home

libreoffice setup.exe

Getetese

FlashFunnel (New Media Holdings Ltd)

The application libreoffice setup.exe, “Getetese Setup ” by FlashFunnel (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.guardquickbyte.com and multiple other hosts.
Publisher:
Baheb   (signed by FlashFunnel (New Media Holdings Ltd))

Product:
Getetese

Description:
Getetese Setup

Version:
3.4.1.3

MD5:
bbb60fab4e98cdef8e78ed758d924bc7

SHA-1:
f5007a529a56cdbaef877b2123562265e7e0d331

SHA-256:
4508d4aea6cbf53c28d14eae4fe0f39e014f0fb6543fc70ae350586d71b97d9e

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/27/2024 4:36:23 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.4.15.3

File size:
969.8 KB (993,040 bytes)

Product version:
1.7.7

Copyright:
Lite Fast

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\libreoffice setup.exe

Digital Signature
Signed by:
FlashFunnel (New Media Holdings Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 1:30:20 PM

Valid to:
6/1/2016 4:03:11 PM

Subject:
CN=FlashFunnel (New Media Holdings Ltd), O=FlashFunnel (New Media Holdings Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121DF62995B705C263C7C1BB644682A9A73

File PE Metadata
Compilation timestamp:
6/19/1992 11:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:nQMaHtCHqOdwKlKtejxpBs4NIcx1Kz3c/iePW5ITSG/jJGvJVOivKL+SNkihszMK:nQMStCfdqoZs4NIciuMg/EvSiiCMa

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9321

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file libreoffice setup.exe has been seen being distributed by the following 9 URLs.

http://www.guardquickbyte.com/c?x=uoripurGyf5 L/mRgR8 EVVAEmyjkDYS/aS9lsBiyGw=&c=Rk/bXB6xpJIlacqcVwkGT0Tk8iT3vls3DYZWjcOs0tHeoDt6pu0exGrosMY/OjAKAaeOK7qBGJDfBS5FJj0 x1bySNVRQDo0unpBSd8x2behq6yekZJvcvo9Gy4IyM07&downloadAs=LibreOffice Setup.exe&fallback_url=http://www.downloadfree6.com/landers/.../download.php

http://www.capitalvaultsbits.com/c?x=0KesHQq6BbTIo0wlVh3rbPq0Wsn7a3bdL3CwiXHEc04=&c=hwOiThGWsuqPUxF2ViaFwZ1sq3uNwDySTVGWpjQp9a09H4mQ 3RNPbXAGxEJEygwJtsiLXSyZe7op4I5fBzhJMt2u/utE2fwg0miZURw5SYT4O2 O Ty58hckC0AIE71&downloadAs=LibreOffice Setup.exe&fallback_url=http://www.downloadfree6.com/landers/.../download.php

http://www.capitalvaultsbits.com/c?x=gI9nYk3Mia9PppLBB8Wh03VwPJE8x2NXhoZy6Kmj6NI=&c=LDycjZdkcSYpL1jn74oND2zE4FpFNQRLeat/LVi9eE0wifF0oBBOGn0fxge0G/I1PShKFJ/GC/rfYJ2tYjMiDgSKRC7WQ7GUAzNIoFGjvdxd/PPXKZxrBgagtGfgVQNi&downloadAs=LibreOffice Setup.exe&fallback_url=http://www.downloadfree6.com/landers/.../download.php

http://www.todaysendsoftware.com/c?x=2Eti2z6s7brnqsSiDUw9l4xgVSPAQB3StH4F993w/xA=&c=Sd2UMJsXxPzCyD/lv45kJfaSLKFxEZR3WWBVC8bTq0Ct02 oveJFYml/xvv0bmyutII3rd0h6duD84AMtom6nP6C6WkeQaXKfe0yE/r9qyIkEHGkVBpesZAk8RJ4YGYa&downloadAs=LibreOffice Setup.exe&fallback_url=http://www.downloadfree6.com/landers/.../download.php

http://www.capitalvaultsbits.com/c?x=cNGbeB8BegQsxn4yDuU4wItStJcMbTUp414Q L0sF6o=&c=aOtJoviEooYQVtK3dp1p3iFzVJPA3Xn7yzhbB4k7W4wuu1rUHF7q UzANqdOAe5sYSEudYK4z2WXIylW/gb5MqS8UNQuqSdp71lkg7P5nMBG6qKVlmjJPLe3pbB A1f9&downloadAs=LibreOffice Setup.exe&fallback_url=http://www.downloadfree6.com/landers/.../download.php

http://www.capitalvaultsbits.com/c?x=ipKs86 9a9XfUBiFJJ1XLE0PTcgnMeseqSulXuDj Kk=&c=bNSPlOaNXQTtrDpHu/woohaAwvuSDxCSyiWCp/BmzDl0/xVCgvRHna2qnTbPX4Cust2C6CeJ/SacsoakVo/txkpCA PlJIQa72XcqvolRMATZyPH4HNth9IfgCmmdv2 &downloadAs=LibreOffice Setup.exe&fallback_url=http://www.downloadfree6.com/landers/.../download.php

http://www.capitalvaultsbits.com/c?x=PxcBUSvnJPkh2KGVRBbCcrbkYH4YBcta2xGya1U5MF8=&c=r9Gx2XgTbU7iTMIrldt4POwTcQibKxow2ijN6YVTk8lS9AeS44kWchhSTFZrY5sMKfQFSxuzgHF7KDDcWokBySl9iTZSPvyf5qWCqzaH88 c9N/yzxSdEzNgpg1sRe6a&downloadAs=LibreOffice Setup.exe&fallback_url=http://www.downloadfree6.com/landers/.../download.php

http://www.filebitscentral.com/c?x=zfmXXrhxQ/QQadKltL/wOSOOlrFP44YKCxuisVkGD0c=&c=a d1LuOKlWn/hEooamABtAYXAw5D4j/3Olxl5B5/b78DeEidxcJzvYamu0UpMGt0QDPjsYE6apfeKR avlR5Sy11q vs2M rYbb0FmscAIFcyBR7rXhvvhqOiBZSvoz0&downloadAs=LibreOffice Setup.exe&fallback_url=http://www.downloadfree6.com/landers/.../download.php

http://www.filebitscentral.com/c?x=XI/g2bqMVGFixthYFLXy4 UMoIECEKIH7WMlQxrw5nA=&c=JSFN7mLOdtgArM2Uwq 12G2ZiBl1X1x3/haU7fxvxqJ0z9z 7mK8U99giNBd 40K0CDOih dLOxmcCqm49tB2dkS8vUyjnB718e9q9HNeQDjom3XNTDXE58tocuQAo8H&downloadAs=LibreOffice Setup.exe&fallback_url=http://www.downloadfree6.com/landers/.../download.php

Remove libreoffice setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.