home

install-openoffice-2.exe

Lotaduh

Cpc Net Advertising LLC

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The file install-openoffice-2.exe, “Lotaduh Setup ” by Cpc Net Advertising has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download the free Apache OpenOffice but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Fanoto   (signed by Cpc Net Advertising LLC)

Product:
Lotaduh

Description:
Lotaduh Setup

MD5:
a652affc67cd61b6bd634ccfbcd7ff7e

SHA-1:
ac05f67fc913fcaf0192d02bc3706a3839a620ca

SHA-256:
542b5be401d2d8c6d5d172162fa02e219b0b0855f8eb05930f261be5bba12562

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/24/2024 2:50:40 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.CpcNetAdvertising.Installer (M)
16.2.25.11

File size:
1 MB (1,079,968 bytes)

Product version:
3.0.0

Copyright:
Lite Web

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\install-openoffice-2.exe.cox6068.partial

Digital Signature
Signed by:
Cpc Net Advertising LLC

Authority:
thawte, Inc.

Valid from:
7/1/2015 2:00:00 AM

Valid to:
7/1/2016 1:59:59 AM

Subject:
CN=Cpc Net Advertising LLC, OU=IT, O=Cpc Net Advertising LLC, L=Wilmington, S=Delaware, C=US

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
2BC1DD7AA35DE89A0D5276ECD7AE32AF

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:cINVhH8+kTLe7QVPOTW3Dv1w72i6RFjKT0HDxBYAK0Dc:cIv1caQVGTIDvW687

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file install-openoffice-2.exe has been seen being distributed by the following 16 URLs.

http://www.straightarchiveslist.com/c?x=nyg3ZU8gVMNm2qJm uTJP4r4XWxLn0qMHhWMfNfuqD4=&c=9qhyl6ieR/pet45tS 7nvTUiLnmNecDiArPTgq8rCihyrQE77ZKR69tbQMiZNdv0akgq1ShIue6akSLo/3FFhWC0//d36UzkkvhnCrVZzyr8mt7fpj91xby2UgDZ3erR&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=pzYsYg19eJ9Q8rtmcSogphDlBgvdEgSKzj8cYGRmuOQ=&c=5xISBo5XFEcqRlgp TXgxKXosT8qUFedFvPhydNNbFKlBwuFD8 UGWIY9VeMmwbSifMMaSFLr9/.../1XJd4SK&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=hM/.../6mhVEu 33IbClUrFPBTyqk87pRMRgx0VjfbQ2qZO3QSqzm tHtZis1lOsSSGRBKNekAvD87yG9OWo5WfUncuTZU1ahyiJzcuWIIkGANebnLs1IU&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=VfUpqBgsqCBC/THblBeqt kHLyL3C2JUWzDbTycQQ7s=&c=0XzqNj7fHUsB5O6d/UEsFbi/tOve7WYuD5LgpX4/.../qyIGcHmtcOHiHtdqcj229gl iyIg&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=CqNdkFkOQTwBop79hKaGCc9WSNuunfZrkE0buCdcHPM=&c=qsDyVAeM1qcQGuGDR8EyHHhI9JDDs3a STwu1h03ez2aPO5Ko3J/.../ZZ1HMyg3M4aYqCUeAdh&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/.../LNlBp qQOA62Z91pFKYZO0EcwyoMIH8pgQQ4E4gSz3fO&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=7KNNe sgqGndMz1IUak8dJZKLAER r8UrbsXDzc3Sn4=&c=9MYxHKNncyIntSI2vgynlL28unRDCxK9xCP5LTg2UunA ElIKeKER4LQ3u0P4KkHVH7LG/.../lJyH1lKr&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=Q3NVYFVtVzqUOGXtoHOsMBAlHNrWJoMX54PnNzRcHok=&c= XlKpFhbp2KcrVYDa37t367P2/AWwla0/sGGD/TQ1ann2tfskjrffJsdYhdr LR1ihfk0h5n0/4EvNSy0tjZwW4hs3hzp6GSNgI0ClFORZHS5uiBGMXfxVZz2/.../7K1&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=P0m1orYATcB0d7JzvPMBhrrnEdDtruecgIAjriq5hZ8=&c=kFSZKupanqyhr9XEBWz1DT5AR9CVAVb9/.../E8AJeXlwv8p1dEzgBXsx 5o kB0lxosxpoijot7NcS06mOyLc0Nz3569jbAKggkqYIugHy&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=bd1U59R7U/.../0o2mmj4jKl73WGsxAqTj0GgM65y8EeOZDO0WjG6 tdjyeiE&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=BRyRJoh/y8xdJhjr5J4oFkpUwZQdZXEiMrr43mIBok0=&c=IchHNjfZm3VjVuAFec7syMWd BBaqct93JfTnlQZIvagqv0jQPp vSJyw0WecQ/7b3O3R/.../NGVEbbmcmT4rIpxZ2cwgHt skOjZSxoW B8w&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=HvGbUVtGeghlvCX4D3x2djsVTUBP23xvFXhAVw8ImZo=&c=aV9OYD3U8huqnm7ejga8PjfuZUFKXLn8F6c7yaEaMA/.../4j8g2FSnHcHp4UHNNHhYfpu2Lv&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=D940q5UgLdwvLeodwrRyBig1GD2NDXaIFqWJTypU2kI=&c=AVBMuqtDl oi1P8AEcpzImjX1e yWi5nIgkUnoEul14aWwP4VB4JaowSLwKAKd6m0AWv4jymYU3PEJbG5Z7Ko1Fhd7sKq8wd98Ppko0nKGmyEhs14Ok3SWl3rzeP8HgC&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=TOBvVeEjFprmzbZf8biM/RRwQ7WjKuMSlnD72v3XTeI=&c=bBC1RIG6O23S2uZM3zPhZMsjbw26mxm1o1gO9AJZFrkQHQEY8Y0TywsqyjZ4VplKXeHXb6s0yCDBPF/IFVKEBxppooLzb/.../SrCZYvjlOX&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=ocB6wfKYWQ5KAfoBUqbB67NyAYKnyBiErsczY8sl2Pg=&c=BQuxt6t8fisPBmpQpYzbae1laZ6XmdqAZksrSle69X8zXOCl 6wdIcEN21Xtu3ElL1oZoZJLZnsXMhpDIYEdTSRgAnvFigGe5U536p6 144R3GSG3XS2ndxQb2lwuJwf&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=hIrchy3cqx/GnGb6wWmROn47jxPtoLsXoufyuMqqMFs=&c=Ss3Ykuz5G/maQSg9gNYBsF1AogH6P2zSJIuVBelKeuE/.../OPXAEP8Gm3QLZD7qQ97LkdY B9Akg8iqFcc9FaJzeC9Id4rc yLSPrMk5C 1a1omZzV10KFE&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

Remove install-openoffice-2.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.