home

dh.exe

OpenCandy

The application dh.exe by OpenCandy has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. It uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars.
Publisher:
OpenCandy  (signed and verified)

MD5:
9c0e9f1b8f7ce517ce45f4dc56246358

SHA-1:
7cc2608323ff86de09206365b1a6debc7dd47022

SHA-256:
b1684c5ca042cb908709aa0de62e4bf458330f3335a66bd43e3b98de63f77ac8

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
5/6/2024 9:11:05 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.OpenCandy (M)
17.1.22.6

File size:
194 KB (198,640 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\roaming\opencandy\af2d4a6e9dd9450bbf4cb1700b1d658e\dh.exe

Digital Signature
Signed by:
OpenCandy

Authority:
COMODO CA Limited

Valid from:
8/25/2014 6:00:00 PM

Valid to:
8/26/2015 5:59:59 PM

Subject:
CN=OpenCandy, O=OpenCandy, STREET="510 Market St #301", L=San Diego, S=CA, PostalCode=92101, C=US

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
1A4DE208E2EAA73D520698E2D08C7D3D

File PE Metadata
Compilation timestamp:
4/17/2015 9:42:12 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

Entry address:
0x715D0

Entry point:
D3, 7E, 79, F5, FC, EA, 73, 1D, 53, 9D, 3A, 18, 54, B7, 9F, D6, 96, 4C, 54, AE, 25, 6D, 1B, 6A, D8, 1F, 15, FA, AB, 51, 82, 7A, 9F, 40, C4, 31, 8A, E5, C1, 58, 00, 4C, 22, 2A, BB, AF, FE, 2F, 4F, 27, 1B, C5, 56, 92, 1C, 42, D6, 8B, 7D, 5C, B3, 0E, A3, D4, 06, A4, B5, 97, E5, BB, 89, 12, 01, B9, 30, 48, 0D, F7, C5, 6B, 72, D2, 50, 99, 05, 50, 0F, C2, 86, A1, 0B, 86, 92, 14, 80, 34, E3, C0, 41, 09, 3C, D5, 76, 1E, 17, 69, 1E, D3, 80, AA, 8D, 51, 8F, CB, C4, 69, 46, 9D, 62, 20, 9E, 0F, 1B, D6, C5, BD, 2E, DB...
 
[+]

Entropy:
7.3935

Code size:
148 KB (151,552 bytes)

Remove dh.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.