» install-openoffice-2.exe
Overview
Analysis
File Details
Downloads (16)

install-openoffice-2.exe

Lotaduh

Cpc Net Advertising LLC

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application install-openoffice-2.exe, “Lotaduh Setup ” by Cpc Net Advertising has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as the free Apache OpenOffice but will also install additional software offers which include adware, PUPs and browser toolbars.

File name:

Publisher:

Fanoto (signed by Cpc Net Advertising LLC)

Product:

Lotaduh

Description:

Lotaduh Setup

MD5:

190667bb9d081a056bb04e66d033ecbe

SHA-1:

598e0dc52dca11f9c10d6da42b2aefc3c594404f

SHA-256:

a7b2359d18a1fd38a2599b63345341c478d1d8a85bea1494a58c951b3db1844c

Scanner detections:

1 / 68

Status:

Potentially unwanted

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

11/24/2024 2:32:01 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.installCore.CpcNetAdvertising.Installer (M)

16.2.25.0

File size:

1 MB (1,079,968 bytes)

Product version:

3.0.0

Lite Web

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\install-openoffice-2.exe

Digital Signature

Signed by:

Cpc Net Advertising LLC

Authority:

thawte, Inc.

Valid from:

7/1/2015 2:00:00 AM

Valid to:

7/1/2016 1:59:59 AM

Subject:

CN=Cpc Net Advertising LLC, OU=IT, O=Cpc Net Advertising LLC, L=Wilmington, S=Delaware, C=US

Issuer:

CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:

2BC1DD7AA35DE89A0D5276ECD7AE32AF

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:ZINVhH8+kTLe7QVPOTW3Dv1w72i6RFjKT0HDxBYAK0Dc:ZIv1caQVGTIDvW687

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file install-openoffice-2.exe has been seen being distributed by the following 16 URLs.

http://www.straightarchiveslist.com/c?x=mxzntzO1hXP7CNMQjpo7pc dmW66b4/56wmixlgg0IY=&c=X2KmwzKMed wO2od583eKUdzAjnhEV IEDELST7OsA7ps0x3iNnbRp qH5qCz8WuVjH7yEiFf1/.../pRqs33q11iIuQhCZoIGPFFN6KiDdUATxfkj79PUcc8rg7fjC&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=wJCzeUudPwxGA/RDaqVDMwTXQdeZMyp7qURK0ssKN1A=&c=fYqabfXm9EaulfqG4l0jr8w0HXKqtrRb8J8O/CIf2uopIIzrGS8kerv/gurovn7fmUUtu N5WDZSFgKgKVRBT7v2laUj/.../XJqa02GhjZR 0d9w&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/.../lvxOk8QfriBRbd &fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=H4n1w4/.../iL tuOio43a4gwrr8hhU2434rWpYMwbtQiJxtDPKdnwNdyfp7An2fQhtUkYqfCWTu7UAbaHgtZQGzoMJUTHcvB&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/.../6Tp1kt511nZKzNx8nqUaDcWsb7IySgf2e0gRd&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=LZiBbBJM40y5iSngXEC54DGtcjLc7X8zghLB1ItX1k0=&c=c76tRb9Yr8SAz3pSy51 g0f3HI93AlXrV75CmKxTLLssWiiXSx3klLBORfLRJ1UMuzF8cDV4VyZZXrXNXnE3SKi1ROD3YnxzChSDRQCjpkbmWJnYqprdYDxIhJLeyYOe&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=w5xbYkxFKCyzfQH4VCoZS2f/MSZQDkds3z2GeCtqUWA=&c=NfsNzomjZplHv5CAaz4jLpSdfaI rVMfbwgJcbGrPYbtVNF7RwkRlIc vwch5aaaSo6Y2iFOD8rpGGz6/.../lfHDtVf0Ad69ZjLvV6KgC&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=4DpDQgZBkfE o8lc0s02mR4hLNufgsvBHh5sesfQaP0=&c=Vkfv8me7gBqhgHmsPDyPdOupKztNPF1xaAYAxaBm0N mcfxGAYMrSHFwOqwFXjgMz72LJQf3dDYD vLI1FOil5WL2 3wJ/.../FdxCGLTkOSE1x&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/.../REICFTYzYoGQlI3iGM0Yrl0QYPZKyAQ0DEBwf6tzF88npQp9ugWd4xpmWj6KAi2B3 4NCMUnykYnmB50uUkqs0VrHvaUuqHbPM3MEB1ObyVpMAso&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=1pPxHUHCYYo/C117TZJaYaYw4ynwZHYa/.../5ezTsZFSKyQAg7z32g1kAbJqDrQmkhFKW93PGKJ95gb0 m&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=fxhfsJuxfMQiVnrvKuHx yUjTPn6dHbFhJEOmT9RGZI=&c=AH8PyrxTl5L3rCX9Jh0MNvW33YIavaK8MGOS8nNtPnjEvnD0mdgN5aY7RbulA68zwk7NAq4cTQmO5tcmxog7bWpomG4zrF3aXE8RCYBANZxfpvFeSN68SPBjPsqVFp9Q&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=Dry7Q15eQbm7i5cO6b/kmtJCiXuq9M5Cqv0WSvViN8U=&c=w7WSzX6/.../784ejjkG9 CSqaLsLdNx2d84ILHr8GbEhJYEIpmLTYjUmOt3c35gMBMHjM6c&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=0Zfn4EnXRVA2MiqnQjlUQ6gWUfymd8CoPY4O1b6vVHM=&c=69aRdGc uDrnqoOOvvU8xjAJsWxEopB8Ylb7b81 mX7p39vmtB5PdIxS P5Ox8MFSDDlQsJlffEXzwjQakboWq36k0RuZxkxlF6RBJf8Wb2Eq2JTi39dDMYAXmnvoSoT&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=gkCoa3Ax35kTbcnoU6AXEQDADY/WlAVWC/.../m6vB48jW291QcWprO8rCokXUseVQKupgmYee7I&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=tGHjDYRnaRnX1D0Ff4riNIcyFsSgwMeg3h5Lfehqi 0=&c=X/.../SKH2KXw1M6nfq1 vk53oQPYAwNXHVJ0ACscPSyQ8Ht8PhnZmt3bQp2SRGv3I GA 0K2jF RynzYhxyVAJ gbH9kMlxX8BK9fKfI N myhnZbhe3jm&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=ksDsupOD3nY5ZMU7knqxChutxO79deXW4n1hxfrcAz0=&c=ico10E1p/.../h1nq4fLPBfeodfLSRIg3Z15U Uqz83 WEEyhmQvOwgbqvROq6wxAvxkNly1tDvfPCk3&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

Remove install-openoffice-2.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.