home

freeocrtoword.exe

Web Software

Beijing Qingchuanglianxiang Technology Co Ltd

The application freeocrtoword.exe, “Web Software Setup ” by Beijing Qingchuanglianxiang Technology Co has been detected as a potentially unwanted program by 2 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.appscitybundle.com and multiple other hosts.
Publisher:
Prog Lite Installer   (signed by Beijing Qingchuanglianxiang Technology Co Ltd)

Product:
Web Software

Description:
Web Software Setup

MD5:
f603248e9f6e7eccdc3feec4d7568d26

SHA-1:
e8373a4aedf42ca6c59347b036c58f18b49e0b5d

SHA-256:
55f38d11eb7fcf96437be345eb17de35092a273c1cc3494872bb70f576a22b72

Scanner detections:
2 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
5/11/2024 7:41:25 PM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/InstallCore.ADX.gen potentially unwanted application
7.0.302.0

Reason Heuristics
PUP.InstallCore.Bundler (M)
16.1.27.20

File size:
904 KB (925,696 bytes)

Product version:
5.0

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\freeocrtoword.exe

Digital Signature
Signed by:
Beijing Qingchuanglianxiang Technology Co Ltd

Authority:
COMODO CA Limited

Valid from:
9/11/2015 5:30:00 AM

Valid to:
9/11/2016 5:29:59 AM

Subject:
CN=Beijing Qingchuanglianxiang Technology Co Ltd, O=Beijing Qingchuanglianxiang Technology Co Ltd, STREET="1901,Moma Building, No.199 Chaoyangbei Road,", L=Chaoyang, S=BeiJing, PostalCode=100027, C=CN

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00E5F50EB929935434546FDDE8F49FCB1E

File PE Metadata
Compilation timestamp:
6/20/1992 3:52:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:DtjvaxVYPchE3nUeRAJv5H7puxtqvVQXldh8:DlMVtAUeaJvxkbs8ldh

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9366

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file freeocrtoword.exe has been seen being distributed by the following 9 URLs.

http://www.appscitybundle.com/c?x=6n jAerdBnHlpL3oM9RuH/0gh6hawOhAE4D6Px4poc=&c=JPNFo8djKJNOktxHVxUq5kgfKRRIjqs87zQbs/NS5kcE2qfFDvO2eG90P4hnG0BbftqpoMU X9siYqB40SzakfFzDFF6BA7JRqjnCXob1ClkpAjM0W uaPTJjiZOD9m &downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.flashpackageapplications.com/c?x=lNql5r7ZAOxNKo1RbtF7pAXp95bO7id2AmFJ85iwJ88=&c=tDlVmJakA0jymfIqaBNhq6GLR/lqLE8F6PSyFj6GMGGBIslvOj0 F67xnr2IixEruO4KHY35HUoMu97KBJK/kx8r3er1M1f9/nhtyeuV/2I2SQfJ/I/3heObjw05vWnL&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.cyclestockcentral.com/c?x=V77czeGCUCVHklAFXAQF zTvlZIN33LXLGtJhKi05bQ=&c=ovE6q/uu18aWmf2kqqZMdDeLDU4e6Z6hU/R17mCyVx045mhkXi6QvYkl0zik7qqmpWfYJaZwurORdtIJq5qXD0Zi KzY44UIxFTBlqH3pVqnURHs5JxVaFatdwFoOpDs&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.cleanconecptdl.com/c?x=rmIvo3vpfntU0i95TAgBskUq3pHvZolFtpDTQ2psKQM=&c=s13 4FK2UC9EifUv2MaJH8ir pqiKAG4YsjCnEqKSw1s1zo7wu4HewsqFvZVkkF8yAXlVM wATR5/fVtVAlWvbSrUAlE42STDKjHrl7M7gsR/N8ifZsjJ1Jy9PlkmuGZ&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.safequickbest.com/c?x=A4I9SxzhLBbQhDZ3M/oH8faCtLj0mDdpK9VcEAxTUdw=&c=9XdDXYPq RUfBn9h1y9di9qP8g0RnZ5DOJ8K7DOhujl Ban6Ij91w5kP3ifM/RFPDBN1J6Avfal0fFzWx0tEWjlR8ieiAMhvDQEQs6guUJSYE9V/mlAc 0B6hLPjgrfk&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.applicationstowersupdate.com/c?x=kUbsppzxct673e7qqyuwinHJZ25WDd HMuOCZE43Cek=&c=WvErT/qUmGirZC0KihckZc7lZvWhWWYTCA5YNkiPRjigQx5zUhCGgg5kAuLSGVnjDSGs1Dy957w 6oH/6xaXuiNR/lQYtXjv2Vw sjmxbNYgjY6UKWXeZSc7cJNMQqvw&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.grabhostcentral.com/c?x=N8OunEEY zhi3/d8qAKsWCMc8d67ni54wHKj28Cb3CM=&c=Oy9 jadw/AXL5C8nMoe/Wpd3vpmA3XAIufkMd6wZNpXMCprFVgrmH988Cogg2/Y689p4M9783M8bvrUVuKhjFr928YACFLVjW9iGaWQZeb2q ZraclQjmdavjH6MK8Me&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.bundlegiftdownload.com/c?x=jCFB2ZE9ExVarrgVygXbHQ lPQAZfvyvGXgCPJOgY30=&c=DZz05NLFr 5hVRUWDnIUcffKb4zjtDHijb2tjqNBSuMOLNXCeqVshq9HJeaozbfuv90eqkRUc8GBm5YU5JfNFtrvDp1Ud7eyPogtC 8RfzH2cz2f7nxSWYu60lyx7xTj&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

http://www.towerheadrepository.com/c?x= Dyu9Uo9RQwXlSG5iJ/GCz4vfRW7rzlfEvpoBQT1xRs=&c= y9oHwn4MEq81PPuPmE/YKMr8ZdVkordSdlU8mx9dCc0Bma9 N2lLrFJzz7LBH9eQg0yPJJmb/N/rRct7nKm5j3vcc5mx70ymqAIxtQtenXod3VR0KrQYyToPUfG60bZ&downloadAs=FreeOCRtoWord.exe&fallback_url=http://www.downloadonic.com/ocrtoword.com/.../FreeOCRtoWord_IS.exe

Remove freeocrtoword.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.