home

ocsetuphlp.dll

Rec Plugin

OpenCandy

The module ocsetuphlp.dll by OpenCandy has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. It uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. It is also typically executed from the user's temporary directory.
Publisher:
OpenCandy, Inc.  (signed by OpenCandy)

Product:
Rec Plugin

Description:
Rec Plugin p104

Version:
2.0.0.376

MD5:
99db27077940a22558f4d9beec14327e

SHA-1:
1cb496ef7b668cffe058a21af151ccb062992267

SHA-256:
47ba568b752fdc461921b51da18a374887d12601792b5106caa8bc6a251cb5e1

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
12/25/2024 2:07:18 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.OpenCandy (M)
16.8.8.15

File size:
836.5 KB (856,536 bytes)

Product version:
2.0.0.376

Copyright:
Copyright (c) 2008 - 2015

Original file name:
RecPlugin.dll

File type:
Dynamic link library (Win32 DLL)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\ocsetuphlp.dll

Digital Signature
Signed by:
OpenCandy

Authority:
COMODO CA Limited

Valid from:
8/26/2014 2:00:00 AM

Valid to:
8/27/2015 1:59:59 AM

Subject:
CN=OpenCandy, O=OpenCandy, STREET="510 Market St #301", L=San Diego, S=CA, PostalCode=92101, C=US

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
5AA7E515112EAEB906A3ABD37394DAD6

File PE Metadata
Compilation timestamp:
8/19/2015 3:38:13 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
3072:K6chCRH4rvHkeodik6XGdRpTBfxN4gBAYzwWWYJOO88b999KKKKzsdHHHQYcdeLg:orv6UGvpTBIaB+LYJ7TBslWHRQM45qX

Entry address:
0x5EE7C

Entry point:
75, 00, 6D, 00, 65, 00, 32, 00, 5C, 00, 50, 00, 72, 00, 6F, 00, 67, 00, 72, 00, 61, 00, 6D, 00, 20, 00, 46, 00, 69, 00, 6C, 00, 65, 00, 73, 00, 5C, 00, 45, 00, 6C, 00, 61, 00, 6E, 00, 74, 00, 65, 00, 63, 00, 68, 00, 5C, 00, 45, 00, 54, 00, 44, 00, 53, 00, 65, 00, 72, 00, 76, 00, 69, 00, 63, 00, 65, 00, 2E, 00, 65, 00, 78, 00, 65, 00, 28, 00, 00, 00, 00, 00, 0E, 00, 28, 00, 00, 00, 00, 00, 00, 00, 43, F1, 82, 1F, 00, 00, 00, 00, 41, C6, 0D, 0E, 00, 00, 00, 00, E3, 30, 03, 00, B9, 9B, 24, 55, 00, 00, 00, 00...
 
[+]

Code size:
517 KB (529,408 bytes)

Remove ocsetuphlp.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.