home

freeaudioeditor.exe

Free Audio Editor

Tsingsoft Imagination Information Technology Co., Ltd

The software installer may bundle adware as well as other potentially unwanted software using a download manager/installer from ClientConnect or OpenCandy. The application freeaudioeditor.exe, “Free Audio Editor Setup ” by Tsingsoft Imagination Information Technology Co. has been detected as a potentially unwanted program by 3 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars.
Publisher:
Copyright© 2005-2013 FAEMedia, Inc.   (signed by Tsingsoft Imagination Information Technology Co., Ltd)

Product:
Free Audio Editor

Description:
Free Audio Editor Setup

MD5:
459b5867b51a3c08f3d193cec764a3f8

SHA-1:
c9a010de3a71c3d96a9a0c646ccf358a8e0eb8f8

SHA-256:
b041bdd5e8174a1ae6bf4ba680682251b994fdc4ac22c4a00f575c3e9c6ba292

Scanner detections:
3 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
4/25/2024 2:37:52 PM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/OpenCandy
8.9663

NANO AntiVirus
Trojan.Win32.OpenCandy.cumjqq
0.28.0.59048

Reason Heuristics
PUP.Bundler (L)
16.11.30.1

File size:
15.1 MB (15,854,088 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\downloads\freeaudioeditor.exe

Digital Signature
Signed by:
Tsingsoft Imagination Information Technology Co., Ltd

Authority:
GlobalSign nv-sa

Valid from:
9/21/2011 6:12:19 AM

Valid to:
9/21/2014 6:12:19 AM

Subject:
CN="Tsingsoft Imagination Information Technology Co., Ltd", O="Tsingsoft Imagination Information Technology Co., Ltd", L=北京, S=北京, C=CN

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11211887AD441BA7E15E9131AAA0DEF9248A

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
393216:h0lF+okILR2G+pjkuOUdRMqRi9C/ymrzmt:hWFxkILR2GWjkuOCRhvJzW

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file freeaudioeditor.exe has been seen being distributed by the following 11 URLs.

https://dw.uptodown.com/dwn/EhnNxB8CRfXwdLFOQWZGXvvi_r0-l0HoRfF7wxzhoaZkRaOio8f00Z53Zg1kcndaf8SRQ8cPrmSGlRBhuqsjPktqpEAsR_L9jFMCE2u8FLDtDJnzWOagys-2f7Crrert/xQTMQlhxbWA5JVot873IQpo5-ao1y00aQ91DgAmlipG9LvVLMCbFesqilaUBiKUTpbdSQAynhJfpNqtbwocwm6hKl-ztK6YZmph_KY6h6IcBGHX0lWGYvRD9Tp7iqHhE/P1MG8G9RL6gGN7t7Zk-NirxkJeMRPm6tZ4Eje_7fhJao720Vm5AWhjnWqhSBy_3fbqK9H7o-K688y1XY22NFjdnXvDBwtNHnawy2RYXLWTT5NVeBTFO0LNOIDWzvgpwA/.../

https://dw.uptodown.com/dwn/uYV8djPYgDsR-YszmXhF9HFuNzSO6WKm7508-dV5Np6sAIFlyycv3QtEKv0lrbjHPySShsPfVFrRLiH2BvjE5H_3fWmgRkXy7xUoiVKFwcCN9ma4Og2jmzoneJDVawZd/YyTY8ZJQRbT1hZrxez93KM1WfVoncvpQ0nMlaLJvs8eYdqWFzSPTl-XAShH0dOTSfp2W7Ioyms9fkM5yXNo9_bx7CWf5i9gs7fAcYlcKR3A0APXKTjLZaN5bYtZveaQO/DIK55K1-CVW7BDVVuf4xSnqNjJL2qYkDk3fF65scyX4RLAeVB5Q4QOktLjEVCw05IPg34tlCYW-0fzaXK-PDyQEkCiYr6XxcD2RYV_LMv8s6WezH2fF2WJZcL06oph-1/.../

https://dw.uptodown.com/dwn/hgeEKRmWG1neM6fpnXdIuj0M5KUWO-IZD5oCStUKBNtt7rxRyqIAEMTT0xmqfFD0oVfQGvi70tYhsFhzmRIJdb2_nkNViQ_4gwIRK6cplvOCJjftSAlsH0pm3pOJXkz1/8Qrx08g_XhjyxCT2TIulxK-hN_Xl71WkOU8uPjFou-Va2HOlcRyuCM31arCDRwQa-RSmNHq-vq2e-m_Ge6qq2wDS8msn_dPw3pbK13VjIqrdrsaaMY37ObZT3dcifa2F/tU8_wq-Pl3PPx4ABROIlgNJVjlTi2pC8hRdtyR9Lw8k-RwyBdsijTKBXfZ6mFjJEPx9K-FssoiwqMiDBGmcSdQqY__Iv4QTTjn_uUx38MXsH2zkY6qXV1iNzB4a9W3Mh/.../

https://dw.uptodown.com/dwn/pOs-xLtLmRFZMSogEfmgHDOUZa47mQjF4PhTkLZJqj_NwArMDhIYaW7_kb0jYgoKlg8gkq42o-ZOsLKinB3Iy3B-6F3LuRDYElYTWgITTWSGtxDzoP2VeDU7k4NTwLTZ/bOAGSo8m0jsE6hvs8JLBPjZEIOz6oDpy8gB6xjPAwsY7K9I8g02G6APAaINUg8CQM9pL5B3UCb7loMuGOqdIR9LAe2mrqpaQ-IIRbP0zZ71pTmvZmqgZSHDn1BnDfdK0/brP_ryRRQtWw7B6qA1ozwG53eycXlsHSef7jurA4qYeAYZ17xxBnPJRQQXq6H_GQtzyUFcqMaRgL4IDO66s5lqj9IC0G0L0wIpGpVsRxgYsup6g-MSwxESeXJOzMWy8i/.../

https://dw.uptodown.com/dwn/ItOF83ncp0qJsmohCcejssJieNJm5DI3xqxoLjebkPExdQYB9nWGwifHwY_Ax-uz4Qoi5DggRjcJXCpocRA2HWOh0LARBc01_vdhLWw74jtos2jt3xBgi5Yc7Fsbl3HZ/ojIkZ3DfBjQMlgwoypC2680c45qBBZpJW5jYpdYr-jEaQ3gPjA9OTpX2TCKVYmFqzj240MYVwicSFGczJXLRFqsG-8oKoWmuT-Od7mykdMslkMZLLw32xbsAv_YhwHKJ/erXLcDPMgevBQrZ5SN_Xl0yWu3NdneA6TVjR2XvWRannCc_lDwQINyNULYjDDhrR4F3jTJbJYDfYOZ5Tv4nODQe3EFHwVWySODi9T0lNlG402bbPWTBavLetKxXl9E2w/.../

http://dw.uptodown.com/dwn/Xusroaiz7gd0vnRsk3AUOz4Zy8kbrNcb7pscY95JkowA1DikMUHXZdpmXd-59g5HgJZ-psDTlEPKS3oHjOqjJrAYuQ1CBXuRpOokAStErAMXtoPRy98m1LmVma4OL2vc/MAY8LYrNU3zf0blsO2G6Z90iHDC57oRPRLiM3K9mp-shHfrAfpD_eDqnOFFH_KyOeoVgEqaZBtOhCdToXLNNosU-PxdQiy5y55duGG7N4DnmQpbmZ7yzim9jjpb4rrd_/XC8-mmMW0Kq5y_zcydakiE9WEYePKynCZI1vRuXUDKTjSwnr5i4lJz-xk_Nkj3M0cDK8ISTWGOiA_UPmhd3dRbI3ymfd3J4NYTLk2_kgDfVIj8raZbYb2N2VNB6FgMxr/.../

http://dw.uptodown.com/dwn/FnCfHhUECunl8K0L7ewz5_-9HhLguay45XdhoEXZqWJNmLczfpkE_AaNteho-Ai_Y4Pe-Vp3A_O8KRcUQ-T42d5g-5Wc7oN4FXahNkD9RAnNNwJVj-6t5r-3T2jxsETz/V4_HJoUy_pHwoOflQoRF35La5gLbv_Vmj7LlqRw-liOa7Oy_yh3AQAvgljrxstPg_Cu---uJIXUc1JK9J5RujDn_PEqzwRpTnCCJiJkyyO4r-rjML97DMTlhpnlnC0Wk/.../

http://dw.uptodown.com/dwn/KB_VzogfkhFbVjUEEL5p_BibJNcjdGZDvXHEFrqyaAx-j8RjM75rql9JNTSek7huHJi52VHPnflvb4MfgmFNDxTIIG0m-GRwarBkMOGYXvhLlkg0fpdCSWJFT0W8r947/cxm-puzbuFNqbHyP9LaPxYj6_DhM6T9d7BoV7omywxx3LsvIeZnC4ubtr1yr9WGmgujOpOAKmhy_kCTsgQ59mE2K1CoURbUOFDRfUDHZMAybJhmnuoIJE_Hg6geWSQdc/Nkd23QNVLnbAzjvC9K446noWdWSJeWdp0J4REKe2cR8qy3lhS62KepuGNv_t-ltoCF3VEiaj2MiUpGsQQHhXoSAJSElov3dm-lkX7UW-A-ITZGOswJ5svr0ZSpSj9xTt/.../

http://dw.uptodown.com/dwn/5eDL0Tx0EfdOtoQ_hXTpoTfNvq9IcEGGMsaBFTq86XoaqtHRXEGdEWL7-huVvAg0ljB9jjE-y3GZS9sOV8jGhqIoJL-h-chzexAHOCgG_qU-tOdAqlL8H32GJM_QLi1Z/d5iUtxiPBnkDwlf13ZUCDA4PLs41VBsue4hyGOijufJnjvvEKAIDxcU46sYt7pVkdJh1I0xE7_8wezctRD4XM2r4ePhAs_wQFhIBbHyCpJs4pbYrlSBgZNVY6WEQT_K-/.../

http://dw.uptodown.com/dwn/_OTHU4UjlnGkE27JJTMqZGk9ya5ptfyWbRaaq9xPC5k-8-w3UQOpsGgafQbM1iNSNb1PJOfNAZMkwCgYPMu2lS88rj0UOYVhq1m8YG7dFmxRvy7kOM3QCXwhHTEemGph/oPHQOmpGwaVXfdUBIKHmR2RC1UvPU8pWxpdpfhMfNQGDIGouM4temekm_ao4W8GuzF8XMWBvyPqBl6ph-LI3pv3xz6dg7Ywkr4N1oYKgTd0__446aUQamN7rSekKvKth/.../

http://www.free-audio-editor.com/FreeAudioEditor.exe

Remove freeaudioeditor.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.