» installer_openoffice.exe
Overview
Analysis
File Details

installer_openoffice.exe

Kefesun

iDEAS SaaS SolutionS llc

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The file installer_openoffice.exe, “Kefesun Setup ” by iDEAS SaaS SolutionS llc has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The installer is marketed through download protals and search ads as the free Apache OpenOffice but will also install additional software offers which include adware, PUPs and browser toolbars.

File name:

Publisher:

iDEAS SaaS SolutionS llc (signed and verified)

Product:

Kefesun

Description:

Kefesun Setup

MD5:

9d48c78eaa62c3ca442e6e56aa28647b

SHA-1:

aa92d998d908aaace87b327e02be7e4c4089325f

SHA-256:

524a1f7a23ece2bb01bcfb4dfb22b7e90e70322689b9410568bbfd0e10861010

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

11/24/2024 7:39:13 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.CSH (L)

17.2.23.1

File size:

1.1 MB (1,183,040 bytes)

Product version:

5.1

Installer

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\installer_openoffice.exe.cq3co8r.partial

Digital Signature

Signed by:

iDEAS SaaS SolutionS llc

Authority:

thawte, Inc.

Valid from:

6/10/2016 2:00:00 AM

Valid to:

6/11/2017 1:59:59 AM

Subject:

CN=iDEAS SaaS SolutionS llc, OU=IT, O=iDEAS SaaS SolutionS llc, L=WILMINGTON, S=DELAWARE, C=US

Issuer:

CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:

79D211F28048FF1D5F9AF47B0585960C

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

Remove installer_openoffice.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.