home

xpadder-5.7.exe

Xpadder

Software Association LLC

The application xpadder-5.7.exe by Software Association has been detected as a potentially unwanted program by 18 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from xpadder.joydownload.com and multiple other hosts.
Publisher:
Software Association LLC  (signed and verified)

Product:
Xpadder

Version:
1.0.0.0

MD5:
85fb91c40f220fe5a12c52e87dbcc8f0

SHA-1:
d783a2c3a23890bc4ca6e0ab5320c5f71cdae1fc

SHA-256:
a1e4df0ed42fc5bd498fcd630a4c7c7b73d8897037df6c5da197b6fa058b6307

Scanner detections:
18 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
4/18/2025 6:01:35 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.OpenCandy
2015.09.01

AVG
OpenCandy
2016.0.3000

Baidu Antivirus
Adware.Win32.OpenCandy
4.0.3.15831

Bkav FE
W32.HfsAdware
1.3.0.6979

Clam AntiVirus
Win.Trojan.Agent-855157
0.98/21511

ESET NOD32
Win32/OpenCandy.C potentially unsafe (variant)
9.12178

G Data
Win32.Application.OpenCandy
15.8.25

K7 AntiVirus
Trojan
13.2017058

Malwarebytes
PUP.Optional.OpenCandy
v2015.08.31.04

McAfee
Artemis!85FB91C40F22
5600.6656

NANO AntiVirus
Riskware.Win32.Downloader.dqybkl
0.30.24.3283

Panda Antivirus
PUP/OpenCandy
15.08.31.04

Qihoo 360 Security
HEUR/QVM42.1.Malware.Gen
1.0.0.1015

Reason Heuristics
PUP.OpenCandy.Installer (L)
15.8.31.16

Sophos
Generic PUA CJ (PUA)
4.98

Total Defense
Heur/TrojanHorse.ZCID!suspicious
37.1.62.1

VIPRE Antivirus
Trojan.Win32.Generic
43348

File size:
415.7 KB (425,664 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\programs\xpadder-5.7.exe

Digital Signature
Signed by:
Software Association LLC

Authority:
DigiCert Inc

Valid from:
1/13/2015 4:00:00 AM

Valid to:
1/21/2016 4:00:00 PM

Subject:
CN=Software Association LLC, O=Software Association LLC, L=Dnepropetrovsk, S=Dnipropetrovs'ka Oblast', C=UA

Issuer:
CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0E1FC80B1C57AD69AA6F8D65D1CF90CF

File PE Metadata
Compilation timestamp:
5/20/2013 3:53:00 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:OiupnfYa8VgbdSln8cDs5eDg7rfghBEwD:KpXhbdSlNowD1D

Entry address:
0x331C

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, 98, 92, 42, 00, E8, A8, 2E, 00, 00, A3, E4, 91, 42, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, 90, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, E0, 81, 42, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Entropy:
7.8716

Packer / compiler:
Nullsoft install system v2.x

Code size:
24 KB (24,576 bytes)

The file xpadder-5.7.exe has been seen being distributed by the following 3 URLs.

http://xpadder.joydownload.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjykEBvyYtTSs h152b0sDErn8kFbk3lYqn/PmG3g15ZMmmeT7DkWOlmivwimNSWRAaW9T2wTBej7C79mf6SpN3SgzUS/cAiiBZIVXOtGHY1xZd9q2nnX32eXukUndXqdD0EYqtydkwdOOz9UHBtecbGJxIqnqqnGCUvasOrhf8 TWO8uEjNnv5qA5Kve4GkbHtOnJjpD J9lRweroL/h0q8Krh 1CanCd1c/Mz4SX/.../M20hsvCsXhBjhATvlM9PUCbmDB 0 sSwmEhmLHmJ

http://xpadder.joydownload.com/get_azure_file/wUiS4WnYccXBwj sXP7oQkEsnl0kPTqmHh/ycteQv E8/yG6sGMxwdoEP0b1Y/j2PHmugw0MIGjVEeisW78zyas2nZrIFQfS9S79BlS/ Crr36CTs9zGln0e6cAiiBZIVXatGGos14N1r2K/GD LS/9Wz83zf3dWPO1nbQoEcKXxXGgpJ5Kac1kwh LuECw3eofg2q4/.../liiiAclf6M QHKquZKaiGx5M6RIBo47M20iuOqmFBJzhVW61NdWSnW1FAawqZju1QwkLHmJ

http://xpadder.joydownload.com/get_azure_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEhv4cpqK4fE9rm/4qHpwydoIKkf1Y/j2OXmulgsEZjbOCeLkErc90bti1s3eDQ b7WyhWFT84XG gLbbqtPKxzoX9Ic7wF9DUXy1Qn4kwJd8vDb/RGSHFfQJ2syiPTENeux6b0FNZr38D3B fMrLJh8hhaXkGWUve4/giLRhHGL5uFjFjvxtFpn esCkfS4fzcr F 4ujVpMs9yiyhvqZel/.../rAAfhopLsxgYtLHmJ

Remove xpadder-5.7.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.