» kingsoft office suite free 2013 setup.exe
Overview
Analysis
File Details

kingsoft office suite free 2013 setup.exe

WeDownload, Ltd

The application kingsoft office suite free 2013 setup.exe by WeDownload has been detected as adware by 18 anti-malware scanners. The program is a setup application that uses the Midia Downloader installer. During install, it bundles potentially unwanted software on a user's computer at the same time without adequate consent.

File name:

Publisher:

WeDownload, Ltd (signed and verified)

MD5:

6e8218792517b086faf8dd25d01abaed

SHA-1:

9637f70daf424b0f6ec7f705e2015b97ef78dc8a

SHA-256:

eed90ebc70bfc8333396e62f9af9baed16b6b6139f39fc61049ba446b2828a41

Scanner detections:

18 / 68

Status:

Adware

Explanation:

May bundle additional potentially unwanted software such as adware during setup.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

4/18/2024 8:58:19 PM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

APPL/Downloader.Gen

7.11.164.78

avast!

Downloader-TOV [PUP]

141003-0

AVG

Wedownload

2015.0.3314

Clam AntiVirus

Win.Adware.Outbrowse-2

0.98/19185

ESET NOD32

MSIL/Soft32Downloader.C potentially unwanted application

7.0.302.0

G Data

Win32.Application.Soft32Downloader

14.10.24

K7 AntiVirus

Unwanted-Program

13.176.11524

Kaspersky

not-a-virus:Downloader.Win32.Agent

15.0.0.494

Malwarebytes

PUP.Optional.BundleInstaller.A

v2014.10.22.08

McAfee

Trojan.Artemis!4792E540C224

5600.6970

Panda Antivirus

Trj/OCJ.D

14.10.22.08

Qihoo 360 Security

Trojan.Generic

1.0.0.1015

Reason Heuristics

PUP.Installer.WeDownload.f

14.10.22.8

Sophos

Generic PUA MD

4.98

Trend Micro House Call

TROJ_GE.2E2DC958

7.2.295

Vba32 AntiVirus

Downloader.Agent

3.12.24.3

VIPRE Antivirus

Trojan.Win32.Generic

27652

Zillya! Antivirus

Downloader.Agent.Win32.198822

2.0.0.1852

File size:

591.8 KB (606,040 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Midia Downloader (using Nullsoft Install System)

Common path:

C:\users\{user}\downloads\kingsoft office suite free 2013 setup.exe

Digital Signature

Signed by:

WeDownload, Ltd

Authority:

DigiCert Inc

Valid from:

2/6/2013 12:00:00 AM

Valid to:

2/11/2016 12:00:00 PM

Subject:

CN="WeDownload, Ltd", O="WeDownload, Ltd", L=Nicosia, C=CY

Issuer:

CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:

0320C5B8F7CE6E92D3665598826A4480

File PE Metadata

Compilation timestamp:

12/5/2009 10:50:52 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

12288:3wMDD46DsVcCVUbFLS+E45hOKacc/88phZbQfGt4HpLKiddm:3tgGEUJLSi5h07NUxvdm

Entry address:

0x30FA

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00... 
[+]

Entropy:

7.9167

Packer / compiler:

Nullsoft install system v2.x

Code size:

23.5 KB (24,064 bytes)

Remove kingsoft office suite free 2013 setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.