home

install-openoffice-2.exe

Fifemop

Cpc Net Advertising LLC

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application install-openoffice-2.exe, “Fifemop Setup ” by Cpc Net Advertising has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download the free Apache OpenOffice but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Cpc Net Advertising LLC  (signed and verified)

Product:
Fifemop

Description:
Fifemop Setup

MD5:
1588606784f8400256a56efd365608ba

SHA-1:
73458532594187c6d6e6495ddafacf0564209c39

SHA-256:
45edcb63673f040894bfda9d2841c2b7f6f6c3ba503afa5a057a9c083ded89eb

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/24/2024 2:25:26 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.CpcNetAd.Installer (M)
16.3.13.17

File size:
987.4 KB (1,011,112 bytes)

Product version:
1.1.5

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\install-openoffice-2.exe

Digital Signature
Signed by:
Cpc Net Advertising LLC

Authority:
thawte, Inc.

Valid from:
7/1/2015 2:00:00 AM

Valid to:
7/1/2016 1:59:59 AM

Subject:
CN=Cpc Net Advertising LLC, OU=IT, O=Cpc Net Advertising LLC, L=Wilmington, S=Delaware, C=US

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
2BC1DD7AA35DE89A0D5276ECD7AE32AF

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:yyDqD9+3xUHfztSm+u8lRWQhehxXWkYYxc7ztt7xlrDOE5q:ymq43xU/zD+u8lRWQhevXWUK7/s

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file install-openoffice-2.exe has been seen being distributed by the following 13 URLs.

http://www.straightarchiveslist.com/c?x=UzxP4PNlZRv3PcCLF126CqtWO9FV2tPIH4GklQhqzi0=&c=e3l5y2O8sp1Midt3joo6LDJzZrgub8rQ2sNSyVgngobstYUdNQVk6 VgsSuFY6MRkD3fg6uQwhpBNp B4n8 sqMcmlPurmurSWnZ42OgTEfrGWlPq Cr8twEXI5Gknjv&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=w0sTTTe4odsVPQQlSwRi0ogFEYIt9tNkVgOHJYuyO4E=&c=XfEWOEVjDs0sW uuyuSBFUgjL1cSCUdoahn GG ykx2N0rp4Bx9MlR0DZT098HGI/xAawOHxp939/.../nkXsEeACS5cWeW6dIRHYP&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=lUY/61ua6XBtE5zDwOsVZURSISe67X4IvEkfBsGqkz8=&c=DK5wqo0bCKqeVHLg hHsaJL7fCN/42idcS3FFpxrcI0W EXfALH81cL0 tcRuy0y6Yi80UszwNfxwAqCeXTyKI/.../VhTZEkC06w2mfbDhMBPiGbSLtnoumn9hrvJenF4&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=UNY6cegzecbv1FJ5w4NvnORh/oYbPYEJcRCe8axohlM=&c=jLLLOzVMSmQshmzx2zyGJE/.../HlWRT367w3JtJWjiNUHQExx97lBXkOGrbnlrBbh94AolWuAnqEPG6jWb2AAiTYvBEav3sdeBzpLibNimSt5vvLHNAU50SVZD7w&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=OvfDS4JYE3Cz5cS91jT1KfiqFM/HOc oKyq1JRVuSI4=&c= 9Br5adYllCrRXP0hndF2P1Fjyk8f5xktdoR2bKo3c/.../3L1STTGb5UR ZaCxLn5iYx7zS5oN4YW7kPRnVCy7iLFGW4P&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=WsUjJzsEG3MLC7ikXQNflGdWTzXjghmLaxJf8c8JqJ4=&c=TJP2mB0cXIJL5Jx RL WvXyGNub9gvlrNp6H09unnDSz4m1GgO22wMPhxr2WKIAW1zMZnfD3eUpWTmA4//dV25ZuFXL2VnZAth8Mi4W28 1ozc3IJf IeTb 0DAafJ1x&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=eXpuKATYkPD3FX15kbb5H4IhYwFqsU6QreS0AaaZLps=&c=yl9P6mCyptma3pUuqDwWDSjzEjrwExaBeQlTK3H8VD9S6mQRDbOYPGjLYlAQt4oGA37/g6wNa6ajjIAK7UJUWvpk9GelD E4lWhNgEySo/.../X6e0&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=u7jq6QglM4aObCa5l7iK215VqH0aSBpXVd0SwswoZ4o=&c=ZhqKcTfFL2fxnmGe2COJ ebzMhJkCsKcxW/ f3Lxb2AVyvy0UEYjmbDVnFQJRQMx12DK/.../sNQ8k7BE84rXSZ8KQ4VZhOJaraSYETAL1mfGtLWTEWU0j644Zp05Mp&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=UDHlcdDTXXL tXE7A0FdVw0n1eLp9Ax4Fek9iY4XH8o=&c=YBlPxjwqAsBur0mAC6kDhnkpNgUz7fvN5Hgtv1tfINVtZE2473ISsvXihz3GSVUSvvoSkVwrkuy6r67bHvcayoGgAUoU8CjbhgjdQaoqNn42dHXorpMi8UbsC2X69mZC&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=hS9OZKZ5JbOuKxdJz2CN0Vey r5R8jdyt1PfswEpQmg=&c=gn/.../rpg2yy AW0kx5tgC&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=sPxM79s6KnZDqo9QppzSmzj0/fkdeJScLZ63mVd3zZ0=&c=/98V vasVqAOEg2tYnPf5vdHTeO9Z2VlJDAgysInjQqcM/of7zf658YoA/zTD7Hj/k/.../o40azXVJFHEATR&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/.../301L4N53HI7&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=uXai88iOCnxpMj6zwvhFyQm6CeqOiPPZj i7 8PK kU=&c=QIpQ ipNkiTbTSxVmReyZh3pLc3Xq2K8Uy8Rc ej13PoJET08RwiYBQ0963an59sXGlknVxk hqYz6985EkfJkppWOCN7psqihERKkp//re5fsLhWhRi1lXyZNP3XOrh&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

Remove install-openoffice-2.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.