home

free-download-manager-3.9.3 build 1360.exe

Free Download Manager

Sevas-S LLC

The application free-download-manager-3.9.3 build 1360.exe by Sevas-S has been detected as adware by 8 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. According to AVG, this software downloads additional adware offers during setup. The file has been seen being downloaded from www.joydownload.com and multiple other hosts.
Publisher:
Sevas-S LLC  (signed and verified)

Product:
Free Download Manager

Version:
1.0.0.0

MD5:
f8e14d0a2cf3e71d1c6797b5f687fad3

SHA-1:
1170795bbc34aaa2f155d0ae849faaaa6e966469

SHA-256:
73ee21f3354af595665f0d3a47fec9b9547d7a428c4ad654f538fa460ad2ffb8

Scanner detections:
8 / 68

Status:
Adware

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
4/24/2024 9:03:53 PM UTC  (today)

Scan engine
Detection
Engine version

AVG
Downloader
2015.0.3513

Dr.Web
Adware.Downware.1446
9.0.1.096

ESET NOD32
Win32/OpenCandy
8.9625

Malwarebytes
PUP.Optional.OpenCandy
v2014.04.06.08

McAfee
Artemis!F8E14D0A2CF3
5600.7169

Reason Heuristics
PUP.SevasS.e
14.8.7.20

Rising Antivirus
PE:PUF.OpenCandy!1.9DE5
23.00.65.14404

VIPRE Antivirus
Sevas-S Installer
27946

File size:
475.5 KB (486,864 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Digital Signature
Signed by:
Sevas-S LLC

Authority:
VeriSign, Inc.

Valid from:
2/23/2014 3:00:00 AM

Valid to:
3/26/2015 2:59:59 AM

Subject:
CN=Sevas-S LLC, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Sevas-S LLC, L=Kyiv, S=Kyivska oblast, C=UA

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
4B35AC223F4DB03D3B4C5368983A4B53

File PE Metadata
Compilation timestamp:
5/20/2013 2:52:54 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:4aC3W3jnCvFhjs17FEUDTTup+Ts9PJYz5jtNcB+/TRfYI:2GL2Fhm7FjDHuzJYz5jtXTBYI

Entry address:
0x31B1

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, D8, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, 34, 71, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, 58, 92, 42, 00, E8, 90, 2E, 00, 00, A3, A4, 91, 42, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, 58, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, C0, 92, 40, 00, 68, A0, 81, 42, 00, E8, FB, 2A, 00, 00, FF, 15, 38, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, E9, 2A, 00, 00...
 
[+]

Entropy:
7.8732

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file free-download-manager-3.9.3 build 1360.exe has been seen being distributed by the following 5 URLs.

http://www.joydownload.com/wi_def/.../free-download-manager-3.9.3 build 1360.exe

http://www.joydownload.com/wi/6PwKCzE_2BPJ4UIpDjatdw/1395448403/1/3/1/.../free-download-manager-3.9.3 build 1360.exe

http://www.joydownload.com/wi/vMmcWmV8Rqqud8js3MIfaQ/1397484245/1/3/1/.../free-download-manager-3.9.3 build 1360.exe

http://www.joydownload.com/wi/DVFhwPk7rsy9xvKH2IXZzQ/1395629886/1/3/1/.../free-download-manager-3.9.3 build 1360.exe

http://www.joydownload.com/wi/n10rQy4z2otBLhUS4vqPXw/1396645311/1/3/1/.../free-download-manager-3.9.3 build 1360.exe

Remove free-download-manager-3.9.3 build 1360.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.