home

libreoffice setup.exe

Internet program

Agile Funnel (Alpha Criteria Ltd.)

The application libreoffice setup.exe, “Internet program Setup ” by Agile Funnel (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.packagedownloadssend.com and multiple other hosts.
Publisher:
Web Program   (signed by Agile Funnel (Alpha Criteria Ltd.))

Product:
Internet program

Description:
Internet program Setup

Version:
4.3.5.8

MD5:
4917e1022313f67e08a6a696ebbac56d

SHA-1:
0ff6a988afd79d971a95d4b76a780b84abe2e623

SHA-256:
f9909d5cab8825e6eac622be7f8f350828b581ddd2bead0356f047d5893c8455

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/6/2024 2:23:12 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
15.12.30.4

File size:
943.7 KB (966,376 bytes)

Product version:
5.7

Copyright:
Application Web installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\libreoffice setup.exe

Digital Signature
Signed by:
Agile Funnel (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 6:25:15 AM

Valid to:
9/2/2016 5:10:29 AM

Subject:
CN=Agile Funnel (Alpha Criteria Ltd.), O=Agile Funnel (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121703663FFB88F568A112BD801328BD38D

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:S5PtGKT3T947xcWA3V9qAS98gFN4fDjibF1vS:SdlTa9hAl9pSbF48

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9273

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file libreoffice setup.exe has been seen being distributed by the following 9 URLs.

http://www.packagedownloadssend.com/c?x=R1eGlFUvDr JVVfZ4uMiVdqtyQKR4vhp0O1U9I00Dmo=&c=LmXewUpbkK8aR5lBETTWHnpYv2VQoD0PPyUu/7OhOLJI2c5CD6zz7ExvOaDutrf/w6hnz1CWpGe8dIzUUTM74S9FtHoXLyq6KUyMfyunrYqc1YthGuS4mIwVinw2aUwCKs2QqUHdsFk5hi8775co0g==&downloadAs=LibreOffice Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.vaultsfilespackage.com/c?x=6/uGFjIxddm/c6A5OjxAZr7J9IPy/CNuVF1XYFQKVco=&c=zaCo0xH9q49zBGnRVq5lW3JWYQJJ7E6kr686ZxgxqToqLNOd4bWGjkqN aUJ cBeQ5D1h1YqHBpf5j4hHKva89uunJTGNlElAYoqeGGU43qqNLx5gtf2dxLW/7dMkK0HI J1KA3ex/r1EUW8TgJzAw==&downloadAs=LibreOffice Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=kIMXEoGw9TQPyeRcIK3Z9sIHNe 5SIfA2TDfnE4wMZc=&c=Q2lJmimqott T5Ex0FoQFqzD9ijwYcsVk6gBtudZdXrrWMYVRmCggl7nnTa4On2pOhe53BwzI wIzKShvDYARSLDgw0OCU30x7OOiGEsHjelDO39r7haP JG5Qww iMrvjTy logD PckjfE82adZw==&downloadAs=LibreOffice Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.contentbinariestown.com/c?x=5ytrKKvdjuAWdVw xJdWwfVSvsMpQv3H0aIgpur783A=&c=fZv0laxaT2Y4Gdhc0jE9zDZ317a5KykD/vbx8IxEjgQ/3hG28dvrcseq9tMIzths6k40GP7Kv8jmWfCkl2zglZuTDLmCzijkAbiQaFJB2HPp20inEuomXUJ8DN2kSgZHPJpC3GlvFxZultHcBHbH7Q==&downloadAs=LibreOffice Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=oJj/3RilmXZsT36S0g4BgvYnogQxTRKZnxa/VGN57QU=&c=2LjSxD8WbJyOTQnrA73CAM1o0SbT5303zrn4FubRp9 QpcBbvGfZrSlz2MrBrqTjPjD3QfiVVjKpMXY6bhhVHPJhnNQGcjkhVZW3zAHnsa/zIYeImBs2nOQofJ/95g2mkXGkKH9661o aqG1pyfxPQ==&downloadAs=LibreOffice Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=A3m86i79HL5lgQTCJ1t Q6VY 8p/AWvJ/H3oTVE/yw=&c=T2qBvKv9XTcHtF6hieK 8WycsJUwPtlBI0/SCKvACfbhW1mi iUfM4R5aUR9RNZzayK97rCjieKyYvkINnT W6Bd7vDuV8QIEmxx1tYZVokoAKE2w3jmyLfM10dTQ7qGLbCusmbIfxuAn5dsravzg==&downloadAs=LibreOffice Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=E5LPbTBtB2/ww9QMRNvNUD1A4MVIqTBeEFtFlW/E2Fg=&c=JNTtV7uPQjRabMwbVooBxlfH GE3vuND2pJDWB6Djydn1ULW4mXDJa1qVK6irm8LJ8 KDqSE4UhYS5qXnqxK76lf69LaZem5GypfkaF/8eIq3AdRa1VLUyc4Z6wZyVtqOfnDEycF1FgFiVoaHr4KLQ==&downloadAs=LibreOffice Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=Wn6iRvKoB8nRJMLjuSfgaQ5sr7EHwMOB/SJbvVvPPXU=&c=7xlMCFCLDkp8uApl5WDsfHp/0eKu3Qopzi1akOBFcuAc9OZ82BATzAe8Ntc8MRpNBGt2UvVAf51a3ghnnwERjTbaJKzsDXAsG02QLQXthjKLRh3bj7ufKmgzT/hZZG/JLJ7CG9zXm0ErS4l0q2oXBg==&downloadAs=LibreOffice Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=ZeFKSQtR9BWY/pGhBvaY80IhxcFzJO p7AzEXe3lBwM=&c=QwpU1McIawFGixhoWD1zmx05fzfBpaEMg5XWZ/YbePPQ3ayXyrJD9G0kirPFjjB da6eaAvMo6kA6Ej40Uf6MBGpCsMeWH5IHH3EW2WwxcniMRXp0H/mQ1MI7q1YEw571BZ3v8QfvVxjThJSQaahvg==&downloadAs=LibreOffice Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

Remove libreoffice setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.