home

7dc96d577964c90f037566d56920e77b83c873bc7c7acf1c13d24743d7dd229e

Sakysoft s.r.l.

The file 7dc96d577964c90f037566d56920e77b83c873bc7c7acf1c13d24743d7dd229e by Sakysoft s.r.l has been detected as a potentially unwanted program by 12 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent.
Publisher:
Sakysoft s.r.l.  (signed and verified)

MD5:
ad9e663d60a1b4373c00f725ed19fdb8

SHA-1:
c9102e60eb6003a1c77c557f18371351aaf6586b

SHA-256:
7dc96d577964c90f037566d56920e77b83c873bc7c7acf1c13d24743d7dd229e

Scanner detections:
12 / 68

Status:
Potentially unwanted

Explanation:
Bundles additional adware offers during download and installation using the OutBrowse installer.

Analysis date:
4/25/2024 4:24:34 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
MemScan:Application.Bundler.Outbrowse.E
5670435

avast!
OutBrowse-C [PUP]
150602-1

AVG
Adware AdLoad.G
2014.0.4311

Dr.Web
Adware.Downware.3980
9.0.1.05190

Emsisoft Anti-Malware
MemScan:Application.Bundler.Outbrowse
10.0.0.5366

ESET NOD32
Win32/OutBrowse.S potentially unwanted application
7.0.302.0

F-Prot
Trojan!9d14 (exact, not disinfectable)
4.6.5.141

F-Secure
Riskware.MemScan:Application.Bundler.Outbrowse
5.14.151

Kaspersky
not-a-virus:Downloader.Win32.Agent
15.0.0.543

Norman
MemScan:Application.Bundler.Outbrowse.E
02.06.2015 14:23:46

Reason Heuristics
Win32.Generic.Installer.Meta
15.6.5.0

VIPRE Antivirus
Threat.4784459
40786

File size:
967.2 KB (990,448 bytes)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Digital Signature
Signed by:
Sakysoft s.r.l.

Authority:
COMODO CA Limited

Valid from:
3/4/2014 1:00:00 AM

Valid to:
3/4/2016 12:59:59 AM

Subject:
CN=Sakysoft s.r.l., O=Sakysoft s.r.l., STREET=Via Gorghi 6, L=Udine, S=UD, PostalCode=33100, C=IT

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00ECE0C7777AC73E48E3B63042EDCAEEB6

File PE Metadata
Compilation timestamp:
12/5/2009 11:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
24576:5wYzbrTZBqf+3pR2/bg/0fPzWJkUH1acWio5U1e3ibX:pfTjqAR++0nzWJkUVacjPY+

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9248

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.