home

gamingcandygames.exe

GamingCandy

The application gamingcandygames.exe by GamingCandy has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from pofj.gamingcandy.com and multiple other hosts.
Publisher:
GamingCandy  (signed and verified)

MD5:
be72cca228ed74e537a2ddc6eeaee354

SHA-1:
cd1156524b3b8d3a08ff8baeb319be75d1e84d5d

SHA-256:
63e7432b5fce06669c090e7fec2f8af70b6a753d35efc9fd7e25599221f4165a

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
5/2/2024 6:22:22 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.GamingCandy.Installer (M)
15.11.5.16

File size:
71.5 KB (73,240 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\gamingcandygames.exe

Digital Signature
Signed by:
GamingCandy

Authority:
GlobalSign nv-sa

Valid from:
4/24/2015 3:13:29 PM

Valid to:
4/24/2016 3:13:29 PM

Subject:
CN=GamingCandy, O=GamingCandy, L=Sacramento, S=CA, C=US

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121BA440524F66114476B688D8F46FA99C0

File PE Metadata
Compilation timestamp:
12/5/2009 4:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
1536:OQpQ5EP0ijnRTXJovHNXKQCDOCZwrh9LyOaNfDq:OQIURTXJ8tXhrh9LyBV+

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Entropy:
7.4069

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file gamingcandygames.exe has been seen being distributed by the following 35 URLs.

http://pofj.gamingcandy.com/.../inst?i=YTM1MTExNzIxMjHboUUqDbSzw6ih0MkOeHk44VkSPsRNsf52rmZOnK3aeFKQdyepXANaka8WY5r7rRIVVsuI7rDaa7DkMNpDNu5N3KY0VrFxeZtOkvZph29xQcr9dXBjmbGEU5CqWdLjBC3vuNQGvsJE/ulM/iCI+Wvq

http://pofj.gamingcandy.com/.../inst?i=YTM5NzQxMTkwNTNP+/iBKszCfhpz+9VIsdAjh9jfBTBEt1l/wfP21pfUGqH/+9YOTkHDQiuT+vOZqPIGxb1EqNNnF5HoIbGzh8aFub13H0NDZLh1IWL+HIylZ5LOAjXaY2R2maTiVjeoiZMBdvduzY295+lM/iCI+Wvq

http://gamingcandy.com/prm/clk?t=YTI4NzQ2MjM0NzbYfghtl6bobjKvLljuRSdHR3eICkpefrPol46c0PbWlVmK3tv4aLLsFYY0yeeYgW772kdNEGaS1rTuR64iRoEbTpIrRK2NOp8fvSJED/gbBb/.../19msC9AS

http://gamingcandy.com/prm/clk?t=OTI5NDQ2OTQ5NIjt135KGbdeJ3EyroT7LNVNB I bJHCrNQgVMldSgqSFgSCHDiKR29UE/Ta2KpOBGhfEHj5NPgx4ZVFgoAVVYZjqru5ZVT6Nv1l6stYmPmnBxc9KalsQNA3N/.../0OVKdzjE6KCLMa5pGedtL2FDu e7qawYTplkCQE=&c=gameId263

http://gamingcandy.com/prm/clk?t=YTE5NjQzOTQyMznhSNDwO/lvyT4W5Rq1fSzpkpQw7AMH2NdIPEkNtxwcktNXhwaZGYKYV2nIcTnKtGb40uB1dGZ9wCUDCaIgnZD/.../51oOl9Itt2BbqL2iprwvUOseoclfxZNCCWV93cIBL9r5hTFKCj60d DPFtHK3gfZhaY6xn178&c=gameId263

http://gamingcandy.com/prm/clk?t=YTM0MTY2NzA4Mzn2MXtoOO/.../YP8TYtcCdXoJ0GVqDHyrwIxPR3SDVP7gt2M3e9vWZzJJrRtjqNxyocSWrCA18 UZAmdNp3bbmMvNANQ8fM2oYz1WPk5fobxLyfT2ABweKlqQQMTAUMYWWcy5C3o JOzRq2 E86llcXK2t8IQAgKX89m RO8&c=gameId3789

http://gamingcandy.com/prm/clk?t=YTM4OTA3NTg4MTn2MXtoOO/.../hX13DT1HOQY62L4YkMmO8mIfVlZ MF0D2gyyS8aVVtOGioX6Yshnaw2Wc2n2eJ4KA7SXgSzKvdKS9bEN5dVcfLMTbGFejeVMrSy8jHm1bbfy8WqE3aSA9ZesrWV2Ra9&c=gameId3961

http://gamingcandy.com/prm/clk?t=YTEwMTU4OTA2MzIj46eKkBfKR93SeAWGz1Gl/H8I7Bk7IlzcG9 fns8Sy4z9FJcPgt9F68nyLpgtxmZ/.../fXdfhN8WfEnY22G0ImaRKKQrCk5GTltTt1qGg3sk2bEXdxalPoheuqDdP1BtwXtdvfYrtlqKxmzWLQa2I7PdU8SMmW4V&c=gameId281

http://gamingcandy.com/prm/clk?t=YTMwNTU1MDEyNzDhSNDwO/.../pbvSNhVMIV3Kqcq1OuqQHw3CqGWRahEOink6wj0XGyjcekHQzGLmVia OE RC8jLgBGLrAOsdhMlNObOGqp3WpnqSgbQLatjTRYR2AdE tupizmHe7JmRVfPrYH&c=gameId3789

http://gamingcandy.com/prm/clk?t=OTg3MjIzNzE3M0DzBft3f/kHNR/lKqHcM9VvCmTUNZAtOb7gurLukF uL8n80EyXcYds71fYr0JQ3/AElZE n8/.../icDfPgsFt1b16RMU=&c=gameId260

http://gamingcandy.com/prm/clk?t=OTE3NDQ3NTA5OHRxnK/.../cE6Wlp Zdp2grAYeQcnsIOVaymosKYzH9dMDOb qTE3Ykqwc27aVfcbxCpil8EScKZudBtAhlLo=&c=gameId3961

http://pofj.gamingcandy.com/prm/inst?i=YTMxMjk0OTAyODTboUUqDbSzw6ih0MkOeHk44VkSPsRNsf4hgiR0z0TsSuj8OXXnYOtgyQYHhUroQK8FJTDzyt p w2D8nfpR1ENLQF4GMud9/.../iCI Wvq

http://gamingcandy.com/prm/clk?t=YTMyODg2Nzg4MDSKP AXG/.../ngeeAfOJ8&c=gameId2811

http://gamingcandy.com/prm/clk?t=OTQ3NjMzMjU5MTKofWVFjPET3kIWbQkOdM8jGLj9ESI2zMpEc0l/zXd3pdwI2oBYk7BM4ppBahtWsVkxyL5ZVVHwfZQnLgpOp mSpOS5QT7d/qupeBMjJgZhcAr8qQD8pcKDpYLA9C4UNYfAqRzjYvmmLLzfYCvKMm/.../IBRE3ZProW hgDc BI=&c=gameId3789

http://pofj.gamingcandy.com/prm/inst?i=OTMzMDQ0NTY5N/iROXEkFsRselyMBBzkun/vocdKV6kuXJNIBwppN5J1GFWOGJ/aG3eBE/XNqEVQcGOJZzAv ECfT6Uvr10jTXzjp7BQvgT SOrq2RWjIRIiGDiG7BmmchO5qYRmnxWbU2KpCuPsg1NVRH5U/.../cs=

http://pofj.gamingcandy.com/prm/inst?i=YTI0ODI3MTU3MDGG0qdSob/ZR9nc3ueCn0wQ4LBD2Cm0Mxtf6unqMsgd1OMXSR2e/xbSz4DsVL/M6/uwT4tF99VdOc65qY/NFyHULfn3raIT1u5719IVfY2IgcP5bP72AtOb0c1jPTK5146dM/.../cA==

http://gamingcandy.com/prm/clk?t=YTIyMTQ3NDA4OTWQjPdZoHE/tjeGCBnKfHJbqns48nPS986W5vS5peEYFsZWGzeHlKQVuE BS3SEB8PkqNbT2kgDZdAIOeWgVso1fVoTi3DiW4xiC7mcmKnQccGBKfSHtRudeF2kgECc64cX2hCKeacznKIEHAfAsZL0aV4NJB5GrFMNWcwG/.../DK1V98vm9X&c=gameId217

http://pofj.gamingcandy.com/prm/inst?i=YTIyODk4NDEwOTAl4AccMLm8xhZB0afXNw3S3r7UdBLUdZ3BLScceoa4H4TO im0 Tqtjw/QyXpt/ElOujgGylb/6xbnZD1fs1R//.../A==

http://gamingcandy.com/prm/.../Ut5Lfx0Mgz1lPNJQtAi&c=gameId2811

http://pofj.gamingcandy.com/prm/inst?i=YTIwNzYwNjMzMjDboUUqDbSzw6ih0MkOeHk44VkSPsRNsf4v0b6zuSDKtM68cQoyjleJRKu33 fDkEMZkQ2O1esVJ2Low1T4EW1Rbns/.../xWcw1icX

http://gamingcandy.com/prm/clk?t=YTEzOTM1MDg0NTSQjPdZoHE/tniZ300cJDszW9zFoUnOttJeU8cZV pABRuunBcPaFUyQ3EftDli93Ga3fCEOwflqnnT/k/.../B2Xxv3AOzUKSzxKdPhE4zg4sY&c=gameId2811

http://pofj.gamingcandy.com/prm/inst?i=YTI3NTUyMTI2NDU xLe4HwlZ6QOjHkWxyPwuKDxdhbpcas6CYl hO5 jWIzDDKdivkr5Kylx5uhCbEhJJAn/.../

http://pofj.gamingcandy.com/prm/inst?i=YTM4Mzc2MDQwNTUCP 16XfmFZgFsAYfL6ohr6WHpXEXKapI1B8ijJb8rCtocy55FRz8Cd7CFepwa43ks0SxKUKGgoV1U6/xSBiyoEoaEmEBR9RYSjWHQgfgH/.../Jx2bm96DAEOBlv3JWFb9dLQCnw==

http://pofj.gamingcandy.com/.../inst?i=YTIwNDE5MTk3MTHboUUqDbSzw6ih0MkOeHk44VkSPsRNsf4SNzx27 sbqUymgkUiMeTzJyscp9PG6Ylanaw7pAmlJK3l7l9aIEipfOmtMrkvnS4gA4X2361b 947k1WUoMl8yL9ZJKK2edVomVezviGXiN1klQnNH6wE

http://gamingcandy.com/prm/clk?t=YTMwMzgyNjgyOTci9Oa7hQiTo7onVLlxmuz/HODYDGGBkKxxxkAAO/T2rwVitAAovE9R5QHKnuu7Pjxvd29klUj5NoBJ7X9EkBWcmqrzb8fE Pt55tXkp69JXQ64qO 64MstnC7p 2OtD9cT6MjeJzzY/.../XGzZNTi&c=gameId2811

http://pofj.gamingcandy.com/prm/inst?i=YTIxMDA3Njk2MTRxZ546zXofWZyEB1oeBTF e/9IHqhmnu 097sdvVAS2qY47z5FXLmrctjfhAnp3sCMXue0u9Y7i3AA4QWzkHMDHPiyZQUoXGS5NlweXloKhhEdDixGGDYv0RxVPnTW3Ww4fYsYDIt/.../iCI Wvq

http://pofj.gamingcandy.com/prm/inst?i=YTM2MDQ4ODY2NzUowgyQT0PRhq1S8mtD1Y4ix1ad6hXNwrz67AOIOkfLlgHUsGlSeOs5BxO 4Bi4 TiHa2c42ajb68J6JzdOj MFn66xx38Vod85BOaNu4cBTnU2nhc4sLuFzM9WTAMAkTRJd/.../w==

http://pofj.gamingcandy.com/prm/inst?i=OTQ0NjcwNjg1MVVMRoEU0 /AISkN1vzIDIbfuUYfh4pIceCPCzgNVlNm3RaVH6M2J1iIxWzttSAABmaAumMryD2GJ0bKKSLZTTaRJitzad nyxCv4ezeNtF6J/.../kdfXZKHyMVAuK3op5TLsqhGLj0=

http://gamingcandy.com/prm/clk?t=OTQ2NjMwNTcyNYjt135KGbdeIj5NvoOZha6mohP42QHJe f/PGaZX6IMUbMR3JJbAc2p7Eb xkKpFhDMjzhPL1pq6Nt1OV94AU/.../dx4QLRq TbaavZcWp0OWucppeA9B12yViYlThf7wFyhR6fER0Hs15eTTELuYPBYaVoBXUgMg=&c=gameId174

http://gamingcandy.com/prm/clk?t=YTE1NjU0MDk3MzjhSNDwO/.../ksxo6mvGcu1RP4ArQ hq0bIrT632g81TOvI5ccVTUoLUOw5RMG2BF8jQmpDBchIqTmCItwBB9OzyS798yju2qLYMqgozZ0CcVL62B5oU5weQIB1vtYnF1TWLMC0aNi&c=gameId2811

Latest 30 of 35 download URLs

Remove gamingcandygames.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.