home

freefilesync_7.8_windows_setup.exe

FreeFileSync

Open Source Developer, Zenju (Florian BAUER)

The application freefilesync_7.8_windows_setup.exe, “FreeFileSync Setup ” by Open Source Developer, Zenju (Florian BAUER) has been detected as a potentially unwanted program by 2 anti-malware scanners. This is a setup and installation application and has been known to bundle potentially unwanted software. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars.
Publisher:
www.FreeFileSync.org   (signed by Open Source Developer, Zenju (Florian BAUER))

Product:
FreeFileSync

Description:
FreeFileSync Setup

Version:
7.8

MD5:
c927f9a454b478c35c8d2014543f4081

SHA-1:
410f488f712871b10daf814f9bd545890fb00750

SHA-256:
20aea80927122fc012a3437dec53a0fbcf694760ba07fd423dd4443a3c28765b

Scanner detections:
2 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
4/24/2024 10:18:09 PM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/OpenCandy.A potentially unsafe (variant)
10.12822

Reason Heuristics
PUP.OpenCandy.Installer (L)
16.1.5.18

File size:
10.1 MB (10,600,000 bytes)

Product version:
7.8

Copyright:
Zenju - All Rights Reserved

File type:
Executable application (Win32 EXE)

Digital Signature
Signed by:
Open Source Developer, Zenju (Florian BAUER)

Authority:
Unizeto Technologies S.A.

Valid from:
8/11/2015 1:43:03 PM

Valid to:
8/10/2016 1:43:03 PM

Subject:
E=zenju@gmx.de, CN="Open Source Developer, Zenju (Florian BAUER)", O=Open Source Developer, C=DE

Issuer:
CN=Certum Level III CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL

Serial number:
1A92CE3E55B64BACCE47710EB787079F

File PE Metadata
Compilation timestamp:
12/28/2015 1:39:51 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
196608:2SrAJKQ7862tJmFniF2Ood+fh7HQM8vjltrOm8tVmEuG9tnKq:gsQNZik98QM8blFO5mEu0FKq

Entry address:
0x113BC

Entry point:
55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, 34, 00, 41, 00, E8, E8, 51, FF, FF, 33, C0, 55, 68, 9E, 1A, 41, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 5A, 1A, 41, 00, 64, FF, 32, 64, 89, 22, A1, 48, 5B, 41, 00, E8, 1E, D8, FF, FF, E8, 6D, D3, FF, FF, 80, 3D, DC, 2A, 41, 00, 00, 74, 0C, E8, 33, D9, FF, FF, 33, C0, E8, 80, 32, FF, FF, 8D, 55, EC, 33, C0, E8, E2, A3, FF, FF, 8B, 55, EC, B8, 54, 86...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
63.5 KB (65,024 bytes)

The file freefilesync_7.8_windows_setup.exe has been seen being distributed by the following 2 URLs.

http://www.freefilesync.org/download2/.../FreeFileSync_7.8_Windows_Setup.exe

https://doc-08-b4-docs.googleusercontent.com/docs/securesc/s2fm3fkc085e30onb734a2tkjhku1u7h/rvpmat8435qtst237d13bbl005bu2gee/1452002400000/00596995306655459898/.../0B1aq3hyKWR7yQk5HYjVwOWRZb1k?e=download&nonce=c8v88cfaenrb2&user=05815287692042944728&hash=sgee9mka0n25k8amur79ka62jpn3fp03

Remove freefilesync_7.8_windows_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.