home

install-openoffice-2.exe

Application

Cpc Net Advertising LLC

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application install-openoffice-2.exe, “Application Setup ” by Cpc Net Advertising has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download the free Apache OpenOffice but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Cpc Net Advertising LLC  (signed and verified)

Product:
Application

Description:
Application Setup

Version:
2.5.1.7

MD5:
d445835b73dc245e1ead670579b7c85e

SHA-1:
74a5cdd9ca2494780200b53a06523c8a302b41de

SHA-256:
6027a0072826fcd333d00e086511496856784ff7e8f11fd0d29fa8c94ae9784d

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/24/2024 2:49:05 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.CpcNetAdvertising.Installer (M)
16.1.23.9

File size:
924.1 KB (946,232 bytes)

Product version:
5.6.7

Copyright:
Software Application internet

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\install-openoffice-2.exe

Digital Signature
Signed by:
Cpc Net Advertising LLC

Authority:
thawte, Inc.

Valid from:
7/1/2015 2:00:00 AM

Valid to:
7/1/2016 1:59:59 AM

Subject:
CN=Cpc Net Advertising LLC, OU=IT, O=Cpc Net Advertising LLC, L=Wilmington, S=Delaware, C=US

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
2BC1DD7AA35DE89A0D5276ECD7AE32AF

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:QVJqOnaqaRPEaxttVDHEvH8i+wkdwKetHpLSPdOsb:QHZeEa1V4vH9kuKSpwdxb

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file install-openoffice-2.exe has been seen being distributed by the following 22 URLs.

http://www.straightarchiveslist.com/c?x=l2oE qnWczszVcp43r11ZU3 jWSZO Ntoie/ji JgxY=&c=yL6 cDj VMM6XqIAn4amjWi1v5/T8 jVR1 6I fa91Nto/.../jXqcKIdQ0a3PmDyNEj9vTW8W4qS4MFlafsFacG4JcdQJqi2YqePwVguDwFd9wFk1akEqfiPvLUvh&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/.../vO&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=SzXoCjnOS9uNJdtKkkXTa/JiW0IVbcW4DVcXTyR2J k=&c=pwSdjtMJNqd181ozER5i/rPkmqMasnf6YduJ5UaqI5YrMhfheEiQh8kRFQxMf2oj78gsWo8/.../Pp07Lw UNEOdhLtIg8M2lsEM4LRtF0DRfm5kF8jWgaqN8yJ&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=JZL15BTLF2X k0hhvH6XvSqDaDmesX4NC9j2V83bIWw=&c=8gHBIqFaRUXvaMYnOQF3p1x9f sozc8y1owBa208hVxsxdZTMnmO7eUCuopHCcGWmbD3OBRiDz12Zln8qZXHRUkxaQKnrz38DVCZqAGlgTwXo4WdNO76jp7PByW6WawN&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/.../dLc=&c=6RQ6s3r7JJV7Z1Fpum9rt7XxOjh9E2gZlvmWgkhaFxfkE8hjsrIfgCvsHPZnQzq97Z0ikDTLSNcuEsku81hron7UyXP A315xdWhxlv6 pBkOuggWWX0Iwh tBFiHiJE&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=v Sm4EFtUXvUT FODvwfEgbS12V18VmPzvkiPcjTjuY=&c=b3PVvL6EBrgXRSkUtYGfe8GuRVVYRYYMMeYjtJg5ztThgOVzGz4LIgWSE9RfkwovLARj0uKVfB3vHpCyOEJsbG749bYJ3dqAqkXlUJgq0UnSzLUJlPwLMtAYmc92DmsT&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=r/VkYTKCZQkwmTZV6C3DiDkVXO u96RDf3UkQrCVeuo=&c=DHUnlS7BrFdwvsElhbrpgT XNBnBC/.../zwkXVRh1r7a9UF94rMQITaChaTH3ZcpczTj0h&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/.../NCroyUAeER3j9ksya85mNwTSZRu hNkvEKHy5XFyaCsldbWJT&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/.../JqjLeHDTCOoE2aedhydQkr4V2xhoAFD8DrwN DoQfY9XixtiqRVymLN3wgcxa1CW0bqmfWur nltI8qD&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=DDuYS0JsJdTmWNUvoqwMbxapGkwQBhGS1zF2KdurBkM=&c=j vuGfhdfWqeLbdgSXAISuqyxWyQeNIddUylVdmF3x82mk1A M/hUQAX3fhJGKdiHuo0kZq0ZJNCygDNPvFYmra1/BAQqC5ZzKVMfY7C0/M/8aLGm/.../FcjJuKhT&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=dCrz6b8w0tVyh YY bOKSqhVQ48vEBn3WgdqN99UnTs=&c=fDHBM2tpNsv2TZXX9EcRDlJnLIf5DqlouQUc9RDZlvWRQrCDER1CfPZYKj6FUifzFKgnsJ7Vfzvgnvh151oG4saOKCfeWyefXH6qiGePMjvrqZ5EiGeXNg3eKYcT7o10&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=pBU86BRdAIm2XJCPtwJPxxRf7 DdiuuaeljqHmwReYg=&c=56LhSvdlNnwb74hpu4x4vbg388gCL6u9v1ETeT/.../5UlmQjbmTNttyxaxQoF&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=vTzI0mQBU8MkKua0KwUDL7DwSeSPYqGxokb/300rdbw=&c=zewEViV7XbcQVo 3Rr8ngME6c4W1wOe/NfEl6hqBRJ2PxkFdAF1qUuIr0K9EcMo7HyWI//O839r5da57GOdWIkeHIZfhHMdUlySREicsedxTZW90isdvq4t9t7JNNJxi&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=5tpUksKcJzE3UmvClngHvqcsUH/ijcxdAIujY/eVumE=&c=iCDpJhxWfksOTDfz6HeTo2AaFeqYuzYIL AAhNi W 6QLzYxxOfvT5X7VVc5x4D92NK/.../2KC8tIle3HNsIMopaRgyTDUeoObzVzgqv5EzQzIK2V5MzAaf9dmH4rdhR&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=O8axhzHXGB/.../EELcHcUrAIYXCnFxl7ZB UI 3a25DArNZdVaZqKvMd9cR&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=CQVlSIOFe8x9T8PGYK/hRcVbU/.../M jVA4YAcXfadOaXmwRAO1d339W8AdKVD3JObesA5Zqs3hNTwGOAJeeWSsRi &fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/.../ wc7 cPPBE&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=ImxR7/sCGeuM2djNhzaB4VjY/Rq41PWo0MO94JCte2M=&c=m6WpMCxDzdUx8vTOisQuRh9WjgCI3bT1UMuTcLMQ/.../RSUWYwdFiCb9iUseu5xGD6HC5c&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=tIJiyTbfEMEETg6DZDiPKFJxZvFT04sEB6yVYYaZnVw=&c=yVwPjltR1aVUm4G/.../tIzxuewbXQxjcMWlLwb&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/.../7vDmhMuKne6flLDdYQahrQIljJcqG1TSTu9I8xKyEHG&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/.../q0nYO9V98V70dSNGxgYCHE5PFYXIBEEfjbOONiu49L4y4cxRD4v3RPt &fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=pxXpl0p bFKsDBXNoUSQS0FEq52SsYnbznbV6kuafKw=&c=RaTJGco5/eIcG627p7rCvMHskp0ZYJXE/.../hRER xhahaY2OLIRLxtnOAc40qd6K&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

Remove install-openoffice-2.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.