» wwe_1.43.5.6.exe
Overview
Analysis
File Details

wwe_1.43.5.6.exe

installation-sur-iphone.com

The application wwe_1.43.5.6.exe by installation-sur-iphone.com has been detected as a potentially unwanted program by 6 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars.

File name:

wwe_1.43.5.6.exe

Publisher:

installation-sur-iphone.com (signed and verified)

MD5:

16d3cc18734f03be9ffd591586cf75c8

SHA-1:

522cdeb854f65d93f28928a47088a7e1c2a6fe37

SHA-256:

e02089ca8b05d802d211a4ae173b5bf882fe6e3e35ca90cf7c7689f2bc5fe2b5

Scanner detections:

6 / 68

Status:

Potentially unwanted

Explanation:

Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:

11/27/2024 3:58:30 PM UTC (today)

Scan engine

Detection

Engine version

avast!

Win32:Malware-gen

160327-1

Dr.Web

Adware.Searcher.2853

9.0.1.05190

Emsisoft Anti-Malware

Adware.Generic.1283396

11.5.0.6191

ESET NOD32

Win32/Wajam.AI potentially unwanted application

8.0.319.0

Norman

Adware.Generic.1283396

02.04.2016 17:35:19

Reason Heuristics

PUP.OpenCandy.Bundler (L)

16.5.8.15

File size:

3.3 MB (3,499,640 bytes)

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Common path:

C:\users\{user}\appdata\roaming\opencandy\78dd935f158843f2b88a2e6b9cc68370\wwe_1.43.5.6.exe

Digital Signature

Signed by:

installation-sur-iphone.com

Authority:

thawte, Inc.

Valid from:

3/24/2015 5:30:00 AM

Valid to:

3/24/2016 5:29:59 AM

Subject:

CN=installation-sur-iphone.com, O=installation-sur-iphone.com, L=Montreal, S=Quebec, C=CA

Issuer:

CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:

4B3B4C34A65749DBB9235BE933415AEC

File PE Metadata

Compilation timestamp:

12/6/2009 4:23:18 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

98304:DDFg9CiKcfcOS/pkX3cQrRc2192Q+ZkzaYSgON7soze:DDiwAY/pkcsx7zaYoJtze

Entry address:

0x36A0

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 88, A7, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 80, 40, 00, 53, FF, 15, 88, 82, 40, 00, 6A, 08, A3, B8, 63, 42, 00, E8, EE, 2E, 00, 00, A3, 04, 63, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, B0, 0C, 42, 00, FF, 15, 58, 81, 40, 00, 68, 10, A8, 40, 00, 68, 00, 5B, 42, 00, E8, F4, 29, 00, 00, FF, 15, B0, 80, 40, 00, BF, 00, C0, 42, 00, 50, 57, E8, E2, 29, 00, 00... 
[+]

Entropy:

7.9963

Packer / compiler:

Nullsoft install system v2.x

Code size:

24.5 KB (25,088 bytes)

Remove wwe_1.43.5.6.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.