home

ac3filter_2_5b.exe

AC3Filter

Alexander Vigovsky

The application ac3filter_2_5b.exe, “AC3Filter Setup ” has been detected as a potentially unwanted program by 4 anti-malware scanners. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. This file is typically installed with the program MonkeyMote 4 MediaMonkey by Obsidium Software. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars.
Publisher:
Alexander Vigovsky

Product:
AC3Filter

Description:
AC3Filter Setup

MD5:
28577a1789f98076f5a32abc78cb379e

SHA-1:
cec6d5b7d6f8a2d613069f3d0f882cfe23c4b92a

SHA-256:
65e6457c90193063ac8fd1776e0f290825aa36f6f0eebc5ad6c7f7316b59837e

Scanner detections:
4 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
4/24/2024 2:12:42 PM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Threat.Undefined
9.0.1.05190

ESET NOD32
Win32/OpenCandy potentially unsafe application
7.0.302.0

K7 AntiVirus
Trojan
13.174.10588

Reason Heuristics
PUP.OpenCandy.Installer (L)
16.11.29.2

File size:
4.4 MB (4,563,950 bytes)

Product version:
2.5b

Copyright:
Copyright (c) 2002-2012 by Alexander Vigovsky

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\ac3filter_2_5b.exe

File PE Metadata
Compilation timestamp:
12/20/2011 11:16:50 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
98304:fO0hpdRkJSbK8ZflacRFIWgL8nt+5IDe7r23detRqj:f5dbbKSflaoFlQ8t+5Nu3eqj

Entry address:
0x16478

Entry point:
55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, B0, 52, 41, 00, E8, AC, 03, FF, FF, 33, C0, 55, 68, 45, 6B, 41, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 01, 6B, 41, 00, 64, FF, 32, 64, 89, 22, A1, 48, AB, 41, 00, E8, 4E, EC, FF, FF, E8, F5, E7, FF, FF, 8D, 55, EC, 33, C0, E8, 7F, 84, FF, FF, 8B, 55, EC, B8, AC, D6, 41, 00, E8, E2, E9, FE, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, AC, D6, 41, 00, B2, 01...
 
[+]

Entropy:
7.9915

Developed / compiled with:
Microsoft Visual C++

Code size:
84 KB (86,016 bytes)

The file ac3filter_2_5b.exe has been discovered within the following program.

MonkeyMote 4 MediaMonkey  by Obsidium Software
Publisher's description - “MonkeyMote Music Remote Lite is a wireless Winamp / MediaMonkey / AIMP / JRiver Media Center remote control for your iPhone or iPod touch.”
www.monkeymote.com
About 8% of users remove it
 
Powered by Should I Remove It?

The file ac3filter_2_5b.exe has been seen being distributed by the following 42 URLs.

http://gsf-cf.softonic.com/cec/6d5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_es&type=PROGRAM&Expires=1470741402&Signature=CrfG7LHqhO4HrWOkGxkhP~X07gvosYfV5KKcP0zYCkAzg2iOxcol2hSS22IgAY-prtfWzuLHgdK7AI2GLnm9V3BmLol1W~rTTU6~hBjt4tGqt6rlU596jvZxEqepfCdLyYbEU76Upe3d1XXdsVl9SDEJ1attNBrs-KLw3FMLnd0_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=ac3filter_2_5b.exe

http://gsf-cf.softonic.com/cec/6d5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_en&type=PROGRAM&Expires=1444277705&Signature=GI~udlyYOT0EnPCX3~aBE27ccTeNSmjJQkzQOby336Ky2V1qJa~qyV9FB44Pg6pdNrnQOrYQg6gyDQz6DWYQPn7v3TAJvbozIKXKJN57mCwdBNDRnlt2T-D6lCnEKFePrubzJEnLvabK1YPYh2O4wBMo9cOxoKOzHbG2nLglzpQ_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=ac3filter_2_5b.exe

http://gsf-cf.softonic.com/cec/6d5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_br&type=PROGRAM&Expires=1476325969&Signature=bzjIBQPQnoWGn6v5X3YtXowpLapKEr49ffRrrOM5lIg8u7C6V7eMqVZypxpEqjNzsv8J1jCy8r9h7OlnWxv5yegqQo02zqRQDOuOPzbLxGjt5cbwX8ySmrRzNRYZGXBW6YA-5QpVJH7DSVFm6AsEm-4cdZOfEI69c1rFN6M2h9c_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=ac3filter_2_5b.exe

http://gsf-cf.softonic.com/cec/6d5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_br&type=PROGRAM&Expires=1476085358&Signature=YRUzFa5NXaLK73Q1vcNuhlL3JOWJmWIWcAB21EA4bG-PPbL0e~Va00f-vrup1B9BzLWLI8Nl2YeJhkWsVIpbkUkFhxsUSLTPahCsDf2Wa-QiaSpCPHW4GsRdCDKxksmm2gwF847PLmVJ7TEkvFPLnys5lzIOUeOJQvMm288Hg8E_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=ac3filter_2_5b.exe

http://gsf-cf.softonic.com/cec/6d5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_en&type=PROGRAM&Expires=1421548186&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=auGenwEPXLKn1b6I7RV5EiORhTDCU8eY8Wbw8mIFandcpWkr8Vs5uE5RFmc~4~5HFSU2uaxXE-dPgpxn8kMuUrY9v9ztqqlSHU2obOhbeREGEDhczZ3~AdvJxUzSNDj8VNLBDz5w8b9RcIVuAD5wpZm6dC0Ym9fBMft-P~m-5XQ_&filename=ac3filter_2_5b.exe

http://gsf-cf.softonic.com/cec/6d5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_en&type=PROGRAM&Expires=1448291266&Signature=BeHOc5g0Qja7Ufi0ICQTo-8xYvnXp7bnyf~TvqR-020Il1UWQsmL4SofssDC4IAnjaVL2w5aVfDFDJiqYxyaa8ZbZVuQumhbxpXGV~gW5mqNIAh1WzOR3zVfW1vb7Qqk9sxx2-VGsCYJ5LR~8BC6JnRoHAB7Ak7~pEAZAX0hLDE_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=ac3filter_2_5b.exe

http://gsf-cf.softonic.com/cec/6d5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_es&type=PROGRAM&Expires=1449750476&Signature=CBgtLQRP9WzZM82Bw8-~vwhuBa98Nwfr5kOts414UYLa0DkQKkoDQAbND2huK4WA6EwJTNkS2ngkha9BD2O4kiDo-fCfYn3wR5uqVdePMx7XFLgoseR8rZ3iBRTb1fyfGVcV0AVUI~FsfqSZ5ewHCjM4pSCzfjrKDAK7HuchFQE_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=ac3filter_2_5b.exe

http://gsf-cf.softonic.com/cec/6d5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_en&type=PROGRAM&Expires=1451633357&Signature=VTozA2prBVSYqF0FXH9EZl7tweZLfITB1xlkXtGecM7zMnXXnKRLdNLMpXak-sL6tLUVq3b7sKWYeyDo9IfO771LBUCO1TSu22BjGkBtuizxfIspShOG2FAYGTdvurb-YNjKG4Uakrzm~lXWkTkb3JtSreTnKlaKumHmAQt68vo_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=ac3filter_2_5b.exe

http://gsf-cf.softonic.com/cec/6d5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_br&type=PROGRAM&Expires=1471872082&Signature=IGZgvaLTvs8PmZMZCMu9lFuZq4x2a8NgqroSN~bbMkwIh8n2TEMvoqCuqehVQeIZjWxNKaLbkAaMtIVXiE9ThU5OjgqNiNdJICHztRdl7kzKE-w6-LbIc268jjemiaaEbKRw3-ImDGaDsId-On1sBiE-x8Em2jq5ZMduuWW~FmQ_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=ac3filter_2_5b.exe

http://gsf-cf.softonic.com/cec/6d5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_br&type=PROGRAM&Expires=1469398140&Signature=Yc0uLTEfX3hrDVj-HOSxlaWUGQzC9Y7KtSxiDmybH8baPKmmuoz6IjQ42w2IVluEpVOO4HOD8jgbEwHo9ioFsQ13d~-1kwz04qbXow3-c-MpxDTL~bc0LYAOCAwYOXKJo6mI3N1zeuGcQ6mW6Vm0WTEvysScMLL5PDbhPrWy27Q_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=ac3filter_2_5b.exe

http://it.dcps.tn.edu.tw/project/downloads/???/.../ac3filter_2_5b.exe

http://gsf-cf.softonic.com/cec/6d5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_en&type=PROGRAM&Expires=1468913553&Signature=X605dwWECA8HV0Ha5qLjCLBWccTXRpibz8Eachpdn7Ig3lZLVbOWfPS9pDzSUz5vxYItBLwyaEKiG2-s4jHa521Sy8pZA-XDVlu3WO22u0p3WE07csHhgz52DujYmeThMzmsAMxOZK6IKa0~QFPQ~FYd1bcGEcBpv5Kxhd1InTo_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=ac3filter_2_5b.exe

http://gsf-cf.softonic.com/cec/6d5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_en&type=PROGRAM&Expires=1428470786&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=Soij21cpyKuXDDAtDaXXnzLOZQ-lgWg68IS8VjfYlGIqa5pE~2ISRQFJGaQMOxaXJDhdVhXNtGYz~MKPfZZatibQk-SFWJXz02IAVdb2y-Zp9nR6okS1cYY5ZIx~1R3arlEh6CbIHmXGLj9Qsda2l3ruSug6AHSxXK7hgCDjSxM_&filename=ac3filter_2_5b.exe

http://gsf-cf.softonic.com/cec/6d5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_en&type=PROGRAM&Expires=1459377807&Signature=QxRECVSQr24os-Fvz~YcXKD~K3xmkOoRGoBahMmdxQVeKxk3BXuvzWMAkEujR~wmGp-3VuFjPUcqe9wZ~fT7VEIN6GfayYw6IqzVKtxKOdhW85cpHQN0SGhLKMPl6H32bAO1KQyhiionIjotCplTncH3IixqD6wp5YV2ETZZG0U_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=ac3filter_2_5b.exe

http://www.moviecodec.com/.../ac3filter_2_5b.exe

http://gsf-cf.softonic.com/cec/6d5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_es&type=PROGRAM&Expires=1463451720&Signature=QpkW1L5u00bXbloC8iC7kBuemjnS2Km-BpDslPM0iBIfu4a7byG8I5vvAMR-9jByWh79Pu7zS6T6nbyiyWBrjBpegXtfKY3JzW-tmwlcVty9j0KEKq~RK5aecckYWgbWim~4aQBiq9ASQCaLpVzW8bM2KW16bNuQLgHdF7S8bCE_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=ac3filter_2_5b.exe

http://gsf-cf.softonic.com/cec/6d5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_es&type=PROGRAM&Expires=1460771002&Signature=akJaUBnnB2Yusq~HMnOsN4O0hq0ZCWoAqFsDVSMTAvPJ3xnzh6Fk~v-L-4XMkvN5u~ehcM12Cbfg9~0MgS3FEa5BIMFg-7A7IXB3sKVEp8iYf~9xZznaAXiTfFrqxYhJ2HTZ-hTPseAyKT1z~5GGY92OcXz23tvOvrOTmynnr2w_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=ac3filter_2_5b.exe

http://gsf-cf.softonic.com/cec/6d5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_es&type=PROGRAM&Expires=1458390189&Signature=BdOB~AD82MIYt0AknFLTU5VT1JqmZwa59kc3R9U5qiMazS8jWlLeB552SsRrAqhTCBNSVEcme1e1R0cJIw6KWzyHpZm7vBwRaZn6kOL9fcDb3TMXIIiF2rU5~tXH8R91gauqo-CNsm6PSHf1xLn01QuC129wNlg5mSKQNzOMKnk_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=ac3filter_2_5b.exe

http://ac3filter.en.softonic.com/.../6CH9aeXedl4L8u BHNJXWTW LP1LFlnGQpxqjlxANI0jFJOXFWHsYqkgKBsD4OZr9unOrm0Vz0CTbU3RL6hlod7mVT7uldKefO3da5koGvMW5nHd2vBMW9qKfXMjT7xR24B4fYJyky0fq1yqOk5IZ0crQT40jBxfsSNDTJsyw=

http://gsf-cf.softonic.com/cec/6d5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_en&type=PROGRAM&Expires=1426911961&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=H~J405CHi1tFUjqlTX2yFVIKLUzVCbLXuniR~Kt8gHbv3fmILNzaI0mGuLFPDPKxfYCwNw7U4tC~ITV2Lv2bMx4oHpACDUHMyA2IlzLR3ukJUWaAu0wa-HV5G70lrnMJ6NuPLxxXUKBuAx0lYvX-xFdBw4pc2GcTWsbvWG3eyj4_&filename=ac3filter_2_5b.exe

http://gsf-cf.softonic.com/cec/6d5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_en&type=PROGRAM&Expires=1422394058&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=TFJ-Ft7Bp2nkhP-lIMUMpkVnx2NzMUvN-Gn-l9xf3s60Reg19rNzTSr1kOSoOcZxmWdqaAJSicZzf~aKMLogWpkgb5kbYxe6oBT5kdUcrGtTIF9xSwXEjFwGPOMamOUtF9GptEa-FX~ukaux-iYsS7OjaiQxfUqqsY14KOV~ESI_&filename=ac3filter_2_5b.exe

http://gsf-cf.softonic.com/cec/6d5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_es&type=PROGRAM&Expires=1429018567&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=aq-0Q0hlNCYXBhN0cFT7O6NiTLX847k0ViTRO2Pgw9YFETpB2Ca4hiU-sVHJlKw9aTPmemOU3qcyMxuiE85B24Cu9mh~7Ie2PzG~Ck1d3Z1~bvrvZ2RhQ3tW5UCWv94Jd5mxcCiJnfG-K~sptHPTAQmEoshiIMsYiDjBD-8Jk1c_&filename=ac3filter_2_5b.exe

https://73e923939509b315172c8fd44c3f6d38127f4d52.googledrive.com/host/.../ac3filter_2_5b.exe

http://gsf-cf.softonic.com/cec/6d5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_br&type=PROGRAM&Expires=1439283617&Signature=MUbOyesDIxb~oiOrySR4ZoaI3L~~Hyj-7~E-X~rGleZj28INz3BeKGGKkOzuUD7ejDrAhmEYufQK-AEINLFwjkVx5eEZUIwzC7ANhpXYqilNQIfK39mluApNj6~D5TOZuWXb5gMpkO0jHRdYz~Ez-aF5~KAWWTyxP3gxUGYE0vY_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=ac3filter_2_5b.exe

http://gsf-cf.softonic.com/cec/6d5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_en&type=PROGRAM&Expires=1423745910&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=itqi11LOKWNEbNVg84k~33oY8he7ehyPIC-eJ70c-4yyFP5yy~258ARlurit1nfQ0HDAXUUPXG7LcXhcWtSE3Q90DvFD79P3mvazIid9TsXbOOHtw8efUP91xJMDR2l2LTabxRx7ANa8XM-0eaMtOAa8Qhx6dcDamNEQkC8Kvr4_&filename=ac3filter_2_5b.exe

http://www.ac3filter.net/downloads/releases/.../ac3filter_2_5b.exe

http://gsf-cf.softonic.com/cec/6d5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_en&type=PROGRAM&Expires=1429756423&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=Xtwfw38hmOKdrOOw688Lsq~WVa5VqNWbw5jvHAWCo-xnnCT7z6b3amR0UZcJcY1UHrNU12imwMOgcdKnFtDy51IOC8pvMhMuYaw9zmhoYxhYN3O46Qul25Ksn9K5MXzoMe-Jc-F7nQeJE1uJ2fWh4hAuYDK4nUvXWHnILPsmrOI_&filename=ac3filter_2_5b.exe

http://gsf-cf.softonic.com/cec/6d5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_es&type=PROGRAM&Expires=1425332919&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=JtUeahhjQNOo6403oDvO6vaxPYJUhmNxhUjjvGOA1dwtlNDn~3BvD5KZ1irwHSnKU2JU4qlxEUrnGH-8fM1QOZyGgN5P564FzaRsxTmQFcsTccc79Pu8fPpwpkBFeR4uZEHJYIt9ywcUX4PEsjbnN6mt7aVcVuos8ySCgCaQpzg_&filename=ac3filter_2_5b.exe

http://gsf-cf.softonic.com/cec/6d5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_en&type=PROGRAM&Expires=1422932944&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=MbvtkRE4Y7k8MH3ia07eNqBrilN2Z-jrjF-vmsB5uT8TtBKpJ2-Xto74w~CnfHLYrqCty7f3i-bIZSOHRsud2wHhfT2lfdR8joqhFvVu~1003WwXhCJufj1Fl4KOjJuoiP8syERbwrvooBet0e9j2uPb-Lf1ozMAuuqN1~SW5hY_&filename=ac3filter_2_5b.exe

http://global-shared-files-l3.softonic.com/cec/6d5/.../file?nvb=20150115201250&nva=20150116081350&token=0615dd474ea5071c42281&SD_used=0&channel=WEB&fdh=no&id_file=26811&instance=softonic_en&type=PROGRAM&filename=ac3filter_2_5b.exe

Latest 30 of 42 download URLs

Remove ac3filter_2_5b.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.