» install-openoffice-2.exe
Overview
Analysis
File Details
Downloads (12)

install-openoffice-2.exe

Lotaduh

Cpc Net Advertising LLC

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application install-openoffice-2.exe, “Lotaduh Setup ” by Cpc Net Advertising has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download the free Apache OpenOffice but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.

File name:

Publisher:

Fanoto (signed by Cpc Net Advertising LLC)

Product:

Lotaduh

Description:

Lotaduh Setup

MD5:

314f47befc9a2f876971304e655410d9

SHA-1:

9c4644be4601ccc9cf64b56c1698348d43f54ae9

SHA-256:

5149be3d1bdf4a04e75b4782c200a80cae4f05132f386e8577cef764d9414657

Scanner detections:

1 / 68

Status:

Potentially unwanted

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

11/24/2024 2:29:36 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.installCore.CpcNetAdvertising.Installer (M)

16.2.28.9

File size:

1 MB (1,079,968 bytes)

Product version:

3.0.0

Lite Web

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\install-openoffice-2.exe

Digital Signature

Signed by:

Cpc Net Advertising LLC

Authority:

thawte, Inc.

Valid from:

7/1/2015 2:00:00 AM

Valid to:

7/1/2016 1:59:59 AM

Subject:

CN=Cpc Net Advertising LLC, OU=IT, O=Cpc Net Advertising LLC, L=Wilmington, S=Delaware, C=US

Issuer:

CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:

2BC1DD7AA35DE89A0D5276ECD7AE32AF

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:aINVhH8+kTLe7QVPOTW3Dv1w72i6RFjKT0HDxBYAK0Dc:aIv1caQVGTIDvW687

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file install-openoffice-2.exe has been seen being distributed by the following 12 URLs.

http://www.straightarchiveslist.com/c?x=1XE/6ySrRiCBH5YKydHG9O/.../ta1pLLpWty1WC4S9A83YsJA0Ke5&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=nn/nreQRput0aird Ur24fop5Sj/i veguXetYSKWgo=&c=V d6swo0SYjfx1s27cKI5tLYwgB ykfXLDyewhbvLVNpHCW8qL3l SCju7xeJ5nW0MfF/nXjB1/.../5sS99TfCu35wkw26S&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/.../fKLXYPL3EQfxIyxPIOHXXW7e3L1nbWaRBWMXT0g18Sh0jJiGxgad7YkWMs51K5Sw8kFkg2 2btrpWPJpynHNuraAYAlCJ1UKEHZvPRUM1xar9Dgf62osjNJJrcaT&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=8WA VmOz4VsgjH sD6yPbGfs73GNfLdg5m4rV/6IvQo=&c=kIWsxp8gJnocITA9m6N8xs8nfW7ezSqr6nfz/.../omaEkEVFYqyQAO3Vsm&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=jJRZxNgAIn0aUgsktxHiLD6nj8oFDvotpkW/j1W/MbE=&c=IJhtH5c1pnG8lP2YBvQNV3zrwpbDAbIDm r3eYOtgFspOQHPvrE2ExUhIf4R5phIX4wh35JlMZk7PzqdSs7FYi qeWUul6buy/.../ZG5c2pg&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=2Cgs2E9lpDWHLJe7V4TQXiBI2c9lAQhumXSdPB20kqg=&c=LabOpzkGZRo0qBDnCpliBdtxba9s77iNfpqNF0RmZ4k6Q2sB77cJdxkS0PfVstsoeQ7ngPG/.../BIIOKM4RNV&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=9AprghKkL9mB oNg94/w/X2PULVloLt5b3ciAEwfjLU=&c=5oIYX6DHRrWi1yVrfZZw7pGmd9HIUPXwGmfKR3WgPQuIXKohBQ2Ipz6yTiF8nO9OhsZ9WBlaVmFIvDSw SwWtosqwztHnkPQh 1xSj/.../Vx sstsc2vT9JtKe7ARSGPr&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=hjQB4O02c0OuchZkcVJyqIbsLBZlhp0UoodirMx/.../AiSwZ9RPDP1syrgJolGliWF sywBZlDN3j0Bh0UNRKjRnwElwMJbGPE88 TgetCdfq70XFhQoirsv36z&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=0z/H7b2eqpNzqShRLibWuiUdXnOV8lYL//j8dtByt7A=&c=bu0doMeiWipEKk62hkMW0Ci5k3vl5cVbV wh3NZFkFix0Re8y JeK0vRfr4salkrHbt9BGdg3VJVRglz57YcP1inBnCzV4S85EU3klkDOn3hBLeYlweVw2xV1lWqtn9x&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=Na4Xu6dZyQywp8CMhiu1dHgMtqtQl2o03ufir4CxGBs=&c=MqBvWH6pF2BttVCuDlc0ynyxcyKw2Hqis6uHh/.../sQ&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=oNVsXsocPhRn0ZbRG32r92jQwJvb6CmooQXE0vESEkI=&c=fS5WZbTuGi8fGPHBXOlC7PtovdrE5S/WaSlEBbOf8m4vN6RbAaHvx3gLpK 9i7HmzkjQPD uk47cn/.../HBkf7 YjfCF82qegbheRFtzSXRvURA12Z38gAlctrX9qpgwd&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x= zSIuoumwvc0sSkYkf4poZX6ujT3IccQhS0Y4VX1U2w=&c=DKXb3nqCSiojAjN7iaKc6ymqu1MnqWRJ 9VH6DgswA6t2qfLZPOSzSvCsogeB2HyF1h6C9EopuuZL duUFuD9d7aftQNyjRtdw8ItpS4nmO3L46nmsvCkh8pQtNYmWRk&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

Remove install-openoffice-2.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.