home

microsoft-word-2013.exe

Lite Application Program

Destiny Dream S.A.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application microsoft-word-2013.exe, “Lite Application Program Setup ” by Destiny Dream S.A has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.capitaldownloadsdl.com and multiple other hosts.
Publisher:
Destiny Dream S.A.  (signed and verified)

Product:
Lite Application Program

Description:
Lite Application Program Setup

Version:
2.6.3.4

MD5:
f0d345bcf3db331792d2adf12b9e7016

SHA-1:
88b8cf08f86f9b5985fa631c749955f2434c3b80

SHA-256:
702a9fc78f21763fd12c1841d5627f3efbae5a7dffd9ae7dae41a685ef74a2d7

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/27/2024 4:30:42 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.DestinyDreamSA.Installer (M)
16.1.30.7

File size:
996.5 KB (1,020,464 bytes)

Product version:
3.4.3

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\microsoft-word-2013.exe

Digital Signature
Signed by:
Destiny Dream S.A.

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 7:55:11 PM

Valid to:
10/2/2016 8:36:18 PM

Subject:
CN=Destiny Dream S.A., O=Destiny Dream S.A., L=Clarens, S=Vaud, C=CH

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11217A75EB912AE2167326222C18D9E2357F

File PE Metadata
Compilation timestamp:
6/20/1992 5:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:JC785XIxQtkqpdXowE87p6MZtwiXa9NILu4uqf2aI:J+sIKDfXu8MMUiqTIa44

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9281

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file microsoft-word-2013.exe has been seen being distributed by the following 22 URLs.

http://www.capitaldownloadsdl.com/c?x=RMV0cHQE7VdtyKqSjp4GyY8e7kmZxEQcdHCKFNazxtM=&c=XWVFFqyNLA3vxegrEBTA5AWPCfXYHrUx8eS1iAcI34aNeLJiSdQXI6d28cSHTZL6QXEpYd33lqLcvV5n3LAYcbLQg2H162S1qJjLFBZzDxHYiJPAR8KpFXAkOaqmoe/VLgDTAC1gYnESvlMvcFj79Q3C kX8GEiPKOIcUWMg5EQ=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.chuckleflashdl.com/c?x=iXBA1f3bmqk6k9Ad1NLhmfO58jDgZ6bhEB6dNZScfCE=&c=a/LzINPzSCeu5NaRonCNnuAH12Dk H99Tv9swOznlNGuDPIGjlSRCDxZ30l3OcyVglwjiISwQHbSYUIdp/1YEeQ60Y fbfqAXJk EQCH5aU/DKyCb/t0pjVdBdm4uz8SJ1cYdXNcVD dZxr0TKb7EYCFB1ORjg9437a9F5nhp7A=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.binariesappsconecpt.com/c?x=Sh9uMomS0kyCEkkw2CDLgn0fhX5rJVgfDAEoKrnhuLA=&c=ibCcH0MJkiuK/Urdp/ zdR cPbaAQNnj8TJ5v/deVpcYCkaUZc8QQmNKOovgkrGmIwK2HZW5uRpIn2stsZO8Tou98jvwwDXeztC1 Ubo2L0e0EZDGDXW5AwcENK4lzr3umr86iQFahxeCBi jGwH NbTQCbCxtsYSsjdREIurA=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.binariesappsconecpt.com/c?x=I/woL CHOB9XlyX5p1CTGH5lYPy7IGmt/9RTtS2vqD0=&c=QlXQNzseZtF/M6AF7SVvzf4E/qU wQXnzpQUzegLYUc7m83oBWU5Cb79OfDE42U1kGJ37eqh3LyQleMjwIgNxyK2uyiRHx252hb1phZ7jDDsmYAHrzym0i21VL3FcF2HSyFuksli79JL9/i6ZAuVokNYiLj9MAAuhVdKoq G9l4=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.binariesappsconecpt.com/c?x= 0j4b4j3FiU7b 2PKXySsMmWBTGWDDpz/04thOr7qBg=&c=fRpHdEHSdVvL5oPhRCQTzfzF4jAAcjN8CTKQ I0heyrnbsr4NiYAn8CXw0mICEXn1fWNY6Xjrim0Ovp927G1LokktwL4jfg5g9FpwQ7d20NxcYfK u WLhRqYiJOaoVTwzEBkudLigUnLoXmjO8bNpKMXqmGEpv4PUbtMMxhjYc=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.binariesappsconecpt.com/c?x=11DwdhcMv5pjy6FFR9Zbp6kuVN9U67/G JBUpkM3 ew=&c=u/oxGl9JRrwKV0q1hA 39 5jb9q9PX cacWAo/UuIlloZrnBEdRhQoRTDIQHtfCgXQwjSUl1LCThnAI8TvETMOrwVO418cTY6oh8gJ6RcUuvIq0mOyYQQhF 8nF1d6JGTVleqFm5/NvCvpvW6T2rSJLf16iRrThqjnActYmDi Q=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.binariesappsconecpt.com/c?x=gBWF12jpC/GZf6R36MvP27P8E9LftoDfy TvLVohDTQ=&c=8nBiyUE48cwrJb5bfwuf5oZBXviTu3oZvR2S0cgeXXHjkOa8qJ7PcyJhqgbRmYxFcdej/slIsxYcTmmpvTLVtzmge6rhgz9xjL/a rWQVlOx8JJ9bEOYuZznl4ixkCiU cG32DDb9AYPR5SqvpOeheBYxbXhhSuLKsaQAN81HkQ=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.chuckleflashdl.com/c?x=12ZAvZ/yTJu2pSP6Bl YljHyfMiCMAocog6r1VbFYZ4=&c=A1cJExIHuehThta04jlN23aZT2nSb0EUbMxLtdoEhPxXjMctgXlNrVZP9Lw2xJIOKFfxBJ5/yOwkWgEaIrOgs4I5KqEIFc6oNUf0Q1Fqpp1 uoGEjIrwrXpaA5MdmKrqiM2bQYjKW5F6lxhhT4JHPlcQXgCoNNnYwbfLAkyK5gY=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.binariesappsconecpt.com/c?x=olz1ah5nKHgR3NPriaICV8NbhYLN4vdCFhoi98Gegdk=&c=XfEUhRIbnmG8KbQezF1oVGCj7BW1EXdkPxj13gr f1sqWCFdwsMHYgpP9vAjvudrNU RwWWy0bxz1Nj/WQzI5/OoIdXUv Oq2piJasFGu7vdYRkv1GHbfS1Yd4fcJhAYxQLpCZ7P8BXO1xnVA zEYVcPWYnQXb4yxl6ueVo7mUY=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.binariesappsconecpt.com/c?x=fuHH5NthxP883ygfk3kxWt0UrNtMeSbneKSh6Mk4RyQ=&c=6rL6r5Tr0mEp4vcUgYOCLsPeLJZ2 4uXgfi9AyR1OpcwNAZc2An8HDKwwRXKNsYsluNnquYIZ6GLphH/AiWK2UXop/R2UhKBR27ejPIf6230O6eSDjXI9jRLSw0gZpApsh6 5tuXCVU/pj zJieFLsUfsPtmBu1Nb 6amAXVXto=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.binariesappsconecpt.com/c?x=wxR fGyNrA320cuGo6CQp96LfRUKn47vzX8fEeDPeWM=&c=ce41RZsb VVdwNXH2elYz5tZK0jxy28qGNaHb4keRmv01LAbQ1kH29jTz7UYQ0abaYVUYPSiZpCLoQdB1lGJzxSqkFZ0GC8O1McShj6 wGNKWgspvLbCaxRO/IuMRCGR67opgTqcG5AsJyRC3v5cnA6WhnKC4nge K23EanBTYc=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.binariesappsconecpt.com/c?x=0zk15xbTzCwxswLjnX2jjj3kEvQBcTGdF/pHGAxYFTs=&c=kRq7i0AkOfpmCfWTDoCGZQ mRviNTbhXILYMsJb4o8G8SysJjkRSwJQPSsKpWpasfmFcReN/7eF3ymqewOz ADz2S73NFXJJpfzXMOKKEf2qcPiQaXJOsBe9Kz/GowvQsCSgioJk SdIVQnVhq8FqVd0EGm7hLJoWJYwlXoFQxU=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.binariesappsconecpt.com/c?x=qY7YnA01uQ4dpV4wJ4UdVIBUg87ClfI e9U5iXH6BxA=&c=Yu1J 1hQ5woNr6NdWAi8mD6ubNsomFgbibWw 8jdz BjXKbu6wPzixTKxOguwW8YXeEZmCNozNdDk TwzdqijyyEynKvQK/VVqBKB33kSkHTJjtFkEB5QQ1trN186MLEJIiGeqKFx96257195SQJzcNvwbTJlw5KddsYc5B2N2g=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.chuckleflashdl.com/c?x=RrvY6QlGqUkXpFh1Aii5rRyP7G/kE8TAWz35mqzKNKY=&c=DkNxMVWjUNlOUtIB4L HTBV0RQE9AOKV3W qqo84HuLmFBhOJMOSPF7qpghHySPs DubVTHAqf quGCmy3HqFlWWDNdcp8oqZPuQtgpWj0XQLAGnlYoEml00Xc8XhAKvPDd2U5kZmJpfKuzVzzVrH46fQKh0hvWIe9 bTZ3m1lk=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.chuckleflashdl.com/c?x=gd3DbEN8D azV1fIGp 2S6n4nfPDQpdudKzNyK4F54c=&c=jqKkAC4 4qkiWNONIZIK2X6CaF8ALCpVBpU3FH5qeKzWAZVgwny6UAcfBtI5d UcGXxbzu5 ofhK8Q gdO9RHmuzp5p7AdT7KRDzirXBV57yTj4yf0wbnd2Rva/68UzYAKdj/Hlm3rgEZzxAtj7wW/LcXd4DY4y0QoRcXLAG/mM=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.binariesappsconecpt.com/c?x=bMTN3k3rfTtZ3nGDdPS/1Cj4KORm6AVu9LFSPf/oaLE=&c=E/qPDM0PhaR1i/Ze51/M/MYwQwmR3/YOmL5sJYRMr9VI0sDIJx6LgyORWxlPxtzmIYqcdlqo4sENr/wKqgM4nQQU3q d40eLq6LQlSrTp4AEB0JrRiwslOfdsBJpUC6KHguZ7Ih92FtXntqvg9vXD8gOt0OB77LgfpEScwNrvBU=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.chuckleflashdl.com/c?x=p51NpmBLZc52h5qVN/d3satuMmS51v7bl67nFyviqbc=&c=oJh9XkQ2UjIVCiH41s70mpx0/Qy6KZ0h/hALrvaW7NRI1FXKGG/pxhhuTQNYEqZ2K0IuNsAIb4qqX1kgv9YNkjkBHQHK5cmEM6cFeXfAW1MmjvZ6UZwZ1ah3UTbXHv1WgJxzC8uve27PjN5v1n8OKjBIHGh4wBGvmVbFCth0HeM=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.capitaldownloadsdl.com/c?x=YkB fXzL36tzvbMGyM3YrVKVsgySGaEyOKThLR0LQhk=&c=lNvBU85yvgEl4c337E3bo9kMF4YT5KLv9IgsJF4cGYizl6TpxlggPXzcRVKznefxDj7gE1c4Bg4CbwLtjOtC8 /GT5H/OSk59x7PpyV0Mdf4AiaqBph b EwFHP1CFF73JWHS/6EMlavBUqSmWgzvwgxbjFaVDoHcUOkG9ox1Yg=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.binariesappsconecpt.com/c?x=Sqz5xMEHg2xsgpzuCIJ83xRnbbRBzJymudsmReVlXLE=&c=7taLZv5QUyUhYuK9v7QywCkxFK3N4vdMImp5IDGgNE0S34aT72jYViOE6glVWivNDCSN2cyWzm6Gau2t7C0XT0hW3rZgJftWV6sOW9L6bV8iAwQSJ Qx4uMPl9T0mO oXXsjKPY1Uur8WjcJisOV3EvraHFShQLmXwh1DnBpHJQ=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.binariesappsconecpt.com/c?x=UtlC9uyUXf6vpkc/ch890ue2/CtcqaL9Eo60sWmgSGM=&c=SuGmGHtjS6oxgT1CNQl0OkwdD8KrW7surrgNn8loa ra lrBOfilobOULP9A50s1IZMHRCOVf3sjpSNAD/D0KQ3b9h9q5JUZwoATgi6lzK/LSdvPaA7w9C1UzqHb oztxZ7A8HGuM9 nsov4kda8X0KREvfoVUf/EexrXaHj6 c=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.chuckleflashdl.com/c?x=togXwU4qc2HlwDRAwQu/sj2BFKCjDpMFn w /G wpZE=&c=8VnjWq3PGhUEYgEmHzVANiAyRpslsy8FF9soKGHu78gimQAG 88oz2StBiDb M4pZmVC/zb9fC1D/OragKOzjLuB9/2j8jcsCHI0mEzHfg0gXN0gLtfivOwWPcobd4lgSwGesVW/gUvhphLn6qHOkcEXSXe2P2Ns66zQbJVY32I=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.capitaldownloadsdl.com/c?x=N94EFot2ZUZg1n2eOdveoHd65nS5aEg2GdjhIpLYx/E=&c=NflRlUg4rBZbJKTAuQqz0jAM6jkpYOHxUDc/EDafx0l6KkgLIyPnLjhNcG0ZHbirvD0PVN4EH62c1/Qkkqf4jLaopbbESJeiiEYj2EVqq 73hUcnn20CevUEbRss19qend9G8nBMvBFrYAQBcrZ uJ4Jm yhu94kylFIcIU69w=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

Remove microsoft-word-2013.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.