home

install-openoffice-2.exe

Ganimicip

Cpc Net Advertising LLC

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application install-openoffice-2.exe, “Ganimicip Setup ” by Cpc Net Advertising has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as the free Apache OpenOffice but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Cpc Net Advertising LLC  (signed and verified)

Product:
Ganimicip

Description:
Ganimicip Setup

Version:
4.4.3.5

MD5:
9241afed97029892c71aa780da7e066e

SHA-1:
b095d95097fea8e23e0759dd3a8842b3c7500907

SHA-256:
c928849337608a5e64f3a9110229521ea1c2083d234bae357c9090a3a7b52b58

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/24/2024 2:56:07 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.CpcNetAd.Installer (M)
16.3.10.14

File size:
1 MB (1,088,488 bytes)

Product version:
5.6.1

Copyright:
Internet Program

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\install-openoffice-2.exe

Digital Signature
Signed by:
Cpc Net Advertising LLC

Authority:
thawte, Inc.

Valid from:
7/1/2015 2:00:00 AM

Valid to:
7/1/2016 1:59:59 AM

Subject:
CN=Cpc Net Advertising LLC, OU=IT, O=Cpc Net Advertising LLC, L=Wilmington, S=Delaware, C=US

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
2BC1DD7AA35DE89A0D5276ECD7AE32AF

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:NwDrF+oZYaRHGWJ5+4rfYRu+3wLoiaL8OzQiHB7CTHHA:NoVKaRHfJoiYRTwL0IOBCTA

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file install-openoffice-2.exe has been seen being distributed by the following 16 URLs.

http://www.straightarchiveslist.com/c?x=lUQgj18IbPVGk461oxDvKeybe4MxgvhcUwccrv3TpSE=&c=TeV6avxSD4FC5dfCxPA9gmCVS22RfRopsuL1I5f1TCJ8Lq9IfnI/r/.../rc&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=0zhER7d1zDnrLtJpuzY3TwZyg5GQjmy/N3FSaaAAxds=&c=cnFLJyEvdoRVCJzTzzVzWVXeAy8X1000LCRiTqwi6k2wrnNg0hRAfY8eAkE1lBSTw5ieC/.../N&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=8MuLjkDEzikhknPSA846zVhb12RX0qSsnY1oR2sWx3g=&c=LXSP0jh2MkvXMQxYnHtll5JwBaUJebRUPPGrncZ/fxJMxoPVOkntmG5m/.../8CfVoONUrA5ti5bqKVU62hUTpgjlDGL2n1SJaDYLSR30NprXH3t35aZsh7yQmaRw2o40&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=GwfpGLmDOQm3eG23B8ZCBF9qlC958gKM/iWPcTwVJio=&c=JuzJNc9kK0AJNFNMdUNHEQdaC9HkL9Wvnt9K1OBcYlFIf5/.../CoFpJRJdXpCoNVL6y1N1pT74ti9R2SeqDz15e2hqNzGxIZWCS9ODZ0 2PdbOGZogLdWO4&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=JDHuBUIVEIOJjQ1J7GKDaKT8hrU xuLInvUKYCV mhM=&c=Di5vVT9HGSifcYbmRX T1Zy1z0H4qMZKQsETvCV6 29xw4lT5AccRxLlzEwyPWJeef BvNRdB5ldbhea5hYF5zTUGy2n9yJd 7hk1/.../qTjcy3Ns&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=4qXnz7 q741Iwm49riBDPqk3jB Ze0sWdgq04i3sy5o=&c=IHLGOjku9PdNCPLZ/7uAJeP lPsHOFUTfNUMbi8qRgFxA/a3ZarAxSS3V/B1lT2LZW6Al7GLDdQEM1r/RI0KA 58A6TK2z2YGRUoszAYo6wpKYmWoPE/.../&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=za1Vo9MEXTga50uVBEmqR1K3LXT2EZnn8ipm2DUYAZw=&c=p5ylL 2E3gTHbymY6jEM /.../ay&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=XQGsq dZBVEWx/Z9mSJ5M1Aq2nZNg5k0Kpw l3kkpgg=&c=Qy rJ11e0wbh33 Ydyp5f0nAgtvs zyzUNMrUMsoMEMmyXEINxuKBJi1A5p/.../DkZhMUdp6aQneAZurqfgrbBUSYaHN wX7fXvbpDqzQxjEBP7ELfybCUC9QHVWp8l&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/.../iHV3tP66tFcc&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=70e2yPs7wOHiv DDl1LQDu2nE8t/LvDCatM4Eep ApY=&c=KYHf56IvHLp UtTAagkcf2KL7zXd STzObIMER9aGzEweyxyZJKmScch/ 5vbPzVGisIU3hH/.../n8N5Slkh2iCe85TzdN3CEZow8plIDUnMcgv8azg0Xv6A5sY6goB &fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=kNlNTeznFxJHaCmhfC3Pjx/.../ItspPVdKPJijmvXflx9sS06isQToBnKuroprEj6amWVG8 aZ4BD51ggWepoIES4oVXqF &fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=lTtjwC4etWsJhlgxL7rMnGtV2hB8voylm3suBhbJufs=&c=uV9Rd5z7SyZjzVAZ7Di09Yex7dtXud obtrCv /.../4UycZRLWWJRyCXk9a&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/.../MgttdjZ9UocFbDbXXDpiSguTWXCefEJtUzyyVIxUIvbM54Wfd2xWrhK0ACRLhfC1aOqOju3N&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=yfymGrrn65c7Qqiin9kqkfPZXmndedrvouJUuqsoBDA=&c=QpJTp RqM6vpdMqxgDsdsSYWDVqgVKEEmkakVBr9y9q7TKV8w4k9fTryu/J IxcQ/.../XpYTvccbj4oBKUP304J2&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=INZlauQvL2SU6DcHrJqgVuR8r81MofQLEEEzCtg55vo=&c=zzfYMVrhfoWKbNeGWGi5JfSjHuWwFbw6GQpEO2APT/.../uG8ojY 4x8EeMS2u45HfeC0um7WL8HO xvTFFfCPzOElyrgGaB03AwqOo&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

http://www.straightarchiveslist.com/c?x=K FKVM3Mha h8I/sRJH8qp020nzR4Wxk3uAQtgyGfHs=&c=G8JiOWCvzE8PrADXRZfEOAU3Iq7nATBwEo42tb9sMJsCM0A pXcB7vix5f/.../TQW0yYTwfSmsaiOrgZV1kEB57UP0fdHGq4i5yPiw7FDUy0ZXkibakaaOwJ&fallback_url=Fallback URL&downloadAs=install-openoffice-2.exe

Remove install-openoffice-2.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.