» codegenerator_1.0.0.0.exe
Overview
Analysis
File Details

codegenerator_1.0.0.0.exe

Code Generator

Becker Games, LLC

The application codegenerator_1.0.0.0.exe, “Code Generator Setup ” by Becker Games has been detected as a potentially unwanted program by 4 anti-malware scanners. This is a setup and installation application and has been known to bundle potentially unwanted software. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars.

File name:

Publisher:

Becker Games, LLC (signed and verified)

Product:

Code Generator

Description:

Code Generator Setup

MD5:

15759b041ff28f6016fe1998c9d91c5c

SHA-1:

08fa8f9366d0b5ba95ebccd1c364dc5c9468c6b9

SHA-256:

ac93e18a4bb2f0212883a28f1a0760b37d64f1fb9b36ed4fb2e894c5697d52a9

Scanner detections:

4 / 68

Status:

Potentially unwanted

Explanation:

Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:

4/26/2024 4:21:19 PM UTC (today)

Scan engine

Detection

Engine version

ESET NOD32

Win32/OpenCandy

10.8606

McAfee

Artemis!15759B041FF2

5600.6397

Reason Heuristics

PUP.OpenCandy.Installer (L)

16.5.17.4

Trend Micro House Call

TROJ_GEN.F47V0606

7.2.138

File size:

1.5 MB (1,587,624 bytes)

Product version:

1.0.0.0

File type:

Executable application (Win32 EXE)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\codegenerator_1.0.0.0.exe

Digital Signature

Signed by:

Becker Games, LLC

Authority:

COMODO CA Limited

Valid from:

4/29/2013 7:00:00 AM

Valid to:

4/30/2018 6:59:59 AM

Subject:

CN="Becker Games, LLC", OU="Becker Games, LLC", O="Becker Games, LLC", STREET=11000 Nash Rd, STREET=Chesterfield, L=Chesterfield, S=VA, PostalCode=23838, C=US

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00DB48510051DE5A489182EB9589CD38AB

File PE Metadata

Compilation timestamp:

1/30/2013 9:21:56 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

49152:YSNY2Ymkmu2AKexBxUFiNm/xgc4ctMfm9a0:lNYDR59BMcm/Oc/BL

Entry address:

0x113BC

Entry point:

55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, 2C, 00, 41, 00, E8, E8, 51, FF, FF, 33, C0, 55, 68, 9E, 1A, 41, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 5A, 1A, 41, 00, 64, FF, 32, 64, 89, 22, A1, 48, 5B, 41, 00, E8, 16, D8, FF, FF, E8, 65, D3, FF, FF, 80, 3D, DC, 2A, 41, 00, 00, 74, 0C, E8, 2B, D9, FF, FF, 33, C0, E8, 80, 32, FF, FF, 8D, 55, EC, 33, C0, E8, E2, A3, FF, FF, 8B, 55, EC, B8, 50, 86... 
[+]

Entropy:

7.9516

Developed / compiled with:

Microsoft Visual C++

Code size:

63.5 KB (65,024 bytes)

Remove codegenerator_1.0.0.0.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.