» install-openoffice-2.exe
Overview
Analysis
File Details
Downloads (14)

install-openoffice-2.exe

Prog

Cpc Net Advertising LLC

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application install-openoffice-2.exe, “Prog Setup ” by Cpc Net Advertising has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as the free Apache OpenOffice but will also install additional software offers which include adware, PUPs and browser toolbars.

File name:

Publisher:

Software (signed by Cpc Net Advertising LLC)

Product:

Prog

Description:

Prog Setup

MD5:

bb803140bbc40d79a7b5cbff44aff714

SHA-1:

b02f31b50ec9aea99e7c2b43f8846baacc54e04d

SHA-256:

32172bd659732da99ac391f1b0b90a674b33cd7555c70d38f328f6db034a884b

Scanner detections:

1 / 68

Status:

Potentially unwanted

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:

This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:

11/24/2024 2:26:49 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.installCore.CpcNetAdvertising.Installer (M)

16.1.29.11

File size:

936.9 KB (959,376 bytes)

Product version:

3.0.2

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\install-openoffice-2.exe

Digital Signature

Signed by:

Cpc Net Advertising LLC

Authority:

thawte, Inc.

Valid from:

7/1/2015 2:00:00 AM

Valid to:

7/1/2016 1:59:59 AM

Subject:

CN=Cpc Net Advertising LLC, OU=IT, O=Cpc Net Advertising LLC, L=Wilmington, S=Delaware, C=US

Issuer:

CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:

2BC1DD7AA35DE89A0D5276ECD7AE32AF

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

12288:KJ/p+GXEhgJdYvzlOCerBhHfKVSNg1qtEz2nSLML9423mL8QJk6ZFGRjmOtYfqoa:KJ/jXtQ7iDKM12zF5k6ORjFCJCkj6

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file install-openoffice-2.exe has been seen being distributed by the following 14 URLs.

http://www.straightarchiveslist.com/.../1PgaqY7wfK1rgplc&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=4iEE8D5nGXg2N4kjpfeQTbRBN6DVpyzV7 aT9nSbwbU=&c=A6/wH/.../r0T9dd2C2p1DuihbuwU9y5rTOu&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=VIRsjEWD/AhVgNspTRk7jT DOW/kVU7GpfH/.../ddZy1rd2Gt1RMklcd5ZxVNA5gR8Tfl1ZbgirUqzXRbTFhKDVs7YEtl3l65rJtncvcyFlr MVYt qL2um7yQEMMxOB&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=gbKnAsAJcmegczhITeTZaoTQx7NtPY8iVAUREAA Cl8=&c=WlYXjfjci36 TtVfSwq9lCaGAlxkTsIsNPjVz8IkZqnBWSFgZKe7i2StCe9f1Q2q2j58YltvSGT9vE8cJCXvHWJnfPkzoa85ovD BNfR GrEx6X646M90BfFc6pbuHB6&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/.../DIsqnNkQl9T3O5DipGagSIBYdkVUHG70rgIEOJ26zjv9I0T&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/.../eXhi9cc85Hy&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=pcyNRdwqbJCaNO93ObwWrNoz5/4Yknty1t5/Get4hoQ=&c=vwYDzND/TJArZG2imFiqMN4f2B6XCGs4ciXMA0k tAhHfWyfPfp7AhpcakJmUqqnSzrbG6MeCA4Cv/.../zkGmcnQOfaF6nQ&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=CKnp/.../R9aoUS0aF85e9Y2T1EDrzeSn7SQ=&c=t5RzLb193V5G9Zb ljI8QkLv2mu39muMEiAfxiTanR9Q5biWMtz3cp9zku5wIWhGMUEU3crc19RFpSgishpRY0OEl1WAh20O J0Vm lAs0dqA9YJXCfVApNeKfprGWCq&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=GOwLpKayL4NVPaVXdUeQ1DdbJlGAFBiEe8I/.../OlvLjaVVh8Cm5C8bfXYwPMbyVm6m6&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=N58ReMHKuUjFbZ7e1tkUI92w9JSOdHFEts0a9gDTKWA=&c=PqpgcU/.../wCea&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=ohbspm0cn3ivWR6iUp1s2jHqRYlqz/R1ZcY0BtJdQn8=&c=Y/.../0YK01YFLgkmEQIFFeY3YOFfGbVn1o1E7vh3wwDtxhCSHM1abOwu2dD&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=07ny3sKq7q pU6pfCGUv0dHZZdZpxIxCvpq2FWlpV U=&c=h2UQvsMGORTrfOx60DyjSHmtPTzAfn8lh5VmsWpWUVZB3aOMqG8ZhbwaP36GY3xlfrEl33gGT7bQK6iZUrloxYNs5IU8jj9G8iMNCMCRVAAyL90E/.../DGcV&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=moEHP4vd9XP5NhcdBMxStMDQklQZsVPpAaW175OHYug=&c=MbXToNkJciMz8n6HYZkzdrK3k2Tx/.../HFemaC00EdzNX8bks qBwrFmkgt5ZjTQRt&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=UWZYDL1fI4kgdaeF19GFY9kuOdHJXcbuTGWyv07JrS4=&c=rOooLF RgVILuNb2hMBXDZ/.../jqCDpJ2K3yT8uN3 6OOa BtF8CyaVGx5yJsmP15ZgCJQ6BwltbapzVh8rzuX9vYR5abysa05c6hkvGR82WR&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

Remove install-openoffice-2.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.