» wwe_1.43.5.6.exe
Overview
Analysis
File Details

wwe_1.43.5.6.exe

installation-sur-iphone.com

The application wwe_1.43.5.6.exe by installation-sur-iphone.com has been detected as a potentially unwanted program by 8 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars.

File name:

wwe_1.43.5.6.exe

Publisher:

installation-sur-iphone.com (signed and verified)

MD5:

1323236d1ba1f9d3808024c75a6bd25b

SHA-1:

c4a0c59fcf1cc3faba1b829ecbc147770f5968c3

SHA-256:

c4506d791b41c21fdfa27cc1485acc9262a4a870710d1b84f48e68c6b8106c5b

Scanner detections:

8 / 68

Status:

Potentially unwanted

Explanation:

Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:

11/27/2024 3:45:00 PM UTC (today)

Scan engine

Detection

Engine version

avast!

Win32:Malware-gen

160327-1

AVG

Adware AdPlugin.DEO

2015.0.4355

Dr.Web

Adware.Searcher.2853

9.0.1.05190

Emsisoft Anti-Malware

Adware.Generic.1283396

11.5.0.6191

ESET NOD32

Win32/Wajam.AI potentially unwanted application

8.0.319.0

Kaspersky

not-a-virus:Downloader.Win32.Wajam

15.0.0.562

Norman

Adware.Generic.1283396

02.04.2016 17:35:19

Reason Heuristics

PUP.OpenCandy.Bundler (L)

16.5.6.22

File size:

3.3 MB (3,499,640 bytes)

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Common path:

C:\users\{user}\appdata\roaming\opencandy\e5aacfef3c0e48988fd864c64ab5401d\wwe_1.43.5.6.exe

Digital Signature

Signed by:

installation-sur-iphone.com

Authority:

thawte, Inc.

Valid from:

3/24/2015 8:00:00 AM

Valid to:

3/24/2016 7:59:59 AM

Subject:

CN=installation-sur-iphone.com, O=installation-sur-iphone.com, L=Montreal, S=Quebec, C=CA

Issuer:

CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:

4B3B4C34A65749DBB9235BE933415AEC

File PE Metadata

Compilation timestamp:

12/6/2009 6:53:18 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

98304:DDFg9CiKcfcOS/pkX3cQrRc9192Q+ZkFaY/gON7soze:DDiwAY/pkcsW7FaYpJtze

Entry address:

0x36A0

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 88, A7, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 80, 40, 00, 53, FF, 15, 88, 82, 40, 00, 6A, 08, A3, B8, 63, 42, 00, E8, EE, 2E, 00, 00, A3, 04, 63, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, B0, 0C, 42, 00, FF, 15, 58, 81, 40, 00, 68, 10, A8, 40, 00, 68, 00, 5B, 42, 00, E8, F4, 29, 00, 00, FF, 15, B0, 80, 40, 00, BF, 00, C0, 42, 00, 50, 57, E8, E2, 29, 00, 00... 
[+]

Entropy:

7.9963

Packer / compiler:

Nullsoft install system v2.x

Code size:

24.5 KB (25,088 bytes)

Remove wwe_1.43.5.6.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.