home

foxitreader621.0618.exe

Foxit Reader

Innovative Systems LLC

The application foxitreader621.0618.exe by Innovative Systems has been detected as adware by 16 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from jdcdnnet.blob.core.windows.net and multiple other hosts.
Publisher:
Innovative Systems LLC  (signed and verified)

Product:
Foxit Reader

Version:
1.0.0.0

MD5:
91343db4ab25a077b4c33fb3eef99f70

SHA-1:
38f2726136cc2f7f4b5c29a3f8b93cbf40f5e8af

SHA-256:
671d677b25fd427a1b948aa89a8608ef7da57a5f7fca71006f8d5efd6877b753

Scanner detections:
16 / 68

Status:
Adware

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
4/19/2024 3:49:03 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.OpenCandy
2014.10.30

Avira AntiVirus
APPL/Downloader.Gen
7.11.182.42

AVG
OpenCandy
2015.0.3302

Baidu Antivirus
Adware.Win32.OpenCandy
4.0.3.14113

Dr.Web
Adware.OpenCandy.55
9.0.1.0307

ESET NOD32
Win32/JoyDownloader
8.10640

G Data
Win32.Adware.OpenCandy
14.11.24

IKARUS anti.virus
PUA.JoyDownloader
t3scan.1.7.5.0

K7 AntiVirus
Adware
13.183.13305

Malwarebytes
PUP.Optional.OpenCandy
v2014.11.03.05

McAfee
Artemis!91343DB4AB25
5600.6958

Reason Heuristics
PUP.InnovativeSystems.S
14.11.3.5

Sophos
Generic PUA JL
4.98

Trend Micro House Call
Suspici.218D75EB
7.2.307

VIPRE Antivirus
Opencandy
31770

File size:
496.5 KB (508,384 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\programs\foxitreader621.0618.exe

Digital Signature
Signed by:
Innovative Systems LLC

Authority:
Thawte, Inc.

Valid from:
9/19/2014 2:00:00 AM

Valid to:
9/20/2015 1:59:59 AM

Subject:
CN=Innovative Systems LLC, O=Innovative Systems LLC, L=Dnepropetrovsk, S=Dnepropetrovska, C=UA

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
09A91C40EAE34E72CD975B0B218AE4BA

File PE Metadata
Compilation timestamp:
5/20/2013 1:52:48 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:DQ0Jhxpm0zwUIJc9CmIJffW0mjWPoeRhjX/u9cYolL:MKfQ0MUI+GJff3RjXD1

Entry address:
0x331F

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, D8, 7A, 7A, 00, E8, A8, 2E, 00, 00, A3, 24, 7A, 7A, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, D0, EE, 79, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, 20, 6A, 7A, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 20, 7B, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
24 KB (24,576 bytes)

The file foxitreader621.0618.exe has been seen being distributed by the following 5 URLs.

http://jdcdnnet.blob.core.windows.net/fas/wi/1/24/1/.../FoxitReader621.0618.exe

http://foxit.joydownload.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsml0kPji1E1v4ZtbB47xquTC8sGMxwdgEP0Xiaqn3fHm ykYcdnGHWOOmEqc20bIjzsWXFU/Iqz3zVUz2szi1if/D8ZrKmiBBpp8ixAwcACngSSx 18kq9Dm8AzeLS/9Wzs3zNTUGbbs6PRNMOan9RC83OJeMcwkp1avlFicheYLz1 o2BSqws1rFjqs1R9LhIYvrLS1O1IK3GOM2yUJdtMzvhhvybaBnznXyEcQe5MWxUXvtoZrTkCgqdeAaGdEvMjwpsuGtD2w xk/.../yvZrixgc7azqRqmFZ

http://foxit.joydownload.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv U8/zOh/jwnickFbk3kYqn OnGuyxdSNGmeTqHnQfdi0bI5zseZBgiS9i/.../4O h1vyfOkswz6tWsVc5YSxQnnjocXJ2Wx8Nv8GB9gvMjwptei1S0Up11Ki3J5OECbzRlSnsZGnzQ0vLHPEqmFZ

http://foxit.joydownload.com/get_azure_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxL3as6F6qtvqXf14WJxwclXdBP1Y/j2PXmuwlBKOSCGGeO1R/YlyPpqw8yPQFXPq3C/T1T8 3G8geeX943KmiBBp58igVdDUXSvGDU2nsAj7GijDnGSGbZdw4TrNT0VLP0gJFsFMqXlV2h0O8TILAl3xOG9UHM3c9z40Ok0Cmu6t1PMlfQvDpG3YoL3O2NXnMu/F/slnw8eroL7h0quMfYhwm60CIxX7c2pQXzroZrTkCgqdeAaGdEvMjwpsuGtD2w xk/.../yvZrixgc7azqRqmFZ

http://foxit.joydownload.com/get_azure_file/wUiS4WnYccXBwj sXP7oQkEsnl0kPTqmHRr6cteQv U8/zOh/jwnickFbk3kYqn OnGuyxdSMGmeRKq1E/Y9xLNyg5/DU1PWvD3zT0z0smnm0qHDpZrSk2lZo5EiiBZIVXatGGos14N1r2K/.../9Wzc3zYWhPMf0gJFsFN6XlACMjLdzFZREgj6v2ZHltIcGQhLxhWyu8sFvRnPltDIzoOJe8ZDJW3MuvXrBwjRZM54n2zlL7ZLg1zni0CIxX7M2pQnn7uNKanCYyMv4DHMZoK3R6uuOjHB5kiRO509tPUCbjDB 354jvhAUkNGDFqmFZ

Remove foxitreader621.0618.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.