home

pobierz_openoffice_v4.1.2.exe

Program

AgileMax (New Media Holdings Ltd.)

The application pobierz_openoffice_v4.1.2.exe, “Program Setup ” by AgileMax (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as the free Apache OpenOffice but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Software   (signed by AgileMax (New Media Holdings Ltd.))

Product:
Program

Description:
Program Setup

Version:
4.4.1.5

MD5:
59f168fc81f2d465ddf61d5d0e60603b

SHA-1:
b96fd2e520896890086e2acdf184cd6c3f780399

SHA-256:
10289cd51e2f5181400acaf8eb6facf56d59027ff366a17adf2d4dbab6d84bf2

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/27/2024 2:51:07 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.Installer.Installer (M)
16.1.17.20

File size:
990.7 KB (1,014,520 bytes)

Product version:
5.6

Copyright:
Installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\pobierz_openoffice_v4.1.2.exe

Digital Signature
Signed by:
AgileMax (New Media Holdings Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 1:04:31 PM

Valid to:
10/30/2016 4:53:45 PM

Subject:
CN=AgileMax (New Media Holdings Ltd.), O=AgileMax (New Media Holdings Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112186313590F7C0AF7C143BC6BDE6200476

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:F5aaWPxdZx1o9RI7EJPwnAfBKIQiAK9rxdTGn6qIUjB9ySF+4riy3pPYXRQRgbDQ:F5arJx1o9i7EqWQijTuZjn+FQSHupF

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file pobierz_openoffice_v4.1.2.exe has been seen being distributed by the following 11 URLs.

http://www.byteapplicationvaults.com/c?x=CZ4/ixNKjIwkBaW0phnSo 55JlWMYf80b14r7mM4vM=&c=rngBn1VGmGST7r4MGIZcj krzMMJljy/BbJbg0qGjXJQE6sZuNuhrvz7sYXAE4TPGBokKDnn7LsWcG8xPTkwLCD3JMO bL42EcWvOTL85C3nkxxcwuwKy 8 80teEuHpQhFEqo6ed620NxvM8 ZJgASWLv lOP4g9zmqjiA1e0w=&downloadAs=pobierz_Openoffice_V4.1.2.exe&fallback_url=http://.../

http://www.byteapplicationvaults.com/c?x=jwj2ATPqfahb/AO5oJ99ehxQ3 hg3 c IXTjJk7ODEE=&c=mAc176eBm038VElLxZFtjvJ4axzG0hOJzg8zXex2XkgExdT49LcJgNfwfJ0MmvMQIUn5ZrWnTBsz0mck6bIFxbnJvY9DalAsw6ET4l3NVOaVECY2wpMCI1z0d7rqplD 5R7K3Q5 jjtml1BPh6hcsL9jvspOFjPrZ02XBPB2AtM=&downloadAs=pobierz_Openoffice_V4.1.2.exe&fallback_url=http://.../

http://www.signtourupdate.com/c?x=uLti7ML4IsnNDDgZ2f 57A099KuQa4ps7xC0CHaYraI=&c=NxbU2zCXvu59M0QH6lsWuasL 2NfiyfmUJUnqY4mfER3LfyKwWv4pqt5eAZ /gz5SgQMBiPFFmUeKh/KdWmNOXSJqijQsezKd TqbmcWfl5 D2bmc1nMpq1m89mnGTIcsO8Lp05 GAM3kfXPeCTz0g==&downloadAs=pobierz_Openoffice_V4.1.2.exe&fallback_url=http://.../

http://www.byteapplicationvaults.com/c?x=4MFUoj0K0h5uRM64YCGp66Y22EoeiSC OuqPfpYjMaQ=&c=yDbELXd88Cuh1TzCrI5npAtDt9cin0h/ot21gfdiqtGrSI NSKxN6K/9eazxoxJNqJJkLZaWDV2223dlVBFgf4yVf1hiZNsQ5QRUUHisJaFo63NSkjMwxqW8xJIgUxebMuV2Oxv9VRXyyfqb32iGbm4qY3050BoJ2riqtElISBM=&downloadAs=pobierz_Openoffice_V4.1.2.exe&fallback_url=http://.../

http://www.byteapplicationvaults.com/c?x=gOndrGNUTg/yn91mf/b0rg/G/qhUoH/920WR33TQceo=&c=ObM0hUxwGsjNlWsT9SJ1emU1f7gyCsjKZQ1nP1pXtjsBfPglO2zMWtwg6vphS3xd7l5fAZHoC6aLyTg5XjR7xcjCh8QQG3QdxhVzIustbb02RKHEy hEx sTtTELAwYU&downloadAs=pobierz_Openoffice_V4.1.2.exe&fallback_url=http://.../

http://www.byteapplicationvaults.com/c?x=imELWtbXYWC DqzUNo97PmubCOusNydX9qKQKhR3j0M=&c=03vw/nysrdH765gCCVDEc4qfs1rcmhz38/UuAhh2hMAfqGwZzohPPbc7 HPyo0W6Bg1lbJKaROLjCjeDJVYk7zdTTewY3wwL4xq2wQu2tFE6dTM13EFgOqrRuLyD4eoDWs//w85DZ7JoBkGamO4CUbhikum zvhMEhQ2U7iDG2I=&downloadAs=pobierz_Openoffice_V4.1.2.exe&fallback_url=http://www.instalki.pl/http://.../?st=hp&q=

http://www.byteapplicationvaults.com/c?x=/Q2oaS15URqVpYzQcTnEZnT1uI TEEzUwQCp8jF wuI=&c=rGm3n83O8gSqPERPbGl9wq8BiToQBFCtnis7W3sTN2RhdxMe4nRBmXaelLdixXjYEUS/repOQhHKCg/ur8 Y/tLJjwVcCd XKBKWabiae031fw8t9Lf1AdckaMwtIdvZ3TVv3G/WcuXZVMeczI9fvOCEngKiBWJp1yt4Q/d3L0k=&downloadAs=pobierz_Openoffice_V4.1.2.exe&fallback_url=http://.../

http://www.signtourupdate.com/c?x=XAG6oEC1eA13bAj5qlF65V9M4TcoenaRmfCaeyKneqg=&c=8zV3MLkm54P6ELExWODWMJ6DgqFnxVPuQvnIp1wMABS3kOPdMQTZHOLl07 ZKJTOjJoi2aLjsOcNijRSplx/6QFy7SKxOCDqp4vahSfp19l7DoLHBZh3NwCWs1FuBJfWc4YNgL7DYOA 90vqGx/okA==&downloadAs=pobierz_Openoffice_V4.1.2.exe&fallback_url=http://.../

http://www.byteapplicationvaults.com/c?x=xql7qytK8RCug/BFaTQcS4kvmcKgWlrWNei/Y9w2jGo=&c=jbL2wtjljcBqbozX3pHTDkIhnzy 6/KfNtgP/G8il5PmZnrFO78qb yAGob1rSvb9UrsW4Yv sZWB2LABc5Xk3OfPhdt2fEQPVEgUQCgpDUE8eybU6In4MPIk6J0wZRF&downloadAs=pobierz_Openoffice_V4.1.2.exe&fallback_url=http://.../

http://www.byteapplicationvaults.com/c?x=dhXW4ER19H6GKlMdXpt/CvW0ozpASjSqL4ukdWLiNdo=&c=pfR4hcl7FDRMt5rAIC5ayOyyA4dMNM4GylwusHig5XC/vg6sWNBU6EiZLq3In4pVa8VBygMFkbIEVTSBu60ZkC7/pZ00m5vMD 04FaxX925NzM/Q27rhPzOiYhwXGgl0&downloadAs=pobierz_Openoffice_V4.1.2.exe&fallback_url=http://.../

http://www.byteapplicationvaults.com/c?x=u83UgjFz2V3mYyPAO7SKzj54TUgTF6p2SY2xE9EiEz8=&c=uG kx/Jg vwtdLvYHaIRwHFRzyY/0QgrEqH/rKNKP0txKk6XoSW8h0s9V1daFqSBGk/tGfkr2EMU/8i4US5YQ0DoxKQtbUqa4xWGAaNHMFeX/1qnGCfFJG4F1R8Bp/ze&downloadAs=pobierz_Openoffice_V4.1.2.exe&fallback_url=http://.../

Remove pobierz_openoffice_v4.1.2.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.