home

winrar-x64-521.exe

WinRAR

Software Association LLC

The application winrar-x64-521.exe by Software Association has been detected as a potentially unwanted program by 16 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from winrar-32.1800download.com and multiple other hosts.
Publisher:
Software Association LLC  (signed and verified)

Product:
WinRAR

Version:
1.0.0.0

MD5:
1964b97854784b34a070031c913bc09f

SHA-1:
a178764250ea84682fe82efa207d91b09b899762

SHA-256:
ec23cb50493ab23d1a54e7fc686b4ea0bfacd9cfed56db99a12920ca3f788961

Scanner detections:
16 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
12/28/2024 3:27:30 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.OpenCandy
2015.04.19

AVG
OpenCandy
2016.0.3135

Baidu Antivirus
Adware.Win32.OpenCandy
4.0.3.15418

Clam AntiVirus
Win.Trojan.Agent-855157
0.98/21511

Dr.Web
Adware.Downware.9759
9.0.1.0108

ESET NOD32
Win32/OpenCandy.C potentially unsafe (variant)
9.11495

Fortinet FortiGate
Riskware/OpenCandy
4/18/2015

G Data
Win32.Adware.OpenCandy
15.4.25

K7 AntiVirus
Trojan
13.202.15640

Malwarebytes
PUP.Optional.OpenCandy
v2015.04.18.08

McAfee
Artemis!1964B9785478
5600.6791

Panda Antivirus
PUP/OpenCandy
15.04.18.08

Sophos
OpenCandy
4.98

Trend Micro House Call
Suspicious_GEN.F47V0417
7.2.108

VIPRE Antivirus
Opencandy
39456

File size:
415.7 KB (425,648 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\programs\winrar-x64-521.exe

Digital Signature
Signed by:
Software Association LLC

Authority:
DigiCert Inc

Valid from:
1/13/2015 1:00:00 AM

Valid to:
1/21/2016 1:00:00 PM

Subject:
CN=Software Association LLC, O=Software Association LLC, L=Dnepropetrovsk, S=Dnipropetrovs'ka Oblast', C=UA

Issuer:
CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0E1FC80B1C57AD69AA6F8D65D1CF90CF

File PE Metadata
Compilation timestamp:
5/20/2013 12:53:00 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:4iubXEmZ7bkTRWytZbRgdkGESugzZHtsg0zO:EbXtJktWybFgdkGESp5td0zO

Entry address:
0x331C

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, 98, 92, 42, 00, E8, A8, 2E, 00, 00, A3, E4, 91, 42, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, 90, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, E0, 81, 42, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
24 KB (24,576 bytes)

The file winrar-x64-521.exe has been seen being distributed by the following 9 URLs.

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmV89fDKlEgq2JM7Y9uk353f/sGMxwdoOJ1WzMfi8YyL1hRYEIGjPEeCtCvJunfsxhtueBR6avCX8BlSh4Sfqmf6SpNjQm3EM Mty0hdfHHCjFzt3ld18tn7oUSCTRrZOnY hbnVSerJrJRkLMabyU3N5fcbFZREhhrOiS3I3c8b41 cnDGu/.../rFFSq94jvhAUnNGDHvHgfkA==?_ga=1.223432860.629004163.1429555921

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv I253eq ysyl4pHaAW7erC/NXq20hMBbCHdWfSkGqc8gLNmztTIT0zIvXrqBx/9uX 9gvPTrdjblGgIq5M6kQMdCCLySCx 18kq9Dn7X2qLS/.../hS iEcQe5MSxUTqw54ObwyYhb70AT4Y3KztnounkFxtrnBei3J5OECbzRlSnsZGnzQwvLHPNvngfkA==

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXBwj sXP7oQkEsnl0kPTqiHB/xcteQv E8/zq9sGMxwdwEPwC Nu jeDCuyxdSNGmeTbb7TOB10bIjzsWXFQ2U9j3zT0z0smn80qHDpYDSkGtA4p82iUcXHDb SGtnn5oj/y/.../HungfkA==

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmV89fDKjEgqkOYCGp h152T2qHo1koVMfAX6IL34Ina wUoNejaeEKqtG78lmuA01s3eDQ6b7Sz8Hk20sni1mbOI svT0mlNq4cygVBGU3W1AX1/lsk7oWjoUSCTR7ZOj56/Y2hAK6s5bBIJOb2hCSYrLYzcLVgoj6v2EyMsao6x2 4/HCnj5kjE3/VvDoC8ecS8ZDJW2cuvSKFkxl9A/.../HungfkA==

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxL7as6U7L10vCfjoWpgwJgELk31LuKoLXj/ylJSIGGOHu2gG6c8gLNjztTeXliD9HbyDU78 3G8geeI943KmiBBo58igFFQXzWtDjRnwpp1qznxGWmYSLZOj56/dWZFdfE0KwUKMa7pAzIqasWNLBgonuG9RjQuO4/x2/.../2zlL6ZLgq1D6tQMVa5NX8Gie97NbTiCdjbbRJV8B5K3RguuOtDxtzhVW60ddWRXO9UlixsZGnzQwvLHPBsXgfkA==

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXBwj sXP7oQkEsnl0kPTqiHB/xcteQv I253eq ysyl4pHaAW7erC/.../juEyIncYPx1 UyCGL5uFnFjrw1UIC2KcivZ3of1cK3D6l9yw8eroL h0r5Z6xnnG sAMVPt57vUXKquZOaiC8kdb0AT4A3Kyl67Le1Fllrjx66xZodTW6wRBC7pZ75wg0kICeM7XgfkA==

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklY NSrgQUawMZ7O/eUy8GD8o3Yng44cJgTtbrHuajv8mRYNIGjVEeijGrw0xb1hx8OWRAaT9T28SFT8 3G gefQvNKbm2JLq4dk2hYCCCfuT3wphshq9CLwSCTAHv4NitriNSUMK7MwJQpQcL38FXB4ctyJf0V20 anAC1mcob4w65sWnux61DOlPQvDpG3Ypv3O2NXnMu/F/snmw8eroL h0q4N/.../O IWB5Y2enUguvCmGBNzhVW61NdWVXW1FAawqZzu1Q0nO3bDu3gfkA==

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXBwj sXP7oQkEsnl0kPTqiHB/xcteQv A8/yan9np5ktEPJUykYr32LSXjnAANcHGHWOOkEqc2xrByz4WXBQaDoGzqBwX9v3GtzKyP oaf0nFA4p8yiUcGEGSsSTR0ntEo7CC5UGeTUuoFlJLzPHQNabE4PV9Wbe2mFGc3fsrTIxkjkvSsRzQuO4/z0ecnWjD58gae1bouWIC2M8inZWMbhp//TKs5nB8H5sv3i1LqO I1zm7zEcQE5Ma/.../rFFSq94jvhAUnNGDHvHgfkA==

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv c8/zOn/j1gwJgELE/tevylYTHtgkkQNGeRHuumBuB/lqtrh8yeDR7SpnvqBx/9uXO0yP/SpMuYyDdZqtY6gF9QVX hGDU2nsAj7HKjDnGSA7ZewtXiMyUMK7MxJQpJavvlXTl1fsTcJBkniKbnAC1mcoTy2/.../QnnQ8eroL7h0quMfYhwm60CIxX7c2pQnzgoZrTkC4qdfIHV49 M34pouO1FllriByigpUESm60FAaqqZvgxQYjPnPCvmkfkA==

Remove winrar-x64-521.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.