home

freeocrtoword.exe

Web Software

Beijing Qingchuanglianxiang Technology Co Ltd

The application freeocrtoword.exe, “Web Software Setup ” by Beijing Qingchuanglianxiang Technology Co has been detected as a potentially unwanted program by 2 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.presenttowertour.com and multiple other hosts.
Publisher:
Prog Lite Installer   (signed by Beijing Qingchuanglianxiang Technology Co Ltd)

Product:
Web Software

Description:
Web Software Setup

MD5:
d780558d8b5d9de35bd0c0c5269254df

SHA-1:
5f05d0e371edbe9f4486f4915fe233fb2a76d245

SHA-256:
6efcaa92a51930af361d48b6415db853980916f92577cac44e832d677b509cfd

Scanner detections:
2 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/16/2024 5:41:15 AM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/InstallCore.ADX.gen potentially unwanted application
10.7.0.302.0

Reason Heuristics
PUP.installCore.BeijingQingchuanglianxiangTechnologyCo.Installer (M)
16.2.4.15

File size:
904 KB (925,696 bytes)

Product version:
5.0

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\downloads\freeocrtoword.exe

Digital Signature
Signed by:
Beijing Qingchuanglianxiang Technology Co Ltd

Authority:
COMODO CA Limited

Valid from:
9/11/2015 3:00:00 AM

Valid to:
9/11/2016 2:59:59 AM

Subject:
CN=Beijing Qingchuanglianxiang Technology Co Ltd, O=Beijing Qingchuanglianxiang Technology Co Ltd, STREET="1901,Moma Building, No.199 Chaoyangbei Road,", L=Chaoyang, S=BeiJing, PostalCode=100027, C=CN

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00E5F50EB929935434546FDDE8F49FCB1E

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:MtjvaxVYPchE3nUeRAJv5H7puxtqvVQXldh8:MlMVtAUeaJvxkbs8ldh

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file freeocrtoword.exe has been seen being distributed by the following 4 URLs.

http://www.presenttowertour.com/c?x=Wirqe3DBXfs7B7RwGPYMhDk70i0FTT nUoXr7uYPfnY=&c=PMxITUyysOQ1QTxSwuFlfBroQQa9k6/UlGIZO hr9yDlHQ4/KHRuSofyC8/EFoE9TbJn/6meko2cwPMKvP8Zu5MULNT3X3xJLoeh nxq4nJmkD67XBSfE6DKm5 zo1pN&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.tagvaultsapplication.com/c?x=uArSKkI/HlLe zftplSa2Mq8LqSYvlU1kPd3UTtVVQw=&c=UpQccxR9 75SSrKx6Gnj2ZORam/iVG0eygjRrbhPc0dv500f7kILXIen2ktd/BWBAIniQOjkr9H4PyIMv5 KHQo8gt53FyDx6Mh83U 29rtOkdmxS/GzhrJdZnBk JJS&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.contentsignchuckle.com/c?x=uTmSp4rrHyrkgL7LvnnMUFDVz1HMUX3QVQ4xZ/vV4J8=&c=a97kWztyhkRsrUAOxn08S6Zkq3c/FA5FCBfDs5m up8d4GZhyZcdJ ZV2ZvUtAOUTtobzpZv3s0bIe1oryfZnRhu62cnaUnZ4X20ySO4lZPM5LfEAlvleW43cZ4DXxg &downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.metadownloadsworld.com/c?x=4wX/XVRE zbjPbbq5MEtYMsPhR87d02ILSxBpQgLcEM=&c=VIjkY4RA7v7ll71Gso7qEroXMO1rRt7lCyxY6xDjZupa6QNCNpZ60mVkStu11ilWS PVB6c6DYs0VOdNfYuW4oME9NEl55UTj436YKbGfU4n2zy1NlS 68Rf6iQPf1sE&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

Remove freeocrtoword.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.