home

bluestacks_0.9.exe

BlueStacks App Player

Software Association LLC

The application bluestacks_0.9.exe by Software Association has been detected as a potentially unwanted program by 16 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from bluestacks.1800download.com and multiple other hosts.
Publisher:
Software Association LLC  (signed and verified)

Product:
BlueStacks App Player

Version:
1.0.0.0

MD5:
306511ea8e6849398d067ef4d216a370

SHA-1:
a14d94b3a7fe2729a758bb55bbc165b1d4a9e4ee

SHA-256:
9254cff5375fba451f25c91403bce4f23fb88afe4ef7ce69eb8a216e1e9dc150

Scanner detections:
16 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
8/14/2025 7:18:11 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.OpenCandy
2015.04.18

AVG
OpenCandy
2016.0.3135

Baidu Antivirus
Adware.Win32.OpenCandy
4.0.3.15418

Clam AntiVirus
Win.Trojan.Agent-855157
0.98/21511

Dr.Web
Adware.Downware.9759
9.0.1.0108

ESET NOD32
Win32/OpenCandy.C potentially unsafe (variant)
9.11493

Fortinet FortiGate
Riskware/OpenCandy
4/18/2015

G Data
Win32.Adware.OpenCandy
15.4.25

K7 AntiVirus
Trojan
13.202.15636

Malwarebytes
PUP.Optional.OpenCandy
v2015.04.18.04

McAfee
Artemis!306511EA8E68
5600.6791

Panda Antivirus
PUP/OpenCandy
15.04.18.04

Sophos
OpenCandy
4.98

Trend Micro House Call
Suspicious_GEN.F47V0416
7.2.108

VIPRE Antivirus
Opencandy
39444

File size:
415.9 KB (425,872 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\bluestacks_0.9.exe

Digital Signature
Signed by:
Software Association LLC

Authority:
DigiCert Inc

Valid from:
1/13/2015 2:00:00 AM

Valid to:
1/21/2016 2:00:00 PM

Subject:
CN=Software Association LLC, O=Software Association LLC, L=Dnepropetrovsk, S=Dnipropetrovs'ka Oblast', C=UA

Issuer:
CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0E1FC80B1C57AD69AA6F8D65D1CF90CF

File PE Metadata
Compilation timestamp:
5/20/2013 1:53:00 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6144:ciucV6SHpR019Nk3r7xg/Tq2jLJu/aAmVu7IRpuBCk1wYyEV96rNsw7:ciuCsNk3PqLqat+7mk7wxYyEyr

Entry address:
0x331C

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, 98, 92, 42, 00, E8, A8, 2E, 00, 00, A3, E4, 91, 42, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, 90, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, E0, 81, 42, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Entropy:
7.8003

Packer / compiler:
Nullsoft install system v2.x

Code size:
24 KB (24,576 bytes)

The file bluestacks_0.9.exe has been seen being distributed by the following 7 URLs.

http://bluestacks.1800download.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsnl0kPjuhHBrzcteQv A8/zyn9np5iNEMJ1XkbKn3fHm/ykYeazeeEKqtHr8lwbtix8aYFQfS9S74BlSj4Tj/16SY65uEg2gIq5QwiUcQCDPySXokx5hq7CC5UGWTUukUiJ6jYiUMMbMzKxoGMafzUHJ3c43EIhEw2vi4RzQuO4/z2ecnXDX/5xmLzaw3R/29bsuwOjkJzcr F sujUJW/4O h1/.../Mawkk03NTHOu2AG3NvRInnl

http://bluestacks.1800download.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPDy1E1v4Y9bB9bpi/269qG542doNK0Plaan3fHm/ykYbazeeELCtGb08gLNiztTCRB6avCX/.../i7oUSCTRrZOnY hbnVSerJrJRkLMab2U318ecrFZREmhrOyS3pwao6x2 w9BHvo7h a37s9V8n H8KwZm8Jl5SvFqoumRcHu9eh2Q26fKE2nS sEc5f7NWwAHPruYPU3j4rJLxCT5Y8K3RguuOnFwg111Xwi4wNVm69FAawqZvkzR13YjeR y5FjoKQInnl

http://bluestacks.1800download.com/get_azure_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEhz4coqK6bYk5ib0o2B42YlSaBKkLOqvZDDTwEpRLDbETvusW78xyas1jIbERVmD9HbyDUL1sXm ivXRqtKbm2VBs8Nv3wEXFmSsSTR2ntEo/CnoUSCTQbxW2pO4dHdbOfB3bUQdOOz9V3p1apySY05hyPC3SWU3c8b40 cnUSqouRnFm/V Q8vjJJ3pLGNXnMu F/.../kxdYHGS7rFA73sZGnzQwvLDGd7HgfhNPSOHnl

http://bluestacks.1800download.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklY NSr1RF2nI5iC5rh1gmXgq3Yng44cJgTtarHuYDCuyxdSNWmeXLD5TOpwgKtrh8ybDR7HoHOsWQTlszi1iP/Dr9vag2gIq5Y6kRMbAGSsSTRzntEr/Cn5WmaLS/9Wy83zd25TerJxJR4FIa70UH59edzFZREkhrOxWmZ8OtDg2rQ/D224u17Jn/5rAZn esGkfSgFi9O2XuMmlQ8W6Zr2zlL5bqBnw3XlQ5MMp4L5H2vi8JuRmiYyNeoGEMd5aCx48/.../ysZGnzQwvLDGd7HgfhNPSOHnl

http://bluestacks.1800download.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklY NSr1RF2nI5iC5rh1gmXgq3Yng44cJgTta7Hufyro0l8bOGWGCeikHrE1wqtrh8ycBwaDq3a7TBqm8T791 fa7dPZkWlZ88l11hYGBSX8SSx 18kq9Dm8AzeLS/9Wzs3zNTUFa7k3PRNMOaz9RCMmLNzFZREghrPnFjQuO4/02/9jUTXu5xjdl7xmB5ivccCsfXof1cO3D7ZnjRZW54/.../2zFYvP3bGsWkT2t3UNnnl

http://bluestacks.1800download.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPDy1E1v4ZNbB47pquHf14WJzw9EcfxuiPfi4biDngztYLGqSTqHyCr50ybtq1oLZFQfS9S7yHkflszi1iP/D6ICMg2gIq5M6kVdAVnWnDyx 18kr9DmlGXGSA7ZbwtWmbmlTN/5xPRNMOan9RCwgJJqbZAkpz6vnGDQkeofg2q4/D2mwoA6W378wVdv4Mp68ZDJW3sG3D7t42khWqdmu1hvqZel/lCa0Q5YJ/.../joZCTnCgiZqRIBo47M212 KL X09zhU 61tlHEy7mDwr2pZGnzQwvLDGd7HgfhNPSOHnl

http://jdcdn2com.blob.core.windows.net/fas/wi/18/34/1/.../bluestacks_0.9.exe

Remove bluestacks_0.9.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.