home

winrar-x64-521.exe

WinRAR

Software Association LLC

The application winrar-x64-521.exe by Software Association has been detected as a potentially unwanted program by 10 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from winrar-32.1800download.com and multiple other hosts.
Publisher:
Software Association LLC  (signed and verified)

Product:
WinRAR

Version:
1.0.0.0

MD5:
de14bd9465062b5a0d5dbda11cce8a98

SHA-1:
a4350ffb290af8f57324f3bd2a499cca3e7524bc

SHA-256:
99f473043e02357ce024d7848032b5e7c5ddcb89f02ff08cdb47f6c3e0519e92

Scanner detections:
10 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
12/26/2024 8:41:10 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AVG
OpenCandy
2016.0.3048

Clam AntiVirus
Win.Trojan.Agent-855157
0.98/21511

Dr.Web
Adware.Downware.9759
9.0.1.0102

ESET NOD32
Win32/OpenCandy.C potentially unsafe (variant)
9.11448

G Data
Win32.Adware.OpenCandy
15.7.25

K7 AntiVirus
Trojan
13.202.15538

Malwarebytes
PUP.Optional.OpenCandy
v2015.07.14.04

McAfee
Program.Artemis!DE14BD946506
16.8.708.2

Trend Micro House Call
Suspicious_GEN.F47V0401
7.2.195

File size:
415.6 KB (425,584 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\winrar-x64-521.exe

Digital Signature
Signed by:
Software Association LLC

Authority:
DigiCert Inc

Valid from:
1/13/2015 7:00:00 AM

Valid to:
1/21/2016 7:00:00 PM

Subject:
CN=Software Association LLC, O=Software Association LLC, L=Dnepropetrovsk, S=Dnipropetrovs'ka Oblast', C=UA

Issuer:
CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0E1FC80B1C57AD69AA6F8D65D1CF90CF

File PE Metadata
Compilation timestamp:
5/20/2013 6:53:00 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:7iubfgAub1k7Q6zsMtYgiedA46g6fFW6gQ0ZF:1bfZck7bs5u6g6tPf4F

Entry address:
0x331C

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, 98, 92, 42, 00, E8, A8, 2E, 00, 00, A3, E4, 91, 42, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, 90, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, E0, 81, 42, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Entropy:
7.8394

Packer / compiler:
Nullsoft install system v2.x

Code size:
24 KB (24,576 bytes)

The file winrar-x64-521.exe has been seen being distributed by the following 20 URLs.

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXBwj sXP7oQkEsnl0kPTqiHB/xcteQv A8/yan9np5ktEPJUykYrn2LSz/0l8bOGSGCa7 RuFohPpyz4WXBgyb7XuhTwar6TL6yanDpZrSmGlZ5sxuwQQASXWlGDU2nsUj7H2lBjfMAq5Xi83iPSUGbbAgJFsFNaXlAzI/IYybNBB7hqDgEC4nfITz0 U TWO uEiZxaM5Fpn esOmZWMbhp//TKs51xsR8I3/.../rFFSq94jvhAUnNGDHvHgfkA==?_ga=1.139112051.1567440074.1428237413

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjylEBD2adrXseh152f0sCw22dBNJ0bterruNDC2wVRSIDfVWKn7SfxygeVyz4WXDgaDuHamThe1pXi9mf6SpNrSgyMS9Yc7wF9BXmSmAzhnn4Aj/CHoBSCLS/9Wz83zcG5ZPOZ1bAoEcKXxXGgpJ5Kac1kwh LuESw3eYD7w Z2BGqwoAOWyO1nR5i/etCta2NXnMu F/.../vGx58ixSxyYgMRj7qRQfwqYinnls3NSvOuWIfkA==

http://winrar-32.ar.1800download.com/get_azure_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEhr4coOQp h152L0sC8rlY9RagT1Y/j2OXmulgsEZjbOCeLkErY90bhlzdSWRAaS9T2hVRLlszi1if/Drd3KmiBBp58i1h0CDTTyGDUsnsIt/CPzW2udQLhXi83iPSVBMe0gJFsFNaXlVHh6fMnNNBBhhqDkGDRxIcayjbx8SyvmoFGMlvZmFtXkLoD/.../vGx58ixSxyYgMRj7qRQfwqYinnls3NSvOuWIfkA==

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsm10kPjGhChOxat/Zp6BvuXf1 2Jzw9BNJ0TteuKla2G3g15aOHGPH/usW781yaskgNSWRAaQ9T35Hk20snm1maqSvNKbm2RBs9Jp3QEdEzW1AX1/ksk7qHSmDjbbUrcfwsTrJTYCYas5bBIJOb2iHjomOpvcLUIojaXmGi4nfIb60eZ2BG2woAyWwKp D9G3ccqkfTYFgYPsX/.../HungfkA==

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPDy1E1v4Y9bB9rpi/26nqGl6wJgEKU31PuKgamG3g15ZOmmeXLD5WuR13vFmwNuYBQ2PqmetHk20sni1mbWI svT0mlIq4cxilNQXzWtDDRnwYtpp2mvSGjASr1Yys/pMz8GYbo5bBIMOb2xDy5tc43EIBEwjqPhFiEmao6x2 8/.../Lbh 1CanA8VPup74AyW4 tTSxj4rJLxKT5Z6YCFh4aC6HhhzhVW60ddWRXO9UlixsZGnzQwvLHPBsXgfkA==

http://winrar-32.ar.1800download.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1GR37cteQv A8/yOn9np5iNEIJ1Xlar74OHCuyxdSMWmeQrDzCr50ybtq1sWZFQfS9S3yHhm0qnD8gfLbvJ6BzzcU5tYiiBZIVny1Tnpnn4Aj/yHoW3GSA7ZfwtWibmMVY A4LhAEcKXzXGgpIZKbNBBhhqDsGDRiIduwgK8oRm r1/NneE5TMeve4GkbHtOn5jpD JnlR4f/.../aD0 s C1FllriByigpUESm60FAaqqZvgxQcgOHHEu20fkA==?_ga=1.267312395.485802516.1428559337

http://winrar-32.il.1800download.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsm10kPjGhChOxat/Zp6BvuXf1 2Jzw9BNJ0Hteu60fyr lUZTa2mNH uvHLU/w7hiz4WXAwaDqXakWVT8 3G g//D6YCG0zIJvN02h0hHVne5X3Yghshq9CnwSCfdUrcfwsbrJTYVY/.../zDU75pJD2gFZ7ai2D 3gfkA==

http://winrar-32.1800download.com/get_azure_file/.../yOn9np5iNEIJ1Xlar74OHCuyxdSNmmeTbD7Tac8gLNhzMyPQFXPvX66EQ7xvGa6ifTP 5GNg2gIq5Y6kQwbAGSsSTR3ntEq jnxGWmaSq4fkZPzPG4NabE5bBIOM6XlAiM8OJKfb15g0LPvUSwscpe1iLN3XyunsVjdl7xmBpivNIa8ZDJW3suvHPsv3BcT55qoxRihLP9nnHWsAstf5sGzQHnusprTkC8qdfYaEZY2enUguvCmFBxzhVW60ddWRXO9UlixsZGnzQwvLHPBsXgfkA==?_ga=1.75760085.1725506963.1428679087

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmV89fDKlEgqtI87Y9ukx53e5 zYmlJxNP0ykYr32LSb0gA0aZ3GHQuOmHLc/xbFmxcWZDE b/.../RsmRkI6Ir8kw2wO7h 1CanA8VPup74AyW4 tTSxj4rJLxKT5Z6YCFh4aC6HhhzhVW60ddWRXO9UlixsZGnzQwvLHPBsXgfkA==

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxL7as6U7L10vCfjoWpgwJgEL031N/juNDC2x15KdTrST7bgW6c8gLNmztTIT0zIvXrqBx/9uX 9g/.../lcsj7GyjBCHIAqEUzsP8MjUGdux6egoEcKXxXGgpJ5Kac1kwh LuESw3eYD7w Z2BGuwoB6LjvQvDpO3YsO8ZDJW3MuvXbBwjRZW54v3n1nxaLh 1CalCd0et5OpSCDjspmb2SYjbaQaHNAvMjwpsui1Hh5zhVW61NdWVXW1FAawqZzu1Q0nO3bDu3gfkA==

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXBwj sXP7oQkEsnl0kPTqiHB/xcteQv E8/zq9sGMxwdwEPwC Nu jeDCuyxdSMGmeX621E/Y9wrNyxdSWRAaQ/.../Qc1N3nqqnGCUvatyrhf8 TWO4uEjMmO1nR5i7etD7JzEFnZSvFrAunhkX5YH jVn bKE2nS sEYwEutWwGnPou5rTkCoqdeAcGdBoe20o8 ikFwhgix i3J5OECbzRlSnsZGnzQwvLHPNvngfkA==

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsm10kPjGhChOxat/Zp6VvuXf14WJ0wckML0Ljb7juNDC2w15KcTrYCeL ErQ/.../aD0 s C1FllriByigpUESm60FAaqqZvgxQcsPHPHvWMfkA==

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPDy1E1v4ZNbB47pquHf14WJzw9Ecah65Kuq Iju6xEldMGKSTqHyCr50ybpq1oDEUx6avCX BlT1un67jPbDpZrSl2lZ9N1w2hcXRn3 AD9xlssu/Sz5WmKSA7ZfwtWibmMVY A4LhAEcKX0XGg/.../rBAfh5972zEwvP3jWuXgfkA==

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv E8/yG6sGMxwdoEP0b1Y/j2OXmulgsEZjbOCeLkErY90bhlzdSWRAaQ/yXqWB 0 CfuwrCT8svT0mlCq4d32gsABTS6CTxnn4Aj/SHoGjrNUrcfwsTrJTYObqs5bBILOb2hDyYqasWNLBoqhrOjS3hnKcfvmesxE2y4s0Sa1Kp D9G3c8i8NigIzcr F sujR4R/.../O3ont G1FllriByigpUESm60FAaqqZvgxQcnO3XCuW8fkA==

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmV89fDKlEgq2JM7Y9uk353f/sGMxwdoOJ1WzMfi8YyL1hRYEIGjPEeCtCvJunfsxhtueBR6avCX BlSh5yfr3rfDpZrSkmlZoJA5kV4BXnWtGGcswNEivSH4UHGaRK5Xi83lPSVRMeVnPRNMOa7/XGg4IZCMd1k/.../h0qnLbh 1CahCd0at5nvHD6qoZrTkC8qdfAaEZY2enUluvClHx9liRWi3J5OECbzRlSnsZGnzQwvLHPNvngfkA==

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1GR37cteQv E8/zq9sGMxwdwEPwC Nu jeDCuyxdSMGmeX621E/Y9wrNyxdSWRAaV9T2uVRqiqnD8gfTZpMufyD0J8Ncty1NGSXOlCyAg3JY79WjwWWmLBuUI2syiPTENerswKhwIML38FXB8ctyXf08wh LuECw3e4Hg2q4/D2mwoA6W378wVdv4Mp68ZDJW1suvWrB63UxX8Iv/.../hXnuQ5Yfu9WwGnPot5OYmCUpb7ZCTsc3OnUx8LvzDxEihBW6xdxNFT7qRQfwqYinnls3NSvOuWIfkA==

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsm10kPjGhChOxat/Zp7pvuXf14WJwwckNKVXsK7H/NWH6mQBKOSCGHeO1Grcyx75j1s3eDQ6b7Wu8Hk20snq1mfTDpZrSkGNBs8FpwBUeBT/iSGJnn4Aj9yHoHTrHAu0e1cTjJTxEYr04PU5Wb/rlXTl1ecbENFx70uO1UDttfoHv1O80EDzy50jE3/.../4O h1vyfOkswz6tWsVc5sz4SXvjoc7TiCdjbbFJV8NkZyt896G1FllriByigpUESm60FAaqqZvgxQciOnfNvGIfkA==

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPDy1E1v4Y9bB9rpi/26nqGl6wJgEL031N/.../RsmRkI6Ir8kw2wO7h 1CanA8VPup74AyW4 tTSxj4rJLxKT5Z6YCFh4aC6HhhzhVW61NdWVXW1FAawqZzu1Q0nO3bDu3gfkA==

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEh74comb9bp0uHf1 2Jzz9kGKkHlbr35NDC2xl5KZDzQT7zlCr50ybpq1seYDh6avCX5DEzl7CL8y6mA55yazXFA4p85iUcFDSjlW3xol8E79WjwWWmLAOUI2syiPTQNerg7KQoEcKX0XGgmIZrcLVgojqv2ESI3c8b40ucnSDDuoFGMlvlmFpC/dcapbGNXnMu5F/tyxkFA/4O h1nwZLgyznLkUo1ApsG/Xnzrso/.../zDU75pJD2gFZ7ai2D 3gfkA==

http://winrar-32.1800download.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv A8/yWn9np5iNENJ1XmYb3uNDC2xl5KZyvMQqvyCr5uybhkxs6aBAWQ/irzT0z0smnm0qHDpZrSk2lZopEiiBZIUny1XGEpwJZr7CC5UGCTUr1ZwdXqdD0EYqt0dkwdOOz9UHBteszLIhwhnqqnGCIvatOrjbgnBSqws1LFjrg1WtDsMt/maXVB2sO8A7xsyg8eroL/.../Mz4SXjpuYPEw29gO cKAMZhK3RguuutD1040FThlcBHET7qRQfwqYinnls3NSvOuWIfkA==

Remove winrar-x64-521.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.