaZ6gLgPn0sOisPf29DHcAOUdEksslqxGD etZbK2HTgsQZhBVa9JXi nSfoWyReUVMrYCi /IDRA57YT4O/aljOWglGM9xDZQtF8wOSwpmlfgWaJW9Ld960jJBxUqOTs8aZzQCLEmV06IXQ5droL&e=0&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.taggiftflash.com/c?x=cG9WA86UtT74JUHLvRlACCfyJu0S PMcWI4xuB2tPEI=&c=YJSemyfI0NsWwVae91jsbn5nBDo G3dvs6uSjHlnfzRtam09/Vfi7FccXHM hQtsBTohd96KGQ PEME4Jqljf27zRIEjgt7bAA9xCnioVGth1TCQHexM RTn gaKNBIM7W1ZskVsAebVYLrOO4MWgvtHDzOneZvRyz7WgbI32qdIVVRsk4v9zRirEkdlqhwC&e=0&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.taggiftflash.com/c?x=BAQnAEGvJRa/7WVmTZO9DwRAswmThuOx4u0E0CVuel0=&c=IJYp9x6qo02pO2RNSFo60cGrhB0KhoZX8lo Pv5DtAcpCYqoaCwu3jJHGQOp BxxDYcrZM5hg9hnWCfnmJGRsPSxm0GT9jnYm3TOc5GZ8xqljlCRUDUbk0O5LgIpdUlJ9MQsRNb9CxEqusaoEgvP1d Hd9lVUnFj5lk8/LGXto=&e=0&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.taggiftflash.com/WVl6OTRQVm9sTWtaYVVtSjZUMnd3SlRKQ2FEVlJZVTFhUWxkVU9GZ3lSRGhLTTJRbE1rWlpjVTFJYkhOeGJFaGpSV1JpYXpnbE0wUW1ZejExVUNVeVJsTkhNRGhZTTFNbE1rWkVNbmREVGs1cldrWlNlRFZTSlRKQ09XdEpNbFJwVEVOUWJsRjVXbEo0Vm14TVZVRk9aRTlWVldvbE1rSTBVSEZtU3psa2RsTk9TVWd6TVdGRWVHTkVaaVV5UWtaMVZsbGlkMVZPVUhKQ0pUSkNRMDkyYTFwdVVtdDJTVFZXVUdoSlNUQndjM040YW1VeWRGQk5RbU4zVFVreVQyRnpjbFF3T0dab1IzVnBiVmxMYm1sa2NrRm9NeVV5UWxWNlJFbHJOVmxSVVNVelJDVXpSQ1psUFRBbVpHOTNibXh2WVdSQmN6MUdjbVZsVDBOU2RHOVhiM0prTG1WNFpTWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpRU1V5UmlVeVJuZDNkeTVrYjNkdWJHOWhaRzl1YVdNdVkyOXRKVEpHYjJOeWRHOTNiM0prTG1OdmJTVXlSbVpwYkdWelpHOTNibXh2WVdRbE1rWkdjbVZsVDBOU2RHOVhiM0prWDBsVExtVjRaUT09

http://www.taggiftflash.com/c?x=g1UM6AKFqQg9IcSY/BtNQs9Z4x4MkdatDgaLLHaXVpc=&c=OoW6BQgbLx/HUG4Ve4El0eKOAJ9p9e6ulX9lvH1lRzUTsip7RYyOu9HUw83jrqq/I4XnI3rq/OM3DIhEoAlNbpWb0Ih34eyAIiJcdkXeDvW86pqTQp4gW24BUxFQg5KTCrMZJ9YYjPTGoLxLgkmhWdDG6hUeNeaIYQxC3kq3UgyqB907b7GdgzpV1i0oN2Ss&e=0&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.taggiftflash.com/WVl6OTRQVFkzYkRKbFZubFZXV2RYUTFsUFRWWnZUbkZUWkhFMk1YZ2xNa0pNVERJbE1rSmpiSFZuV1RaVVdVdE1kR3N3SlRORUptTTlkMVZYZUZocWQzZzRUVFZ3VUhweFZtNDJSVkpPWVdzNGRGTlhkeklsTWtabVlXVjJhbXcxYUVOb1NHdHNhMU4xZUVZbE1rWnVNVWxaUzNCalVrOUdObnAyVGpnM2N6ZzVPRnAxUmt0SlNISXdkR3NsTWtZbE1rWkZhMWtsTWtKeFMzbEJXR3B3ZFVkR05tazJRazF0V2prM2NHRXlVVTlOY2xGa00zQmhKVEpHVlRkMU5GQndRWEpvT1V4dFJXcGlTMWxVYlRONVVHWjNlbHBVV0dacVl6ZG5KVE5FSlRORUptVTlNQ1prYjNkdWJHOWhaRUZ6UFVaeVpXVlBRMUowYjFkdmNtUXVaWGhsSm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROQkpUSkdKVEpHZDNkM0xtUnZkMjVzYjJGa2IyNXBZeTVqYjIwbE1rWnZZM0owYjNkdmNtUXVZMjl0SlRKR1ptbHNaWE5rYjNkdWJHOWhaQ1V5UmtaeVpXVlBRMUowYjFkdmNtUmZTVk11WlhobA==

http://www.taggiftflash.com/c?x=MTMKQUAYjncjFCMhWlVfirT6FnT1pAJawthmSVRXU8M=&c=DFLoMMe4wAzkgUYNEvdEAKgdUp3GK8QMjxGeGRN51Dh/RRxR8oBXeQmVHe/lPPAHbjLbX7Z4GkECWnIKKKUDFdQLP42/yPbHZiNIpci1vj9EI6NRqKLmdqqSl7be2T swE8aDLyZ8EAFyb/1zk wm2Gv2 duAXTKlBNEEnnFu/4=&e=0&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.taggiftflash.com/c?x=GlBHvkWgSyMInwWzqe5M4O93p22l /v4VPYNpTGmqDE=&c=Y2K6VWW4RsPs1VfKpxZLRHnYIt2Af1tZqNBzx tlYemLoBH/QRwpH7CyC6BAXuhosMLsgw2QanOZdxVUu8x8sZXxS02w3N25y9IGyZQB8aHDgVONfVGum03cHuzLJHRruXSi59/TxE3mXolV6D2peCO/pASKa/Fa/C2SEZp71mQ=&e=0&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.taggiftflash.com/WVl6OTRQVGxvWW1ab2EzWjNhbVJSVVZKTFdFc2xNa1pSVVhGM2EyWlBjbW95YVdsREpUSkNXbFkzU2pCRFZVbFpOVnBySlRORUptTTlNVEJZU2pSNVRYTjFVbXROSlRKR1dEVktiVWxpYW1RbE1rSXpZbWxqYUhZMEpUSkNia0ZGTkRkVGNuZE9WMU0zYjJWTFdpVXlSbUUxVFZKVk1qSmlUM2hXUlVSTFFrUjJSazlVVFZCVVZGazFaV1ZvTVhZNGRWbDJkbUZ4YVRkRGNIVnlXa0pGY0doc1NERkNhRk5ITlRSUmJWUTBURmMzUWtwRVVrcFhjRUZLV2xkWGJtbHVNMVJEYmtJeFYyWktiVkF3ZUZacVptVmphblZ6YlhjbE0wUWxNMFFtWlQwd0ptUnZkMjVzYjJGa1FYTTlSbkpsWlU5RFVuUnZWMjl5WkM1bGVHVW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMEVsTWtZbE1rWjNkM2N1Wkc5M2JteHZZV1J2Ym1sakxtTnZiU1V5Um05amNuUnZkMjl5WkM1amIyMGxNa1ptYVd4bGMyUnZkMjVzYjJGa0pUSkdSbkpsWlU5RFVuUnZWMjl5WkY5SlV5NWxlR1U9

Remove freeocrtoword.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.