home

pdfcreator-2_1_2-setup.exe

PDFCreator

pdfforge GmbH

The application pdfcreator-2_1_2-setup.exe, “PDFCreator is the easy way of creating PDFs.” by pdfforge GmbH has been detected as a potentially unwanted program by 8 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from dw.html.it and multiple other hosts.
Publisher:
pdfforge GmbH  (signed and verified)

Product:
PDFCreator

Description:
PDFCreator is the easy way of creating PDFs.

Version:
2.1.2

MD5:
e411a93d6580891feab47e1162b116ea

SHA-1:
2fc4e5fbfdad3f2e68253645ec3b0f2fa31ffd80

SHA-256:
3e55c7deb5bfc201f0f4a6ea8b604af4b7fe616dfb80cef7fc27ded5c133d722

Scanner detections:
8 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
11/5/2024 11:32:17 AM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Adware.OpenCandy.145
9.0.1.0156

ESET NOD32
Win32/InstallMonetizer.AQ potentially unwanted
9.11736

Fortinet FortiGate
Riskware/OpenCandy
6/5/2015

F-Prot
W32/OpenCandy.A2.gen
v6.4.7.1.166

G Data
Win32.Adware.OpenCandy
15.6.25

NANO AntiVirus
Riskware.Win32.OpenCandy.dqxwfl
0.30.24.1636

Reason Heuristics
PUP.InstallMonetizer.Bundle (M)
16.3.10.15

VIPRE Antivirus
Opencandy
40834

File size:
27.4 MB (28,754,952 bytes)

Product version:
2.1.2

Copyright:
© pdfforge GmbH

Original file name:
PDFCreator-2_1_2_884-setup-pdfforge.exe

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
English (United States)

Common path:
C:\users\{user}\downloads\pdfcreator-2_1_2-setup.exe

Digital Signature
Signed by:
pdfforge GmbH

Authority:
thawte, Inc.

Valid from:
3/9/2015 8:00:00 PM

Valid to:
4/8/2017 7:59:59 PM

Subject:
CN=pdfforge GmbH, O=pdfforge GmbH, L=Hamburg, S=Hamburg, C=DE

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
4A0B7118F7483AE9BED26C9A1C65AD91

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
393216:cget8OGmWo4dgnM93nKrqNXj82ITuBojUCihucpFQyRkkVzrZCI0IbWzBNA9JTmr:ot1GmWo4dNETunCiYcpqgkkxUIbWzBI

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file pdfcreator-2_1_2-setup.exe has been seen being distributed by the following 50 URLs.

http://dw.html.it/index.php?softname=pdfcreator_2.1.2.884.exe&code=1435744332&q=ODY3NTR8cGRmY3JlYXRvci0xMQ==

http://dw.uptodown.com/dl/1441843192/.../pdfcreator-2-1-2-multi-win.exe

http://dw.uptodown.com/dl/1444147157/.../pdfcreator-2-1-2-multi-win.exe

http://touch.kaspersky.com/.../1435018330

http://www.pc-magazin.de/filedownload/documents/.../PDFCreator-2_1_2-setup.exe

http://dw.uptodown.com/dl/1440625760/.../pdfcreator-2-1-2-multi-win.exe

http://0104.nccdn.net/1_5/1de/1c7/.../PDFCreator-2_1_2-setup.exe

http://www.jbcred.com.br/.../pdfcreator.exe

http://www.softportal.com/getsoft-4408-pdfcreator-2.html

http://dw2.uptodown.com/dw/1445647904/.../pdfcreator-2-1-2-multi-win.exe

http://dw.uptodown.com/dl/1440616382/.../pdfcreator-2-1-2-multi-win.exe

http://cdn.dobreprogramypldownloadfiles.com/c?x=Au4F5JDsDXmsGT/o8IqEvXf5oXDdS8ahXrePiWMYazg=&c=ced0MHv eVKokbsgFenoYpsF3Kd96zLUON ZJZUqtITVHpMEBgy9iJN7/vgkRpWgPsJzNzXpjCeN 380rhPFl0TXhR0H/kJRRmBG7ZDjbP2q5LYp6xWlw9e5Bvc3EZdyC5GoSP1D4uH/HQUFN6nnuw==&fallback_url=http://white.download.pdfforge.org/pdfcreator/.../PDFCreator-2_1_2-setup.exe&downloadAs=PDFCreator(12691)-dp.exe

https://field2base-my.sharepoint.com/personal/matthewl_field2base_com/_layouts/15/guestaccess.aspx?guestaccesstoken=/alc4/.../5SgKc8oMI=&docid=0efb77864907a40d0bfaa7e43775fff2c

http://media.eadbox.com/uploads/contents/s3_file/file/.../PDFCreator-2_1_2-setup.exe

https://www.usherbrooke.ca/moodle2-cours/mod/.../view.php?id=552001

http://dw.uptodown.com/dl/1436486883/.../pdfcreator-2-1-2-multi-win.exe

http://www.windows8facile.fr/download/.../?wpdmdl=8356

http://software-files-a.cnet.com/s/software/14/35/53/.../PDFCreator-2_1_2-setup.exe

http://dw.uptodown.com/dwn/mhfFegMQg7QMVcXjpHMQEEhNwLRDGo8z3P9l10TtMlde4bPNByV5cnqqG1Jf6A1atfrL35EsKH1p0ztb1bUQyMQuelFXdgv_j4t1Mr1yTFPzk6rFMgF1RDm3GxRzrzrI/.../

http://dw.uptodown.com/dl/1435087204/.../pdfcreator-2-1-2-multi-win.exe

http://www.windows8facile.fr/?wpdmdl=8356

http://dw.uptodown.com/dl/1437853693/.../pdfcreator-2-1-2-multi-win.exe

http://totalsoft.org/go.php?site=http://white.download.pdfforge.org/pdfcreator/.../PDFCreator-2_1_2-setup.exe

http://download.pdfforge.org/download/pdfcreator/.../PDFCreator-setup.exe

http://dw.uptodown.com/dl/1442003987/.../pdfcreator-2-1-2-multi-win.exe

http://dw.uptodown.com/dl/1433938114/.../pdfcreator-2-1-2-multi-win.exe

http://download.pdfforge.org/download/.../PDFCreator-stable?download&download

http://dw.uptodown.com/dl/1440423829/.../pdfcreator-2-1-2-multi-win.exe

http://r2.computerbild.de/exec/r2r.pl?m=w-cobi;u=http://d.computerbild.de/downloads/.../PDFCreator-2_1_2-setup.exe

http://dw.uptodown.com/dl/1444901945/.../pdfcreator-2-1-2-multi-win.exe

Latest 30 of 55 download URLs

Remove pdfcreator-2_1_2-setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.