home

microsoft-word-2013.exe

Lite Application Program

Destiny Dream S.A.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application microsoft-word-2013.exe, “Lite Application Program Setup ” by Destiny Dream S.A has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The file has been seen being downloaded from www.capitaldownloadsdl.com and multiple other hosts.
Publisher:
Destiny Dream S.A.  (signed and verified)

Product:
Lite Application Program

Description:
Lite Application Program Setup

Version:
2.6.3.4

MD5:
0a38c688bed525108cbf913ce3901102

SHA-1:
8f709dc9b4cbfcc2c09c98145fbeb9786dcebf24

SHA-256:
c4a7cd7a576efbd6dc395653d423a0efc9d57106935db7a4bfd5dbc1da2526e7

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/27/2024 4:31:52 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.DestinyDreamSA.Installer (M)
16.1.30.19

File size:
996.5 KB (1,020,464 bytes)

Product version:
3.4.3

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\microsoft-word-2013.exe

Digital Signature
Signed by:
Destiny Dream S.A.

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 7:55:11 AM

Valid to:
10/2/2016 9:36:18 AM

Subject:
CN=Destiny Dream S.A., O=Destiny Dream S.A., L=Clarens, S=Vaud, C=CH

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11217A75EB912AE2167326222C18D9E2357F

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:fC785XIxQtkqpdXowE87p6MZtwiXa9NILu4uqf2aI:f+sIKDfXu8MMUiqTIa44

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9281

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file microsoft-word-2013.exe has been seen being distributed by the following 19 URLs.

http://www.capitaldownloadsdl.com/c?x=/ clCyou/jWF6oCRWN5VZS3/GnBlFyNZYQqpd8oVg7k=&c=BTeyd51NYmKeaO69zx1pZVb/t57oomCpkqGtF5imaop4Tn6XqKEQ70XCuHv2 j pGUyf940O6Vtl9LZqUvZdWiOpILMPqq0AJJDWHxUhkm 07/d jDlWNHfCgZm3eetN&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.ranchgiftconecpt.com/c?x=gO5qv065YxxqRltM0IV2UWB0C91BRQOAIEU57VuWpW0=&c=ymzIO7DK68Q6Pvl1CuT2XN8UFT1 Mgf59r1NTI/p4//hvroxfHMKEDP00bmz306/LGwxGCYKmTQEGIZyL/N5kqXD0jyx3vXFOqd5AFco/MKpjDGr38slVMjMmKE9xZOU&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.capitaldownloadsdl.com/c?x=3WQjhRWNs4g0VTiIX33i3s1Sbi4ZtoUMpm/shLS4ucI=&c=Pxlecgtk3NUK2Zkg49 CJt4cJTQnzk 5BSln6j2mq/nrqdfXbmsV8LNFh7r34/pB/GURqHC8zRF5cmIukiO2XDBgr/LjS6u2Cx6GKTHZ6WNuOo01xwbq6XHMulsMQlVc&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.capitaldownloadsdl.com/c?x=TiqjrSkIP7ZhOl6rXaVW NX7Jqebt4CZldaosD4hPn0=&c= CyQ/i7rGZRMlMKVR/Eq8ISkqMh0o/DpGwAP15CGmvla4WqkEP MYARmJmgmZUoF0gxQsaxHDK5zhgoLPDFbavD04rSO6rc3oO0mfr8woCntOeQEEZX9q8nHys4fm0fm&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.binariesappsconecpt.com/c?x=E3 GDxVFKBQ1QZTm ozktTPJggMC/zjEkM44azipWVI=&c=uld2QkhcsXiF9lP5k5djh1yexBikd0RFATsAdZPGUvhnLcfTVXnqxuLU1Jts2fsqdOBfSErhjrxZtNlhjq7IhKhFpHq1CluxxlJbgI9RXK0SnLuQ9E5R0Sec4wfVHCZa&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.chuckleflashdl.com/c?x=g4d8oYEBOHJ7AxGF4zUkGAgQYV2SQCFt5/tI c7yNoE=&c=I4jqsxAstTQshmYSx/BTdU8t4f1h1LEXAQmWJ9ird98ZgbJqIIaujpCVwsNXBm8CcKPgEHOSX0AQiCy2HcDvfig9 dHCH nACz0uowD2zjBygDWrkma0N4mXYVweZsML&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.chuckleflashdl.com/c?x=XMjVm7y2Q3UqijgU3s9nLbQp2GBawiZnMLsP9HMQ7EA=&c=tjohwjt42vJXu6VlG2eyYsTESWELnmyRX1fn6fx0VPUXh5xRcrpuHG/LyjUygZiSxuGROWcRkLH0ayZuJZMPLY0FGg2ghnhceQBeXY7woBK6tI2DuNkVtwojjSaWp2nF&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.binariesappsconecpt.com/c?x=wJjHzcS94zzkazWZOhKvjw75K3cq9Fsp5/DSp3NSoeA=&c=BhjURAy3SdySe8dTxF6R4MnZDDop2hMs7A4XOjQudCWs4JeKb9ZzV0KwTHHohKCsaIoa1qZdZJxL4fUyuIOh6vDzek8k9y wnwolPGHRzhQoJGS2GkFNQI2ZAO8WLJhI&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.binariesappsconecpt.com/c?x=oUXMkyokLuWnIokw8h77TTKtopPFX1ELD2Zx0maunPw=&c=bhJFJ2CtAJszm/lsxElP3T0HtSWBfbNhFhlWeRZeBjz0K6R9QUxIrlb5vE2bK5W1H8e5tdHQiHsKvQTYFJ5SZAwqi7jMAddZQCXG2jUxA8aCZvGWYUIUfkY818lmM8Ft&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.binariesappsconecpt.com/c?x=yZuQqBebLpx452JD3PVgtBZLTsclgPLCAH0oPL77ssg=&c=01FSe3RXJw/vTa9cHJ458BDRpDwu 5mSwuD812cS9C06fcTVzFfI9wn/rD4931EMgxKnpl8//xxHQtGLE0WvSYQNYG8qoaVQc/B5LJ3lOEnTn7T9HJLJRGakWGo HiLG&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.chuckleflashdl.com/c?x=/RSj1HPWJXxRfLhsZXp7wQyYI06hvaqn8kqWn6hQ6bA=&c=Fo0xC4NYKoI Ukhah7CcPd228oXuPrgeEnetDn9cutj3FOOy8rXaNNyT9u6CtPXXqQtqh ACvu2bbWjdy5w/aY2D8ufe731 8LZ8p2MqPfNwdA0mHaQs20c4urt40raG&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.binariesappsconecpt.com/c?x=afUxsapqblnYDGHDQgdjcwNFVaLpQ/v7ohM9/DJY0TY=&c=0qC1cg6zNA5e3eEEW8FwZCiBOgkcxtCTt3uxEHoyo4TRLxDUboBH0BHb6X9tHQn6xjfkZrY8ICI5Yai3pdCebWNj0xXiOXWluMZjkX00BS9HycFPFXG/bjPvt7kdTMND&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.ranchgiftconecpt.com/c?x=EXSWcFr03rqLQFd8zLllP2qcj4URG/IZWpkoY7DK224=&c=h/g1n0 0dtIJQh7qYHCtlQVkrJ2vRACGJedGLNA324zJfLlnNPzVZmd/MCPnUAN8K o/aRaLsytEFoRw5TUk0X/OYQQ1Hx4N3q/UduBI7Nqum5YBI46xk1IDC24HAt7I&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.chuckleflashdl.com/c?x=fZnVpru9IajYMKj608W9zMdERCYov6DCW4W/nB4LQ9k=&c=7ffPKHvAdGFFIC4x BKfkVt2LbzoS3JytQNudSPtmUGgRwJq/KrbwF6kMD4qYd65CHX4LFIWZkwCBg/izSqRQ9G3YhLxEmORezj8oYbfEpHkGopVIK/n7k65V8CaeSjS&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.binariesappsconecpt.com/c?x=KqQyd8BzvdPSLh2YIKIwcdijscD5xmXW8QxAR/69Guo=&c=K0ol43WZJpM1Vl7CbUrGXqvHemuorMc5mmHhCkGU0NYKnUrRvM4iaCbHUWTtAuep uRKSAbJHqwmn2m4lAlFqWmuIiqk4NxFvSI2BsQ1UzCAn2MefjDIm//Q4IX9AGqo&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.binariesappsconecpt.com/c?x=npZYUetzYN Wq4KU Xo5MmWDC5apJri4YGJqkfVmv/o=&c=fnf69/Y7Kf7amniG86/eUnRKvH7XckPBx7hVkjw4LM6POuZSFztCoJkmhs312NaiwhWRxtfr TQMyhjNSEP3JdyKSYJ08zyHf61K1puyqZtmmMbKpB9cnRv0TXid7feV&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.ranchgiftconecpt.com/c?x=UTZ7KuZsBlkeAurxdVlHHvFPF9hs3WdfdJjHiF0 Duc=&c=R7obx8p GQrQuyX3YAh5LxCRaRfEsR0PDJ/ARHME4DkPif38uBk0HhnLhD3H6Px1egsDpmgyYmOfu QJifFqgBIzkn57vzZHOIsWsUe5UetUCdLl6JnQr68G26kkHvEw&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.chuckleflashdl.com/c?x=v6BeUXoABaWDiflAxBejcg12RB05ygkJcE2IpH/wqOc=&c=GwTtHBZIrWZz20nxJ9ygNoYOsAgALxOviXNHXMxycb5ZnUCUSbfdbZOUE5eqkLFlNuloA9NPxCll7T3Qcz3NY1BxxPbyljXnWWq6jueKlKMoI8fjzH MpW6aGlerlp2p&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.chuckleflashdl.com/c?x=GSopRIvGzpMc2z7yIXX95GDEbGy7o0BH6wTHUNpO 9Q=&c=4qYhRBE72OqYsOzbMB7pF0vkWbM4jTDNtat4QbwtZ14baaV82xONJRo/nVjzJBp3Q9hzrKk/aU3zbYGrkGdorAKjbQEfrJ03YQk4H/GtvKRc9UC5UgQdePPpQKgdDj9p&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

Remove microsoft-word-2013.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.