home

wwe_1.43.5.6.exe

installation-sur-iphone.com

The application wwe_1.43.5.6.exe by installation-sur-iphone.com has been detected as a potentially unwanted program by 3 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars.
Publisher:
installation-sur-iphone.com  (signed and verified)

MD5:
3521bb1c368d3efe2b820f069ed3a9d6

SHA-1:
d3fee06c3a63ba08531b14e6534a4d1a0e08f7d5

SHA-256:
083560bc1d7c382fd56f06f445aeb556827cbc3c1d8822a64922c43a6b4c1681

Scanner detections:
3 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
11/27/2024 3:34:46 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Malware-gen
160326-0

Reason Heuristics
PUP.OpenCandy.Bundler (L)
16.4.12.14

VIPRE Antivirus
Threat.4150696
48238

File size:
3.3 MB (3,499,640 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\appdata\roaming\opencandy\900c4183ab2b4c4eac12c90dcb4356a0\wwe_1.43.5.6.exe

Digital Signature
Signed by:
installation-sur-iphone.com

Authority:
thawte, Inc.

Valid from:
3/24/2015 7:00:00 AM

Valid to:
3/24/2016 6:59:59 AM

Subject:
CN=installation-sur-iphone.com, O=installation-sur-iphone.com, L=Montreal, S=Quebec, C=CA

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
4B3B4C34A65749DBB9235BE933415AEC

File PE Metadata
Compilation timestamp:
12/6/2009 5:53:18 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
98304:DkFg9YiKcfcOS/pkX3cQrRc9192Q+ZkFaYSgON7soze:DkiiAY/pkcsW7FaYoJtze

Entry address:
0x36A0

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 88, A7, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 80, 40, 00, 53, FF, 15, 88, 82, 40, 00, 6A, 08, A3, B8, 63, 42, 00, E8, EE, 2E, 00, 00, A3, 04, 63, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, B0, 0C, 42, 00, FF, 15, 58, 81, 40, 00, 68, 10, A8, 40, 00, 68, 00, 5B, 42, 00, E8, F4, 29, 00, 00, FF, 15, B0, 80, 40, 00, BF, 00, C0, 42, 00, 50, 57, E8, E2, 29, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
24.5 KB (25,088 bytes)

Remove wwe_1.43.5.6.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.