» office suite.exe
Overview
Analysis
File Details
Downloads (2)

office suite.exe

Download and Install Ltd

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application office suite.exe by Download and Install has been detected as adware by 20 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from begin.downloadscenter.com and multiple other hosts.

File name:

office suite.exe

Publisher:

Download and Install Ltd (signed and verified)

MD5:

fd8fc0a8559096288bc41cb84b6364e6

SHA-1:

13ac1038ecba0c3913c3f05439057b76895651d4

SHA-256:

08261e86f90650e23301bb8f6dd552cda1d01611c7fca537c05f7082c610283a

Scanner detections:

20 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

12/28/2024 10:15:11 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Strictor.53116

1023

Agnitum Outpost

PUA.InstallCore

7.1.1

Bitdefender

Gen:Variant.Strictor.53116

1.0.20.535

Dr.Web

Trojan.Packed.25266

9.0.1.0107

Emsisoft Anti-Malware

Gen:Variant.Strictor.53116

8.14.04.17.10

ESET NOD32

Win32/InstallCore.ES (variant)

8.9490

Fortinet FortiGate

Riskware/InstallCore

4/17/2014

F-Prot

W32/InstallCore.R3.gen

v6.4.7.1.166

F-Secure

Gen:Variant.Strictor.53116

11.2014-17-04_5

G Data

Gen:Variant.Strictor.53116

14.4.24

herdProtect (fuzzy)

variant of youtube downloader.exe (Adware)

2014.7.6.23

IKARUS anti.virus

Backdoor.Hupigon

t3scan.1.6.1.0

McAfee

Artemis!DD96055B9A3C

5600.7157

MicroWorld eScan

Gen:Variant.Strictor.53116

15.0.0.321

Qihoo 360 Security

Win32/Trojan.f35

1.0.0.1015

Reason Heuristics

PUP.DownloadandInstall.M

14.8.7.18

Rising Antivirus

PE:Malware.XPACK-LNR/Heur!1.5594

23.00.65.14415

Trend Micro House Call

TROJ_GEN.F47V0111

7.2.107

Vba32 AntiVirus

Downware.InstallCore

3.12.24.3

VIPRE Antivirus

InstallCore.b

27002

File size:

627.5 KB (642,592 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\downloads\office suite.exe

Digital Signature

Signed by:

Download and Install Ltd

Authority:

GoDaddy.com, Inc.

Valid from:

9/22/2012 12:33:56 AM

Valid to:

9/14/2014 9:31:22 AM

Subject:

CN=Download and Install Ltd, O=Download and Install Ltd, L=London, S=London, C=GB

Issuer:

SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

082658FA2A383E

File PE Metadata

Compilation timestamp:

6/19/1992 4:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

12288:O2XyMJfsGn9NGHy8nydSNzidTjBYj0m2nMqzXGe9zRsHN2j2vJ9H6fT:OayMJfsCNiydSSE2Hzr9zy1R9cT

Entry address:

0x98CC

Entry point:

55, 8B, EC, 83, C4, CC, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, FA, 97, FF, FF, E8, 01, AA, FF, FF, E8, 2C, CC, FF, FF, E8, 73, CC, FF, FF, E8, 0A, F3, FF, FF, E8, 71, F4, FF, FF, 33, C0, 55, 68, 76, 9F, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 2C, 9F, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, B0, 40, 00, E8, 9B, FE, FF, FF, E8, 26, FA, FF, FF, 8D, 55, F0, 33, C0, E8, E0, D0, FF, FF, 8B, 55, F0, B8, D8, BD, 40, 00, E8, AB, 98, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, D8, BD, 40, 00, B2, 01, B8... 
[+]

Entropy:

7.7542

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

36 KB (36,864 bytes)

The file office suite.exe has been seen being distributed by the following 2 URLs.

http://begin.downloadscenter.com/.../Office Suite.exe

http://install.downloadscenter.com/installer/.../download?s=yb&k=microsoft office for free download&q=microsoft office free download&m=e&ad=4246627798

Remove office suite.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.