home

install-openoffice-2.exe

Ganimicip

Cpc Net Advertising LLC

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application install-openoffice-2.exe, “Ganimicip Setup ” by Cpc Net Advertising has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download the free Apache OpenOffice but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Cpc Net Advertising LLC  (signed and verified)

Product:
Ganimicip

Description:
Ganimicip Setup

Version:
4.4.3.5

MD5:
fd2365075b799f6dbb00c2288e12f3b6

SHA-1:
45e98b40ee084ed486dfda580552200e8ba8bb4f

SHA-256:
05cf543f11f4a0f78c7d1b8ac05f978ee8c31252b555db8ef55ec21fdb4120be

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/24/2024 3:04:11 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.CpcNetAd.Installer (M)
16.3.9.9

File size:
1 MB (1,088,488 bytes)

Product version:
5.6.1

Copyright:
Internet Program

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\install-openoffice-2.exe

Digital Signature
Signed by:
Cpc Net Advertising LLC

Authority:
thawte, Inc.

Valid from:
7/1/2015 2:00:00 AM

Valid to:
7/1/2016 1:59:59 AM

Subject:
CN=Cpc Net Advertising LLC, OU=IT, O=Cpc Net Advertising LLC, L=Wilmington, S=Delaware, C=US

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
2BC1DD7AA35DE89A0D5276ECD7AE32AF

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:HwDrF+oZYaRHGWJ5+4rfYRu+3wLoiaL8OzQiHB7CTHHA:HoVKaRHfJoiYRTwL0IOBCTA

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file install-openoffice-2.exe has been seen being distributed by the following 17 URLs.

http://www.straightarchiveslist.com/.../iDY1cbRhZLp wc0mCSNfOMAI7VncecFdmQAeN52gvR86iz mvdeRw4TlY k0XbQMb7XTdj1DCKRASKBsUHoCBcqDcaj9oXc6MaosdoSiYMhETS&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=8Y1HOUT/JrhbsZ/XPfTK B5CZ/cT8ZWy4AaStZKXGzE=&c=fQNh46rIaKJ8wz2kuQLhrYEdSaqRp5LgaaXk0AmTH2F /KYya1UvGofQU/5cofV4fNmK6b/.../88MUBAGmXtlsRcDG9Gprmp2P52tUHqij 1SBrz7azr18&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=3nf9tYjPUne7c0d5pxznVskL7FdTPIH38O5p8tu 97w=&c=EY3Ccn bi8oLxm/.../1&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=HZaffsazqgIxW DHUt346p RXDje2/ly/.../77OCc9aNmSHnjb&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=Pk3BD0OSr n 5kUqKmJGNJXM52e33wD9xdrJOWYnPsM=&c=E7Lr03HFrAL99yfRy19rqEmyjL9dtH57Ki0nsuJ58hZ0KZzFEqpJinUxDsaxUI3IQPEGNHZOITVWqXcj58goSaBzxMjuqRbBN56 itUFXuwjRWj7XBKsGoA0GCG4SRL8&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=QTc VI65hyayt8lxDe9g 4giNSM75FOc7F6M8nfEu1M=&c=YWkPew/r4foHX/GLdUQdHpYYe1S5X7kZNZyjnSwZUh/uwUAsDYRJR/wHcgHFWMLnKcsCn262KpGfcC6DVvcEADb5SKXK4n1p1mVbR1W7/.../Era6pm&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=9sOH/.../hGkxmpGf4dcZxMNQ=&c=36TrSSoG l6cMWolguy4ODZYBs4mrv87z7I529x3wKo0BeK1vzg4RDHSBCfBUzZfIPTZEgnYvkkisP 5DGiTcEMJA2Q447Z6IIulNP3eCmd c2Snef5UM155E9MIeIQV&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=b7L0HBkgfjG72ADA8cd4HuOD0ocLzrsuCAZFumkQyn4=&c=queEpLZoxM9YX4ze1Z15KPiaABdfnhMQQNF7AGfOMcy89Y0msXJ69wIPffL5HSnkYp 5Zj74i3uD1w55 pzJ8hPXU7MGMSznwmtWCbGvl11EuJmwK0cNledatcLsdnE &fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=/W2auDXd7n3kZ23ht0wAtnYlTf/ccTVq601Z5qh5y4I=&c=SEl/tlfqsVtm8W3ypt/QhGrZAInoAELK N1GO3BOg7/.../ Kb9d7a1ykEQHLA0RZKv2ziBGEt2s0GFlp SmaOVxD&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=Ai9Ya/EkvK8aDTlIRXkH4CWJgrvafdZg74iHaekNL2w=&c=mlMAZ6Unw7WY/qQs13PCscwF2Ke3l8VO/.../k5CXUWyL4Tvz96xoVtX0sedqzuU 8DpVATJZi6dvTHmvdFy0hoXomHifDYtC7GW1YelZQG8r1uuZkWHEjhLhy45FkBP4 &fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=k869Hmttk/41Y9FbgGH/bao8t 9aUkSE50EByMvXNc=&c=SJzrNQPZjWAe592qRfSqKPPnl56vx5uq5d3sxkqggpoXFFrM NZq5kbMW 1raNDsWroKLTLn3fyf7uE/mDcXzq4cslf745RsOP/.../klLrghLRs&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=LOhTPbhxnpGbDig34jEQarI2hbRre/brE8JWacw9734=&c=xPaAYcXlxD3/ 4pyiZY/fTbttJmrEJU86KERKjjMmAFI29U7unqMYDsAak0EkrXv90GOus/vK7m6zG01/.../ITO7gm&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=HGfyp33CzOesoet2Zna1S/9 g36DvbcAXhbaGj0Vb1M=&c=DMU3d6aLUFyKqvVzJUaBaqG0clOVMemJ651QWDJ2PAaxmUaT/.../RndXZwYTZ3P4HddulUO8ry95Qd3pQLZm9qhmTLwQobuV9xSMRc&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=vOiQQBOP1xwsRU2hg/al5wf9HNbGR8muM54LMCP5PvI=&c=vTZQJLFAabJWRGFtQWnYnwoxdWhYjUbTlTRcDed5rlgXINceKe/nPSqoZ8VWhHQXcV8Xa2iLzzcPRl7x HoQMUqFCrLv27eBKuwE692QI3EYHxhgYpBMb/.../m87fZs8&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/.../hhZTfyiok=&c=7AUHeHcSuDdXKLf4wLguamZuFPLRjsDP3nnrtVRNI1k uEsTX8MUbigbF46g7315acuPaZBAZqtk53kbBaYpagEoCccAreL5Qy87TwQ0hHkfnZQCNiDtR27TntzBPVHW&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/.../zvuc CpDQRP Mugzg4RNxnCbHLAWD 9ykLZBoTnNXbDB5fDUwKEC mbugnoVI3EuXOzda3oq0GuEka0smCWdX&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=quHRpD/5v58YO16nBcqAIjSaGWzvozSxdsE3c AJaBE=&c=G31bcqFPF14TR01W8PFDqeYSyvJKQd8t2XK9JtVhP1hE4JCeTj93JaHruObG pyD3m48DNmPU4OyJmes3nQ2c3goxX/.../j9XAcM21xcX4NLMNM1&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

Remove install-openoffice-2.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.