home

openofficesuite-setup-40289049_-40289049.exe

Left Click Media

The application openofficesuite-setup-40289049_-40289049.exe has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. The file has been seen being downloaded from intva2.clientmulti.com and multiple other hosts.
Publisher:
Left Click Media

Product:
Left Click Media

Version:
74.3.1.1111

MD5:
4a66db1df00356be51b51ab7abcc5aee

SHA-1:
3940899587bc8cdb3424f22d02cea892a6683c0c

SHA-256:
b961cb669348354dd52eb23ee1185721b22682b2de3a09722ed1dae2a3f4a832

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/15/2024 12:41:58 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Vitallia.LeftClickMedia.Installer
16.2.9.21

File size:
884.2 KB (905,376 bytes)

Product version:
74.3.1.1111

Copyright:
Copyright (C) 2015

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\openofficesuite-setup-40289049_-40289049.exe

File PE Metadata
Compilation timestamp:
1/7/2015 4:36:30 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
24576:d6AiqGv+NdALCVfFPryZ34CiTfhIyEJUXbkUcfZ2vud61ZEUt5ResaZnUqQHXPOr:t8v+Nd5/c1shHPbkUcfZ2vud61ZEUt54

Entry address:
0x1000

Entry point:
E8, AB, D3, 00, 00, E9, CD, CB, 00, 00, CC, CC, CC, CC, CC, CC, 81, EC, BC, 00, 00, 00, 8B, 94, 24, CC, 00, 00, 00, 53, 8B, 9C, 24, D8, 00, 00, 00, 55, 8B, AC, 24, CC, 00, 00, 00, 56, 8B, B4, 24, DC, 00, 00, 00, 57, 8B, BC, 24, D8, 00, 00, 00, 8B, 07, 03, C5, 89, 44, 24, 1C, 8B, 03, 8D, 0C, 30, 89, 4C, 24, 34, 8B, 8C, 24, E8, 00, 00, 00, 83, E1, 04, C7, 44, 24, 18, FF, FF, FF, FF, 89, 6C, 24, 10, 89, 74, 24, 20, 89, 4C, 24, 38, 74, 05, 83, C8, FF, EB, 06, 2B, C2, 8D, 44, 30, FF, 8D, 48, 01, 89, 44, 24, 3C...
 
[+]

Entropy:
7.9649  (probably packed)

Code size:
56.5 KB (57,856 bytes)

The file openofficesuite-setup-40289049_-40289049.exe has been seen being distributed by the following 50 URLs.

http://intva2.clientmulti.com/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=47061803[1].exe&checksum=142897

http://intva2.clientmulti.com/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=Setup-47104787.exe&checksum=142897

http://intva1.bitdesktop.com/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=minecraftfreedownloadsuscom-setup-42904867.exe&checksum=139872

http://intva31.procedureconnect.info/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=adobe_flash_player-51655797 (1).exe&checksum=131648

http://intva31.procedureconnect.info/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=java_runtime_enviroment_setup-51666071.exe&checksum=131648

http://intva18.componentsurf.info/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=skipbocastawaycaper-setup-44363521.exe&checksum=100550

http://intva18.componentsurf.info/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=extremestreetracer-setup-29571.exe&checksum=100550

http://intva2.clientmulti.com/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=Setup-46851435.exe&checksum=142897

http://intva1.bitdesktop.com/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=7zip-setup-43927075.exe&checksum=139872

http://intva18.componentsurf.info/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=familyfeud-setup-53877.exe&checksum=100550

http://intva2.clientmulti.com/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=Setup-46940203_2.exe&checksum=142897

http://intva1.bitdesktop.com/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=openofficesuite-setup-40339275.exe&checksum=139872

http://intva18.componentsurf.info/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=jewelquest3-setup-44717.exe&checksum=100550

http://intva31.procedureconnect.info/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=adobe_flash_player-51634145.exe&checksum=131648

http://intva3.compilerlabs.com/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=mediaplayer_update-51532677.exe&checksum=150561

http://intva3.compilerlabs.com/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=adobe_flash_player-51608267 (1).exe&checksum=150561

http://intva31.procedureconnect.info/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=adobe_flash_player-51636171.exe&checksum=121759

http://intva3.compilerlabs.com/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=adobe_flash_player-51503561.exe&checksum=150561

http://intva31.procedureconnect.info/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=adobe_flash_player-51678357.exe&checksum=131648

http://intva31.procedureconnect.info/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=adobe_flash_player-51635223.exe&checksum=131648

http://intva1.bitdesktop.com/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=openofficesuite-setup-40283985 (3).exe&checksum=139872

http://intva1.bitdesktop.com/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=openofficesuite-setup-40283353.exe&checksum=139872

http://intva1.bitdesktop.com/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=minecraftfreedownloadsuscom-setup-42902069.exe&checksum=139872

http://intva31.procedureconnect.info/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=adobe_flash_player-51657121(1).exe&checksum=131648

http://intva31.procedureconnect.info/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=adobe_flash_player-51656219 (2).exe&checksum=131648

http://intva3.compilerlabs.com/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=adobe_flash_player-51545699.exe&checksum=150561

http://intva3.compilerlabs.com/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=adobe_flash_player-51577049.exe&checksum=150561

http://intva3.compilerlabs.com/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=adobe_flash_player-51541719 (1).exe&checksum=150561

http://intva3.compilerlabs.com/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=adobe_flash_player-51584373.exe&checksum=150561

http://intva31.procedureconnect.info/dl-pure?usefilename=true&signature_id=0&_action_=getbin&filename=adobe_flash_player-51659281.exe&checksum=131648

Latest 30 of 83 download URLs

Remove openofficesuite-setup-40289049_-40289049.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.