home

sheetcam-tng-4.0.19.exe

SheetCam TNG

Software Association LLC

The application sheetcam-tng-4.0.19.exe by Software Association has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from sheetcam-tng.joydownload.pl.
Publisher:
Software Association LLC  (signed and verified)

Product:
SheetCam TNG

Version:
1.0.0.0

MD5:
8df086e6ae67816608fd43f0c971866c

SHA-1:
2e527634d7487ce5b618702b42039ee7d3f9a1ba

SHA-256:
cef75ec2fadc1e0f9e9eb9a633163c26b376eb6d0b1abfe56bfbd1e073ea0335

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
11/25/2024 11:50:17 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.OpenCandy.Software.Installer (M)
16.7.12.10

File size:
412.3 KB (422,152 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\sheetcam-tng-4.0.19.exe

Digital Signature
Signed by:
Software Association LLC

Authority:
DigiCert Inc

Valid from:
1/13/2015 1:00:00 AM

Valid to:
1/21/2016 1:00:00 PM

Subject:
CN=Software Association LLC, O=Software Association LLC, L=Dnepropetrovsk, S=Dnipropetrovs'ka Oblast', C=UA

Issuer:
CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0E1FC80B1C57AD69AA6F8D65D1CF90CF

File PE Metadata
Compilation timestamp:
5/20/2013 1:53:00 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:aiuCCwj5JjOywrR/1JdsfIZde0KO44rUvZEzA6pv1E:OfwjfCxrRLTdeUwvZEzA6pvm

Entry address:
0x331C

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, 98, 92, 42, 00, E8, A8, 2E, 00, 00, A3, E4, 91, 42, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, 90, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, E0, 81, 42, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
24 KB (24,576 bytes)

The file sheetcam-tng-4.0.19.exe has been seen being distributed by the following URL.

http://sheetcam-tng.joydownload.pl/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjykHBr6ZNTQvOh152P0sD4tl49bb1XsK7H NWG/wEZTcWmNG O1TOx0g UxjYPfWx6avCX5Dkzl yPq3rGC/4TF1T0cs55ziVZIRjD Xix 18kv9Dn7XWCeRb5Ow4TrND0VK BmPRNWOa72XTl1e8TcZkJ2nqqnGCAvaoT00 49D3ux8VDNlu0oQIC2M8ivZWNdzcr F sujUJW/4O h1/.../rFE6r9s glF54Izaa73cQw9nNMXu2EAmImvEy

Remove sheetcam-tng-4.0.19.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.