» betterdesktoptool.exe
Overview
Analysis
File Details
Downloads (2)

betterdesktoptool.exe

BetterDesktopTool

Florian Schwarz

The application betterdesktoptool.exe, “BetterDesktopTool Setup ” has been detected as a potentially unwanted program by 9 anti-malware scanners. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars.

File name:

Publisher:

Florian Schwarz

Product:

BetterDesktopTool

Description:

BetterDesktopTool Setup

MD5:

0dec3bf19a4a4f218cfd7b8798410f19

SHA-1:

a73eb606dd7520eb599ccc08218591259af6f704

SHA-256:

f986e086d7ff0a235fffa88104b8a261a1da63d1cb341d8ea8995733fba59cc8

Scanner detections:

9 / 68

Status:

Potentially unwanted

Explanation:

Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:

4/26/2024 1:17:28 PM UTC (today)

Scan engine

Detection

Engine version

Bkav FE

W32.Clodf66.Trojan

1.3.0.4613

ESET NOD32

Win32/OpenCandy

7.9169

Fortinet FortiGate

W32/OpenCandy

12/26/2013

K7 AntiVirus

Riskware

13.174.10509

McAfee

RDN/Generic.dx!cqk

5600.7269

Norman

Suspicious_Gen4.FEAPI

11.20131226

Sophos

Mal/Generic-S

4.96

Trend Micro House Call

TROJ_GEN.R01TH06JP13

7.2.360

VIPRE Antivirus

Opencandy

24318

File size:

852.5 KB (872,932 bytes)

Product version:

1.62

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\betterdesktoptool.exe

File PE Metadata

Compilation timestamp:

6/20/1992 1:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

12288:CQiG06mDjoYXVYz9HC7AIEb1C0MQvLp7DMnKfi91iFfd3KX9zU1LRRl7q3C8pJth:CQit6FYXVYz9HCFfQCn591iQofl7uh

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file betterdesktoptool.exe has been seen being distributed by the following 2 URLs.

http://r2.computerbild.de/exec/r2r.pl?m=w-cobi;u=http://d.computerbild.de/downloads/5145442/BetterDesktopTool.exe?__cbodl__=1381648322_7cd26182f5327e74fda94f53ca968c39&_chksum_=0dec3bf19a4a4f218cfd7b8798410f19;ct=1;thc=1;b=5145442;c=8643122;tit=BetterDesktopTool 1.62;url=http://www.computerbild.de/.../BetterDesktopTool-8643122.html;sep=|;tce=|;tid=36679;tn=Tools f?r Taskleiste, Startmen? & Programmfenster;tp=95|358;tc=95|358|36679;tpn=Software Kategorie|Desktop;cs=1

http://www.betterdesktoptool.com/BetterDesktopTool.exe

Remove betterdesktoptool.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.