» fmz_2.0.0.5_setup.exe
Overview
Analysis
File Details
Downloads (13)

fmz_2.0.0.5_setup.exe

Free Music Zilla

KORAM GAMES LIMITED

The application fmz_2.0.0.5_setup.exe, “Free Music Zilla setup ” by KORAM GAMES LIMITED has been detected as a potentially unwanted program by 3 anti-malware scanners. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from dl.cdn.chip.de and multiple other hosts.

File name:

Publisher:

www.freemusiczilla.com (signed by KORAM GAMES LIMITED)

Product:

Free Music Zilla

Description:

Free Music Zilla setup

Version:

2.0.0.4

MD5:

4748ab8260ae8a99c7e1d31390b0113c

SHA-1:

2d457f649e24de6ea38b550b8ebd84ba8f1f36a2

SHA-256:

9ad666286f874b1d0fbfa4b0e8ea45884ecda523a28e7b1fa65dd94d7399791a

Scanner detections:

3 / 68

Status:

Potentially unwanted

Explanation:

Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:

4/24/2024 6:08:52 PM UTC (today)

Scan engine

Detection

Engine version

ESET NOD32

Win32/OpenCandy

8.9431

Reason Heuristics

PUP.Optional.Installer.KORAMGAMESLIMITED.O

14.2.17.18

XVirus List

Win.Detected

2.3.31

File size:

1.2 MB (1,275,144 bytes)

Product version:

2.0.0.4

File type:

Executable application (Win32 EXE)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\fmz_2.0.0.5_setup.exe

Digital Signature

Signed by:

KORAM GAMES LIMITED

Authority:

VeriSign, Inc.

Valid from:

12/8/2010 7:00:00 PM

Valid to:

12/8/2012 6:59:59 PM

Subject:

CN=KORAM GAMES LIMITED, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=KORAM GAMES LIMITED, L=HongKong, S=HongKong, C=HK

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

6E9C3D39106B14390C185EF2DFCEB11B

File PE Metadata

Compilation timestamp:

9/23/2009 7:06:57 AM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:6+qtad4I8wIh9WS19Do7FUqAR2xkx8+RDLXIcWDX1/8asJHx1RmYPCor:Us4o8o7FUqA8xRWIcWB/BsRx1oW

Entry address:

0x163C4

Entry point:

55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, A4, 52, 41, 00, E8, F0, 02, FF, FF, 33, C0, 55, 68, 89, 6A, 41, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 45, 6A, 41, 00, 64, FF, 32, 64, 89, 22, A1, 18, AB, 41, 00, E8, F6, EC, FF, FF, E8, 01, E8, FF, FF, 8D, 55, EC, 33, C0, E8, 83, 86, FF, FF, 8B, 55, EC, B8, 74, D6, 41, 00, E8, BE, E9, FE, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 74, D6, 41, 00, B2, 01... 
[+]

Entropy:

7.9291 (probably packed)

Code size:

84 KB (86,016 bytes)

The file fmz_2.0.0.5_setup.exe has been seen being distributed by the following 13 URLs.

http://dl.cdn.chip.de/downloads/.../FMZ_2.0.0.5_setup.exe

http://gsf-cf.softonic.com/2d4/57f/.../file?SD_used=0&channel=WEB&fdh=no&id_file=66758&instance=softonic_en&type=PROGRAM&Expires=1453542338&Signature=iub6guzAAx93RVxMaMLeSurZGmucTRIk~chrZMW~~pdSYAkXQWFFjxD2ynx77DRp3PE2ks2G4OnizKGLpaMTiEgvKjBFJT4lsm~-~kdzsqQTNjpKkHO1bO8zZQ-fhJa9eaiXxZD2ZdmwpbzFL2BnkI3HSLgZhF4lj-3C9Oi7Okg_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FMZ_2.0.0.5_setup.exe

http://gsf-cf.softonic.com/2d4/57f/.../file?SD_used=0&channel=WEB&fdh=no&id_file=66758&instance=softonic_en&type=PROGRAM&Expires=1425961949&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=RBRWGtUTNF~tTo1XlGdnbURraJACMTxMvtb2HJ7NdZkZ~W69R2v5Z1S~jDT56wSKMvlTtYM1mqYx1sQRJ2bfsmjRoOMSuxl-Uqe~0qZwJEjnFgSRZM5B~lAc7Nz4zDpYJMzPAxTTbmGKdED3G123YolQoIXLffbubxNYD1Lwjuo_&filename=FMZ_2.0.0.5_setup.exe

http://global-shared-files-l3.softonic.com/2d4/57f/.../file?nvb=20150116204348&nva=20150117084448&token=00965f51f37af2f4929df&SD_used=0&channel=WEB&fdh=no&id_file=66758&instance=softonic_en&type=PROGRAM&filename=FMZ_2.0.0.5_setup.exe

http://free-music-zilla.en.softonic.com/download-tracker?th=1/6CH9aeXedl4L8u BHNJXWTW LP1LFlnGQpxqjlxAP4WKdrThBUpzgZhfV/GPbvVkqABIjhd7xfa/3Da2hOG7Dxf5vfnua/YmtvYnjH0Zp9N2kUSEWhsGQaFHH5UI5NR41CXSV6s9Da9f01LXk Nbbu9Vdqsmz9jKChdEVcMRxwwSOa4W9vbrkQScqyOvOZD7k35rts6TklVU7W/52cyU5p4p2ayztZgl3/YxtzylsYozjDD Cnam2Jl42CYdRVcBPWu3vtoz4Lp4a5uOgmrisykwROySkzbP6ZZz51nlV4DjLjXmYla ynIa5PFEFgAg2CjNSyENpFK2ef1qv1GgE0XHc6K46csF1uAdGRRQ7K2pGAnUfsfx4UExydG05ZmrczVi0itNarWbfD8Dku7dbmhs2iERm6OOdFl4xjhfZjx7niidItPUOEQU06ysHXMHGEbLlEMHB69aWVkaVTq/qBhfgQHVr6PWPrPZDLZnRYCs6EshVPf67gZOGI7b0xrw0YpXGAK3leZD9ahlJgm0/.../Fn48Dzs1XYJRKs6cr7PNeZzfAWQEE9671DHjIvD3ZI3JE1gSX 7MvW9IlGu4Fgc76LLSfH3AeBPCBQLGLUNzg=

http://gsf-cf.softonic.com/2d4/57f/.../file?SD_used=0&channel=WEB&fdh=no&id_file=66758&instance=softonic_en&type=PROGRAM&Expires=1459387983&Signature=Op-ybqA-MAUK02BZjWhm8Rsdho9qO1GNxLZAYO-6~soPjW7VoOd-5ymNgnh0h~G~DdxleAiGReQNmtkxDTYKAgj2yT4HfFQ94EoDWuhirvUTOD6dn0XtWHHsMSDNG4OWP4jMh1ESGSJh9Tz-M~p19SHbZdr1UVesyLtDFTh20tA_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FMZ_2.0.0.5_setup.exe

http://gsf-cf.softonic.com/2d4/57f/.../file?SD_used=0&channel=WEB&fdh=no&id_file=66758&instance=softonic_en&type=PROGRAM&Expires=1447954487&Signature=fvHe6HLBvyx9ii7VcRKuugLjEUUwhOrJy~NaiSsGV0KuYzm464qTrZrd-3CSx1dxJm8zsi~8FreYvEYtdqbFRBMInqzn3ecPy4k0M67Aerv7KfWMMByU0H8iwDNLCQuGiP39LfrE9WRPpjj~AK2LUciTYKnmM80KV3JJp6Y-PwE_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FMZ_2.0.0.5_setup.exe

http://gsf-cf.softonic.com/2d4/57f/.../file?SD_used=0&channel=WEB&fdh=no&id_file=66758&instance=softonic_en&type=PROGRAM&Expires=1455521117&Signature=e36RZHNjPxPHotEZd46G5zAOOhbXB49QFH-IB1KtTD63RFikoLp57ApA775xEOXMiUOQVrG4wPe77CbcPnyqEXV7qkh8sGAV8gXJ7AYr16yF6feBmr2POCNvw272nal8-RWmc0P6QGcHunsFAphjzAeblBGRtxkKvXNIZu1qTjE_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FMZ_2.0.0.5_setup.exe

http://free-music-zilla.en.softonic.com/download-tracker?th=1/6CH9aeXedl4L8u BHNJXWTW LP1LFlnGQpxqjlxAP4WKdrThBUpzgZhfV/GPbvVkqABIjhd7xfa/3Da2hOG7Dxf5vfnua/YmtvYnjH0Zp9N2kUSEWhsGQaFHH5UI5NR41CXSV6s9Da9f01LXk Nbbu9Vdqsmz9jKChdEVcMRxwwSOa4W9vbrkQScqyOvOZD7k35rts6TklVU7W/52cyU5p4p2ayztZgl3/YxtzylsYozjDD Cnam2Jl42CYdRVcBPWu3vtoz4Lp4a5uOgmrisykwROySkzbP6ZZz51nlWWpYw7m80yNgyiAjVlx/Jxv7eUhU0ltf9AVYxkNWxM47GvBAAP8mya59qBAFevMtYL3/MHEoEVrfRnK0AUetDF5jfg4hLdy7OijLGcQ7VMv64H8bknZvjw6xM2n5PwUIIxNq6OhYJygqd2te8/uBAt4ro4 C lvDgsRnMirwgwqVLL2140R1rio9MZV/.../Fn48Dzs1XYJRKs6cr7PNeZzfAWQEE9671DHjIvD3ZI3JE1gSX 7MvW9IlGu4Fgc76LLSfH3AeBPCBQLGLUNzg=

http://gsf-cf.softonic.com/2d4/57f/.../file?SD_used=0&channel=WEB&fdh=no&id_file=66758&instance=softonic_en&type=PROGRAM&Expires=1454842151&Signature=V~wJID3KesSg0PC7C64xJVkLQew0seeY0RdsDDO4ZYUPRE5lPYr6U5sViPWcgbcIkWouLMK3sitryYtYr3E~kKKv7b8lnNp~yuDGhstg82tYDNyca3WWmDDhCOn7RUcl-BWnPTYHndkbj5Fwe0eEMxPYK7J9c4f-7lMEYJziXSE_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FMZ_2.0.0.5_setup.exe

http://gsf-cf.softonic.com/2d4/57f/.../file?SD_used=0&channel=WEB&fdh=no&id_file=66758&instance=softonic_en&type=PROGRAM&Expires=1452418343&Signature=LtUsqcR3Z1fqT4clWg5dNFrW6-F~TG2xe-h7JUXAYzEF~SmL7IzPvI4Yc5Yi3FIE~QkDWGlhbffyt~OzC-A-Tz7N21GjuKQTd2ePyx-mi6RoXenoj2uwhoyuADIRdyy2HZNv5KL2bkDTZ~CuyLrEinNxf1RiK7zj8SrVX~gNzHk_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FMZ_2.0.0.5_setup.exe

http://files.brothersoft.com/mp3_audio/.../FMZ_2.0.0.5_setup.exe

http://usfiles.brothersoft.com/mp3_audio/.../FMZ_2.0.0.5_setup.exe

Remove fmz_2.0.0.5_setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.