home

openofficesuite-setup-112400181-112400181.exe

Cat Lady Interactive

The application openofficesuite-setup-112400181-112400181.exe has been detected as a potentially unwanted program by 4 anti-malware scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from intva1.bitdesktop.com and multiple other hosts.
Publisher:
Cat Lady Interactive

Product:
Cat Lady Interactive

Version:
1.2.9.2183

MD5:
f0b9e1f9ae12972b988a956e62971f7c

SHA-1:
1d55af4f984e9db9617263cba16c02a3f3c75804

SHA-256:
b5e63414fb1cb5cda404300f44252385c08f4eeb71790faf71db5f6cd510b627

Scanner detections:
4 / 68

Status:
Potentially unwanted

Analysis date:
12/27/2024 1:17:50 AM UTC  (today)

Scan engine
Detection
Engine version

Emsisoft Anti-Malware
Gen:Variant.Razy.19119
11.5.0.6191

ESET NOD32
Win32/DownloadAdmin.Q potentially unwanted application
8.0.319.0

F-Secure
Trojan.Heur.JP.3q3@aS3oLBei
5.15.96

Norman
Gen:Trojan.Heur.JP.3q3@aS3oLBei
02.04.2016 17:35:19

File size:
887.6 KB (908,896 bytes)

Product version:
1.2.9.2183

Copyright:
Copyright (C) 2015

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\openofficesuite-setup-112400181-112400181.exe

File PE Metadata
Compilation timestamp:
4/5/2015 4:47:44 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
24576:QnYseo1xemN/t8sEX8d9TwVXsuIYZEdfRLSM:Rmdt8srlwJv4RLSM

Entry address:
0x30A6

Entry point:
E8, C5, B2, 00, 00, E9, CF, AB, 00, 00, FF, 25, 2C, 1F, 4B, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, FF, 25, 80, 1E, 4B, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, FF, 25, 80, 1F, 4B, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, FF, 25, 10, 1F, 4B, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, FF, 25, 8C, 1F, 4B, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, FF, 25, 54, 1F, 4B, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, FF, 25, 84, 1E, 4B, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, FF, 25, B8, 1F, 4B, 00...
 
[+]

Entropy:
7.9645  (probably packed)

Code size:
57 KB (58,368 bytes)

The file openofficesuite-setup-112400181-112400181.exe has been seen being distributed by the following 17 URLs.

http://intva1.bitdesktop.com/dl-pure?&usefilename=true&hashstring=jb41116&signature_id=0&_action_=getbin&filename=openofficesuite-setup-42214677.exe&checksum=107598

http://intva1.bitdesktop.com/dl-pure?&usefilename=true&hashstring=jb41116&signature_id=0&_action_=getbin&filename=openofficesuite-setup-40238857 (3).exe&checksum=107598

http://intva1.bitdesktop.com/dl-pure?&usefilename=true&hashstring=jb3172016&signature_id=0&_action_=getbin&filename=vlcmediaplayer-setup-78829815.exe&checksum=131064

http://intva1.bitdesktop.com/dl-pure?&usefilename=true&hashstring=2ap32116&signature_id=0&_action_=getbin&filename=minecraftfreedownloadsuscom-setup-42908725.exe&checksum=138324

http://intva4.developbutton.com/dl-pure?&usefilename=true&signature_id=0&_action_=getbin&filename=Setup-66081211.exe&checksum=167623

http://intva1.bitdesktop.com/dl-pure?&usefilename=true&hashstring=jb41116&signature_id=0&_action_=getbin&filename=openofficesuite-setup-111269317 (1).exe&checksum=107598

http://intva2.clientmulti.com/dl-pure?&usefilename=true&hashstring=jb3172016&signature_id=0&_action_=getbin&filename=Yandere Simulator-March 17th-124387477.exe&checksum=150530

http://intva1.bitdesktop.com/dl-pure?&usefilename=true&hashstring=2ap32116&signature_id=0&_action_=getbin&filename=42906545[1].exe&checksum=138324

http://intva1.bitdesktop.com/dl-pure?&usefilename=true&hashstring=2ap32116&signature_id=0&_action_=getbin&filename=minecraftfreedownloadsuscom-setup-42901019.exe&checksum=138324

http://intva1.bitdesktop.com/dl-pure?&usefilename=true&hashstring=jb41116&signature_id=0&_action_=getbin&filename=openofficesuite-setup-111269317 (6).exe&checksum=107598

http://intva2.clientmulti.com/dl-pure?&usefilename=true&hashstring=jb3172016&signature_id=0&_action_=getbin&filename=ClickWorkAtHome_Setup-124582425.exe&checksum=150530

http://intva1.bitdesktop.com/dl-pure?&usefilename=true&hashstring=jb41116&signature_id=0&_action_=getbin&filename=openofficesuite-setup-40295959[1].exe&checksum=107598

http://intva1.bitdesktop.com/dl-pure?&usefilename=true&hashstring=jb41116&signature_id=0&_action_=getbin&filename=openofficesuite-setup-116439599.exe&checksum=107598

http://intva2.clientmulti.com/dl-pure?&usefilename=true&hashstring=jb3252016&signature_id=0&_action_=getbin&filename=Chip 'n Dale's Rescue Rangers-124677593.exe&checksum=164825

http://intva2.clientmulti.com/dl-pure?&usefilename=true&hashstring=jb3252016&signature_id=0&_action_=getbin&filename=Conker's Bad Fur Day-80602109.exe&checksum=164825

http://intva4.developbutton.com/dl-pure?&usefilename=true&signature_id=0&_action_=getbin&filename=Setup-102747645.exe&checksum=167623

http://intva2.clientmulti.com/dl-pure?&usefilename=true&hashstring=jb3252016&signature_id=0&_action_=getbin&filename=Tenchu San Portable Japan-124403941.exe&checksum=164825

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.