home

f_0002f4

Windows Media Player

Innovative Systems LLC

The file f_0002f4 by Innovative Systems has been detected as adware by 11 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from windows-media-player.joydownload.com and multiple other hosts.
Publisher:
Innovative Systems LLC  (signed and verified)

Product:
Windows Media Player

Version:
1.0.0.0

MD5:
a1e760b62a7a936aba3aeb4e6fb715ee

SHA-1:
88ab17fbbb195d5bc5650445e9c6af60de7a2c49

SHA-256:
aa4d48b31c2892fadad2e19c7ef90a3c7b1fbc92858bdb8f8753876379e7765f

Scanner detections:
11 / 68

Status:
Adware

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
4/20/2024 12:44:26 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.OpenCandy
2014.11.03

Avira AntiVirus
APPL/Downloader.Gen
7.11.182.198

AVG
OpenCandy
2015.0.3302

Baidu Antivirus
Adware.Win32.OpenCandy
4.0.3.14113

Clam AntiVirus
Win.Trojan.Agent-803351
0.98/21411

Dr.Web
Adware.OpenCandy.55
9.0.1.0307

ESET NOD32
Win32/JoyDownloader
8.10659

Malwarebytes
PUP.Optional.OpenCandy
v2014.11.03.08

McAfee
Artemis!A1E760B62A7A
5600.6958

Reason Heuristics
PUP.InnovativeSystems.I
14.11.3.8

File size:
496.4 KB (508,360 bytes)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\google\chrome\user data\default\cache\f_0002f4

Digital Signature
Signed by:
Innovative Systems LLC

Authority:
Thawte, Inc.

Valid from:
9/19/2014 2:00:00 AM

Valid to:
9/20/2015 1:59:59 AM

Subject:
CN=Innovative Systems LLC, O=Innovative Systems LLC, L=Dnepropetrovsk, S=Dnepropetrovska, C=UA

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
09A91C40EAE34E72CD975B0B218AE4BA

File PE Metadata
Compilation timestamp:
5/20/2013 1:52:48 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:2QXT2KJW/h4qeXgnaYgj+0SOVOJ8ugU5GLcEE:XXyKJW3eX3Ygj+QOJ8ugU5Hb

Entry address:
0x331F

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, D8, 7A, 7A, 00, E8, A8, 2E, 00, 00, A3, 24, 7A, 7A, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, D0, EE, 79, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, 20, 6A, 7A, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 20, 7B, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
24 KB (24,576 bytes)

The file f_0002f4 has been seen being distributed by the following 8 URLs.

http://windows-media-player.joydownload.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPTy1E1v4Y9bB87pi/269qG142dwNLUblerC/NXW20gIHbjfZWfusW780yathwMOPDE b/CXqTB jqnD8gfDbvN7amGJPs55ziVdIRjLjGDU2nsIj7CroUSCTQrZOl4TzPHQNb7MgaEFRZ/CwFWh0O8TILAl3xOG9UHM3c9z40Ok0DWC/.../8hzn27Q5MMp5L5XnjorcTYzz4rJLxAT5Z YCsxu7utHBEihBew3c8QSm hWly65ti41QRmNHDEsnhThIeHbzXrWByI3KMudEKshGiCRhg JA==

http://windows-media-player.joydownload.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPTy1E1v4ZtbB47xquTC8sGMxwdgEP0bjban3fHm ykYHcXGHWOOgEqdwmuc0m4HeFQfS9SzyHgCu7Gm0yP/UpMvfkmNKo4c7wF9AXmTjTix 18ko9Dn7SGjaSrpW2pKpd25FPas5dhION67yXnt/cMjLLVgoj6v2UX9xao6r2 w TWO uEiZxaM5Fpn esCpZWMbhp/pQq5ngkBAudGskBikP Mg1TGnAtEIppKpSDrjspGaiHh5JPYfFM14eyMxu6GtHxprnFHpiYkbVG/.../B6YxD31yjWABg JA==

http://windows-media-player.joydownload.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv I253eq ysyl4pHaAW7erC/NXG8ykYfaz3YRK7kBehil Ax2YbBVkXEvT3zT0zzsmnp0qmEvNKbm2FMq4d32gsWCzHkF2MgwJp442umCyrMAqFdydm0f2IVY/o4KRIdZfCrAi89asWNLBgonqDgFzQuO4/w2/9xSnux8VDOlu1tFpn esGkfTcFi9O2XuMhlQ8S7oj8j0rzLaBznT7zS48ErJKpSCDjspWRny4hYL9ETY9 M3wpoqL SQhqzRy13c9DESXgAh/.../BtKlukxyqODgs JA==

http://windows-media-player.joydownload.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklUxNSrgQUamP5uQqL5juTyvvygumpJbb1rmaaWpdyauyxdSMWmeXbDzCr50ybxq1sGeBw2T7SS7BkX9qiLm3 fa7dPam3FJpYc7wF9BXmTnU2pnn4Aj yHoXWGQQbhOw4TrNT0VN/ogJFsFNKXlESMhLJGJZQkpz6vlEiw3LNyxkbFkRyz47kjE3/VuBJivN5vwOy4bnNzgSL19zgBVsdm02BrqZel/.../BtKlukxyqODgs JA==

http://windows-media-player.joydownload.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjymHRz0ad7bteh152T qHomkphOcRauLfmgLXj/ylZYOHHLQrfzR/J03uQ1kJ/MGkzNrmatTlT8 3G5geeH8YWMxCFZqtY6gF9QVXKiGDU2nsEj7HS5SGjaSrtW2oC4aWNYL/ogJFsFMKXlFiMrasWNLB4onqbmGychao6x2 4/.../YghSflCc1a5NX8Gie97NbTh3F1M 8SWMRhaDZ28v mHAQ0xkOi3J5OECbzQFSnsZGnzQovLHXHuGsWz9KQOnGiVxiE3Oh0Kgjy3zPVABg JA==

http://jdcdnnet.blob.core.windows.net/fas/wi/1/24/1/.../windows-media-player-11.exe

http://windows-media-player.joydownload.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv A8/zyn9np5iNEMJ1XlbKn3fHm6ykYObT/YTqu1E/Y9wLNyxcKYFQfS9SzyHgWu7Gm00v/QpZrSkmlZ58xkkV4BXnOtGDl2lMIr7CC5UGeTUuoFlJLzPHQNar44PV9WbfuoETliJZuaf0o/.../IPVeGNFpYC4 8L72VE8jnB3z3d9OAWilFAawqZvu1Q43NTHOvmAGiJGTaTD9V0qEgvt7aAfz1CXUAQw JA==

http://windows-media-player.joydownload.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv A8/zyn9np5iNEMJ1XlbKn3fHm/ykYeazeeEKqtHb8lxLpgxcSPDE b/SXqSALlszi1iv/Dr8vT0mlNq4dlyxUbFiO1AWd/lcco y35U2ScSbcfwsPrJWFeNOwgJFsFMaj9RD0mJpqRYVg/0fSwS3c4ONmjmLh3E2i7rA Hye1nR5i etDuNiVO1IK3GOM2mB8c7Izvhhvyb6p/.../QI8Bv47 ASX7uNKamCwqdfEaG9Bifjw 7bfzREt8zkrhnogGASeiDA75sdm9kx0uZ3jFsyke29PBZi30ERSfmvE8YwH6xyDTARg JA==

Remove f_0002f4 - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.