home

freeocrtoword.exe

Internet Web

TechEvolve GMBH

The application freeocrtoword.exe, “Internet Web Setup ” by TechEvolve GMBH has been detected as a potentially unwanted program by 15 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from cdn.amazingfolderscenter.com and multiple other hosts.
Publisher:
Installer   (signed by TechEvolve GMBH)

Product:
Internet Web

Description:
Internet Web Setup

Version:
4.7.4.4

MD5:
30d05bf15981994a3834073a28c018b4

SHA-1:
76b5adc85b47817c105704c0cf70b0153b0517d9

SHA-256:
b12dede1008bd8918e3c3ffc45f137dba55d61d20fdf09220ae1e3994d8dfccd

Scanner detections:
15 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
5/17/2024 1:31:11 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.InstallCore
7.1.1

avast!
Win32:Malware-gen
2014.9-150430

Baidu Antivirus
Adware.Win32.InstallCore
4.0.3.15430

Bkav FE
W32.HfsAdware
1.3.0.6379

Dr.Web
Trojan.InstallCore.151
9.0.1.0120

ESET NOD32
Win32/InstallCore.YK potentially unwanted application
9.7.0.302.0

Fortinet FortiGate
Riskware/InstallCore
4/30/2015

herdProtect (fuzzy)
variant of freepdfconverterutilities.exe
2015.7.30.12

K7 AntiVirus
Unwanted-Program
13.202.15473

McAfee
Artemis!30D05BF15981
5600.6779

Norman
InstallCore.CERT
11.20150430

Reason Heuristics
Threat.Installer.TechEvolveGMBH
15.4.30.12

Trend Micro House Call
Suspicious_GEN.F47V0324
7.2.120

Vba32 AntiVirus
Malware-Cryptor.InstallCore.gen
3.12.26.3

VIPRE Antivirus
Threat.4786018
38882

File size:
656.6 KB (672,312 bytes)

Product version:
1.4.1

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\01-04-2015\freeocrtoword.exe

Digital Signature
Signed by:
TechEvolve GMBH

Authority:
VeriSign, Inc.

Valid from:
12/15/2012 5:00:00 PM

Valid to:
12/16/2015 4:59:59 PM

Subject:
CN=TechEvolve GMBH, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=TechEvolve GMBH, L=Beijing, S=Beijing, C=CN

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
50FF3D5C361AE9F52E4B0A3CF576C6EE

File PE Metadata
Compilation timestamp:
6/19/1992 4:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:A3rpJQY6BXg5UOOvFjkcxj4YB6ZqGFWSiflm38+PHfhmv8R/4FwCFVQoC:A3r7T6BXNNjtjzfSWSi9m31/hmvVNC

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.8894

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file freeocrtoword.exe has been seen being distributed by the following 4 URLs.

http://cdn.amazingfolderscenter.com/c?x=Ts aN3Vkb0dIUds 5SIKWhoLms/LvSOBn5/QQhbkLxg=&c=tOZa sROrzwTSJ9CODvsihmESDu9i1UbvSMi4Fe6z5FwwX6mhnuNm/gUfXeTSdE91EKshLe1xYRPHHZ9 JTL9A==&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://cdn.amazingfolderscenter.com/c?x=wl nnF1sypn3roC1g6nj1UTu3VdxxFApkuzxB1O IlM=&c=Sk9l1KMqtptiOHIMEBSleghcV4Vpus dZoYjyFk tJ/0qgpkKYAwiq31SMDN6b35hPrxDn941u1E5D6HDAxlnQ==&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://cdn.amazingfolderscenter.com/c?x=EjqPsqhZRIdsZcMY/vcOJoDiT1fi dQ2AegWJ0H U5w=&c=N54/TCL76lxRaGEEoPO0Y amHMEzCRI Bal5Dwijj2K6lWLi4zzuGo8dvVbXtmH53rjBmED8Esub3hKT5canGw==&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://cdn.amazingfolderscenter.com/c?x=K2Zx6B5EJfzYIelTlsPXn /bb9pfH1lQfyAUInMhIg0=&c=18TCvAUXkzh/NCipGlfDr7RVADPbqkMN4l1LlksEvsW1lNd n073jkAg4SXLJH6jGB70waeiMqtQ49Wyp/aSSw==&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.ocrtoword.com/.../FreeOCRtoWord_IS.exe

Remove freeocrtoword.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.