home

microsoft-word-2013.exe

Cagolig

Destiny Dream S.A.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application microsoft-word-2013.exe, “Cagolig Setup ” by Destiny Dream S.A has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from www.nowfactorymeta.com and multiple other hosts.
Publisher:
Huful   (signed by Destiny Dream S.A.)

Product:
Cagolig

Description:
Cagolig Setup

Version:
3.6.3.0

MD5:
462fcc51716408b2c500bf30c1e7b39c

SHA-1:
0a66044af7f58bd0c4b9c702784e6ae4030f730c

SHA-256:
794052d335ea425f74308620b41b7f22679568cc0fcc1063e45e7ee2dca9a060

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
12/28/2024 5:04:24 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.DestinyD.Installer (M)
16.4.13.14

File size:
989.7 KB (1,013,448 bytes)

Product version:
2.0

Copyright:
program

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\microsoft-word-2013.exe

Digital Signature
Signed by:
Destiny Dream S.A.

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 7:55:11 PM

Valid to:
10/2/2016 8:36:18 PM

Subject:
CN=Destiny Dream S.A., O=Destiny Dream S.A., L=Clarens, S=Vaud, C=CH

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11217A75EB912AE2167326222C18D9E2357F

File PE Metadata
Compilation timestamp:
6/20/1992 5:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:go9v/Sb8ISdMPNf/kLkfz8HF2+7jDBVCyP39KvlDVJx:g6SkaPNXkQfziF2sjL8l/x

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file microsoft-word-2013.exe has been seen being distributed by the following 10 URLs.

http://www.nowfactorymeta.com/c?x=CTdUVwKoKh6JBMkXdiVbBB7MkiW8NnNBhIiUiItqTG8=&c=4/rjRzzwrKF41gMKjXhISBdAKapIbdhm9RmxXZJ7OtqHlZl Xgbu8XjKIiuZbiGZJi g8x39huraMXq3DWbqLw9 pxszNorszmIMX HhhK2XEwU5Lx22DI9bAh0ogXBHU/vR5zzPhbGtlxZeYg2lm5KCLG3gBMUkVBau2CYIu7w=&e=0&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.nowfactorymeta.com/c?x=WQKq0uAtsog5/Pfw1vBWx9cFizIICZnKtGJNmNLyP5k=&c=kC9AkKUcvQSnGyyT PlzPMnR4frNEWelkaXgGUCzuiGOZ OFeNrpFzEc2a3CSoGzam2MDT PLqUBZYBXrlLcpqGhqPJyW0olc51dZj12AvG1uLzZ7h4DxA4vlXiiBu90Hvk3RzeHb34rXB8vlHiTDwvx0SFnURHQOhkzbo7hd2s=&e=0&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.centergiftcontent.com/c?x=He 7Baw5lSaJ0mBzO6IPu0ojCdcSuEMqnbTiO/FzDh8=&c=akle2abpfMdvFKrVeyGpPNzFMnaJC5aUPnR QyNTgqTlsGL1S 7ZEG5eL3Ul4aKr W6YKthrleXwptoItQEH65Zoh/aywlkwSo0QEv7viQFIj5oKmrW3DkHFX1x1mM t3nNajS8RXNTkNJuSwP9JTw==&e=0&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.centergiftcontent.com/c?x=RJMbosdjZJvz13DY1J1fyE Rx8rqkxNGnKGzmmv5L2g=&c=0y5HyaHYOU4OpJBw4/xNpKAcBM58t DBWz3WaaNCLAwI5dGC47J1OpYjJH/WrIhOQwdJVDQ8041T4Ta6flEJv6go81QH33KMjpkAbydI3F95sSZjVVt8BmNoYq/nJeOvM5yGevqTMjlm8yMSrV7JhNoMMK91VoiQDITFiCJyrkYXVfovCmNbTP50WzvtTlOJ&e=0&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.presentfuntowers.com/c?x=uXv 26n8Saw9FueaPGPbOw/saEHYYBKGyLMgk5H/Yxc=&c=LfFA2xtUjzLIFEACK72Zvw7HHHlGjByr5KlYb44CTwRAgaROIxcrc t05mZnS9gPTiTNTL UXXsM29w ZLp3IaW 1gqjfNOR6eWz4A2mnkm6P47KO8XeGzfhlU/eGYE9aC6/971In5hyW42pHbTdKbqTEB JN2sDr/MmEC3Olxs=&e=0&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.presentfuntowers.com/c?x=tNf/W6GkFji9PFYgO1w9XKuKP8RbTSgFZBDJ5D 7y2w=&c=h 8FCtDJ4574SUTIGBhhb5SexJegtz6Bu7rkqxm1h9U6AbFwRd O75gjfX7RVta gO14bWrCRctspjRoYXJNUZAuIfUunkYiy4LAUFiQ4Ckgz0S8He4XfHEhXaSSioj Ls2gR9aCatYVYxcr1lyV9je/PbvsVLLU4j3Cazq3mDa1tJZQZs3y5uRYKYBW9HuP&e=0&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.centergiftcontent.com/c?x=cCVj eggfPvgUc2ub3vG5OPs8I8ZIoW 7xSDNi5sF8g=&c=CHmg13GamDTZgtmhdBPMI6kziPJiPoYAhWVST7A1H1K6m2o2BfPqDIFYTZG XW1JnTb/XcAEsaggoptIEvOVzwWyLuftdGmz45MrjA5aWDHAMICXO9/i26x9rLdwRds36rord9MyBF/r0sl1nzMLoyQy9CGIb2FB/RNFuZg4Fdaok5Jz1jJhvMuhRCEtjvI &e=0&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.presentfuntowers.com/c?x=CPvd6lLmvVfnnWeQXY75dC79gONdj9n1TmclI3TMcKk=&c=nf8cbs3lHQ85/FsJ4ZBxh4ttiNDc0XWXgE/x6XRyvuoyF11ropVI8H6/qLpukgaEdxexriUYfR4Ks1Vu/c9JxwOJVU/Yg3ybhffU33jeKAGWIRm9iHxbBh1hzC0uKpYJAQzoFg7zYOV G3jWTCsQ/NlAD3dnIMbgBSVLJnTxlHm6T5f/ZDvwpWYI xd05viI&e=0&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.centergiftcontent.com/c?x=a9qpQgZXvb4Krjl2Vgt9lGdiJ0A6PS1xL3uqvzyuiZE=&c=KE9b/IXrTkMhIzsM4qIdp879 aqYBeYFLtABJd3jaLvIYoSZs rtq2vLJYJSMmoOQqUkiMCCILS9IJY5HEGk OR/lg3ohjRZ0ydJnRxMMHDAAK80y YZmXQmuzws// 7PCGz/eRiV8bvzomSQHUCG543uX68yaoVf1qtMhJagBHeKdOce1EbVgVKopD2ByM6&e=0&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.centergiftcontent.com/c?x=KYSZVnAJEuE7uBpGMtRcFQ9T8o6Q4ouUcFMHD4mbKio=&c=wlNmIq4xdXzsfw6zvLvTql3jb8XobWBEL3VKkZkGb/aPSsH1GkPY9kTknUhATI4KntFOGBo5cLi3Zo3cLcEpwB6 9m q/NAUCiR cFxNLF0r2W6JThPGQK9jlWEaHBNbS4hRJeJApoCTfHihBm5Baw==&e=0&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

Remove microsoft-word-2013.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.