goodsearch-toolbar-1.0.33.exe

GoodSearch Toolbar

Software Association LLC

The application goodsearch-toolbar-1.0.33.exe by Software Association has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from goodsearch-toolbar.joydownload.com.
Publisher:
Software Association LLC  (signed and verified)

Product:
GoodSearch Toolbar

Version:
1.0.0.0

MD5:
99ea4f3820bbfbb9127f01ad18f5e568

SHA-1:
a9f0b3090976a0136fae1779d08efc4c6bd214bb

SHA-256:
433a01cb912478d54b793c56d1a08321eb137d56c3ca127612426d5298bccf09

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
5/28/2024 8:42:27 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.OpenCandy (M)
16.7.17.2

File size:
412.1 KB (421,968 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\goodsearch-toolbar-1.0.33.exe

Digital Signature
Authority:
DigiCert Inc

Valid from:
1/12/2015 7:00:00 PM

Valid to:
1/21/2016 7:00:00 AM

Subject:
CN=Software Association LLC, O=Software Association LLC, L=Dnepropetrovsk, S=Dnipropetrovs'ka Oblast', C=UA

Issuer:
CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0E1FC80B1C57AD69AA6F8D65D1CF90CF

File PE Metadata
Compilation timestamp:
5/19/2013 6:53:00 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6144:+iucV6aFpJL/05vnOjGcZS995nWIc8jnxsp0QC70uATBRJBuPNQtqFN6G:+iuSpXGcZEnDc87A0QgA7yRh

Entry address:
0x331C

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, 98, 92, 42, 00, E8, A8, 2E, 00, 00, A3, E4, 91, 42, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, 90, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, E0, 81, 42, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Entropy:
7.8770

Packer / compiler:
Nullsoft install system v2.x

Code size:
24 KB (24,576 bytes)

The file goodsearch-toolbar-1.0.33.exe has been seen being distributed by the following URL.

Remove goodsearch-toolbar-1.0.33.exe - Powered by Reason Core Security