home

pobierz_openoffice_v4.1.2.exe

Lama

Kabikamoh

The application pobierz_openoffice_v4.1.2.exe, “Lama Setup ” has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Kabikamoh

Product:
Lama

Description:
Lama Setup

MD5:
c12064b4cddcbbf88f2e40b7044db652

SHA-1:
de90c3efc35fea104f0f6486f5a9299327aff569

SHA-256:
824c5681d6f6e704e26d81069fa4aaa84b1e7c9aacd0483e9bb76ecd4381b5f2

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/27/2024 10:28:17 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.RE11 (M)
16.4.13.17

File size:
1014.7 KB (1,039,045 bytes)

Product version:
4.3.9

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\downloads\pobierz_openoffice_v4.1.2.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:6uv9cIzgrS0hZ9JGroxkFbZSouqKijrXz960CGweU0XmsIAktEDTDpjETKG+Iqs:6uvXzgrHhZ9J9ED96CnWsIvIpoT7

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file pobierz_openoffice_v4.1.2.exe has been seen being distributed by the following 10 URLs.

http://www.appsfilesbundles.com/c?x=IOv1F5mG0azEO3u5IZAt2bb3HCr iWY9KRYHYjPRuyU=&c=/iD2O5E/MDxaR/QqRTUamIJnezTYbZVVcxLlAQmQJm/kB2uJh/j32Iu8wERuzjLHuYlWi3tYVPXvzZj37XtpI92GwgGzsgC3sKVMFYz4CsMXNT9vCS0iOwRI1GE9JJqM&downloadAs=pobierz_Openoffice_V4.1.2.exe&fallback_url=http://.../

http://www.applicationsbundlecontent.com/c?x=zZmx7fU6OSHRRyImkt515MopPqXtUD4SWvnPvjMzZTg=&c=w/T7 8F1V3Kd4DcW4BsJtBWXb67UYypzXOqdlAJeVDCZs29Faqtflptn3oXLF4eMaOwj7JP mWppUXbCIZFGa4B9PwnJ9fGtZKWhz/bU5mBKQOvEhUQPCHso6tO2dQ2L&downloadAs=pobierz_Openoffice_V4.1.2.exe&fallback_url=http://.../

http://www.appsfilesbundles.com/c?x=eA5tXeLgMHxNOzsR2wmoh62wo8VJYG4hcIjHLtkqjrc=&c=ISdWi2GTe918jrz3TAkPFyvy2I9c0wnE0nq6AHcOODGlLK22M7MHDd1BbDCezHgWTt 3WUrK61/uJ cGc82Pj ZyDUd73nsqmF2aw3tH2iiFQ4etfPdj8vsSm46fmUQr&downloadAs=pobierz_Openoffice_V4.1.2.exe&fallback_url=http://.../

http://www.appsfilesbundles.com/WVl6OTRQV1ZZY2poT2FWRk1iM0I1Y21rMVdtWmthMWRMZEhkQlQwMHdObEJ3UlVaUU1IWmtWVklsTWtaTFFYUTFieVV6UkNaalBYUTRjRUl6VlZaaFVEUnZiVXBQWmxOTE1uRm1ZMGxFZEhaWGF6QjRSbFYxUjJ4UGFsUjVaaVV5UW1sSlQwaHVjemhWU1hWaldUQnRhVmh0SlRKQ1JsVnJNbVZHTmtaMGRETkxSMU55ZURNMFpUTnVaamwzTmpVMk1EVk1USFJyZGxsMGJFOVFkRW8yWlRScU5uVlNOMUpsTXpWaGFFTjZaVWtsTWtKeWNVeHZkVnB3VVV4S0ptUnZkMjVzYjJGa1FYTTljRzlpYVdWeWVsOVBjR1Z1YjJabWFXTmxYMVkwTGpFdU1pNWxlR1VtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTBFbE1rWWxNa1ozZDNjdWFXNXpkR0ZzYTJrdWNHd2xNa1k9

http://www.appsfilesbundles.com/c?x=2ck2mLrR0UlpJgaPnN4dfZ6BZiqOjbA1WBHDsv708N4=&c=5rc8e SQ1BHSWVqp Gi9SfVg DQ/SGqnnhR1JpaKceg0uofHBJ/KUcINb40pHrCoJYFq4Zp5KQzD1nUW84D0TBxvYAcwQiNvsRK2D88UOzyBewehYf2mBbDcj085bn8tLeqpQvRlyJ2mEpjWN8H7hXfevKsH7Kf6xyUysrtmBzE7apu/LO7HahCJ5pQODWo3&downloadAs=pobierz_Openoffice_V4.1.2.exe&fallback_url=http://.../

http://www.appsfilesbundles.com/WVl6OTRQVEZFVG1GNVpEQkRkRkZDYlc0MFlUQTBiak4xVERkWU5tbzFaSGRyUXpWd1VWWTFVVnB0ZVZKUU0zY2xNMFFtWXowMlZsRk5TRWcxTTBGWVMzZDNNMEpPY2xOV09YWnRNRzgyVWtnMVkxbE9VVVpLWlRGVk0wdEtWVEZ4V0ZVNFduaFRUekJCYlZoVmJuRnBXSGw1U1RjNVJuZHRha1U0WWxsdFFVRWxNa1pHWkVWRmExcHhZMHh5WVVrbE1rWnNhbTl4VG5scWJVZ2xNa1lsTWtKd2IxSkpaMXB3TWtaQ1kzRjFjbWxWUTBwUWFYcHVZMnR3Ykc1a0ptUnZkMjVzYjJGa1FYTTljRzlpYVdWeWVsOVBjR1Z1YjJabWFXTmxYMVkwTGpFdU1pNWxlR1VtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTBFbE1rWWxNa1ozZDNjdWFXNXpkR0ZzYTJrdWNHd2xNa1k9

http://www.appsfilesbundles.com/WVl6OTRQVXhhYTI1RFdtTjFPR1l4U0ZWQ2VrNHhSbEEwWmpWaU5rSlhaM3AyYjNsU2IyZGtSalJsWlZkQkpUSkdSU1V6UkNaalBWbzBaMFZtUlZWelJ6VjNSemxrWkc0eWJTVXlRa0ZhSlRKQ01UUllKVEpDVFVOeWN6aEdSVWh0TnlVeVJucHNRbk00Yld0elVWZEhWMnRwVVZaU2R6QWxNa1k0UkRsMFIwdFhURVExTmt3bE1rWkJVWEpuTTBReWVIaHZKVEpDUWxOQlRuZGtWQ1V5Um5SeFpXbHBjR0ZDTnlVeVJscHlWMlJKVm01YWQweElUMXBRVkVGVUpUSkNZMGQxZFVaWllVUlBhWEVtWkc5M2JteHZZV1JCY3oxd2IySnBaWEo2WDA5d1pXNXZabVpwWTJWZlZqUXVNUzR5TG1WNFpTWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpRU1V5UmlVeVJuZDNkeTVwYm5OMFlXeHJhUzV3YkNVeVJnPT0=

http://www.appsfilesbundles.com/WVl6OTRQV055VlZOMk0wWktRMlo1VTFWS1YzTnlhRlowZVVaU2JWQTFRbWROTlRKWlpFWXpiMHNsTWtaR1JHWnBVU1V6UkNaalBXMUZhMUJRVjJNMk1sTk1UMVU0Tm01MEpUSkdZbmwzVmtaMmMzZDNiMFJpYTNoS09ISmxOVzlhVjFoU2NqRjZiR0ZCVERaUmNrSkRZWEk0VWlVeVFqbHNaWGQ2SlRKR05FUWxNa1pyYjNSd1lUVnBOMmt3Vlc5dEpUSkNkbkIxUVdVMmNEZG5TVEZESlRKR1JtOVRlRVpCY0ZOb2QzazFWVVphU1dOS1pqUkxOMjVrVXpkMmNWWlBkbXhzSm1SdmQyNXNiMkZrUVhNOWNHOWlhV1Z5ZWw5UGNHVnViMlptYVdObFgxWTBMakV1TWk1bGVHVW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMEVsTWtZbE1rWjNkM2N1YVc1emRHRnNhMmt1Y0d3bE1rWT0=

http://www.appsfilesbundles.com/WVl6OTRQVlIxVGxoV2NFTk5OSEZhU0dzd2JGcENhVzVYUVVkaFZqSllkV3c0UkU5elpYaFJRM0k1WWtKcE1qZ2xNMFFtWXoxV2VsTk9halIxTWxOVFNqWXdTSFZhUVVScWJqZ3ljVlJQTnlVeVFsVktaMFJ0WVdSWmQyWXpOaVV5UmxOaFJGQkdhM3BqVm1OWk5WazJUbEVsTWtKVVluWmpjRE5JYm1veFJtYzJKVEpHVEhsMVJtMU5VblIyUkdwMUpUSkNURFEzTTJaUk0wRjFSMWcwSlRKR1EybDJkbWhWWkVOWVdrdEpiRGRuU0dSRWVuSm9jRmhRT1Uwd1psWXdZaVprYjNkdWJHOWhaRUZ6UFhCdlltbGxjbnBmVDNCbGJtOW1abWxqWlY5V05DNHhMakl1WlhobEptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTkJKVEpHSlRKR2QzZDNMbWx1YzNSaGJHdHBMbkJzSlRKRw==

http://www.appsfilesbundles.com/c?x=0Q8nXCzEyfwmm7uDzTiQ0N0AJymo/HoapdP4Mb9ntYI=&c=NqA3DL//U V1K81820s8tG Mk5JfjtSm2BueS0Yq7XCCL/azeBQXQmkY1h52pzIww7 PpzDnSKOptlwGEG9YlFH w6aPTpgSAHwR3MYKiz 3eXuo/TMXvHFy3CFNlEMylYuzQwh/qAQHARSg0tHq7OkZAL1OB7tWCkNbis39onj OzrRKkiW0h/x sFqyNwT&downloadAs=pobierz_Openoffice_V4.1.2.exe&fallback_url=http://.../

Remove pobierz_openoffice_v4.1.2.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.