home

kmpaddedcode_oppercd.exe

Groovecom

The application kmpaddedcode_oppercd.exe by Groovecom has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from files4.downloadnet253.com and multiple other hosts.
Publisher:
Groovecom  (signed and verified)

Product:
Groovecom

Version:
80.8.8.8035

MD5:
0e631532ee9deaf94127274f37bc68a8

SHA-1:
97890cfcb816f91aaa4bb9acbd51e53f7a30c9d1

SHA-256:
713f010733d62ed8dceacd36a8fcdf8a784bac4af08f9660015058134176b5fb

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
4/24/2024 10:34:41 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.DownloadAdmin.Groovecom.Installer (M)
15.11.27.23

File size:
871.3 KB (892,240 bytes)

Product version:
80.8.8.8035

Copyright:
Copyright (C) 2015

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\kmpaddedcode_oppercd.exe

Digital Signature
Signed by:
Groovecom

Authority:
GoDaddy.com, Inc.

Valid from:
11/11/2015 10:18:38 PM

Valid to:
9/10/2016 9:39:55 PM

Subject:
CN=Groovecom, O=Groovecom, L=San Francisco, S=California, C=US

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
00A5A543D1F82F75E7

File PE Metadata
Compilation timestamp:
11/4/2014 8:12:01 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
12288:CGLVJOFbaPq7JeErrminQ0QNhmZCtyUHeo0TZf4JfZbTlxj4qGRrrAQynvTdcCTZ:HEWiVa0Q0QNttyiAQZbD4rRfZy/RvaIr

Entry address:
0x2026

Entry point:
E8, D5, B8, 00, 00, E9, D3, B1, 00, 00, FF, 25, B0, 40, 41, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 83, EC, 20, B9, 1E, 00, 00, 00, 8D, 04, 24, EB, 03, 8D, 49, 00, C6, 00, 00, 40, 83, E9, 01, 75, F7, 53, 55, 8B, 6C, 24, 2C, 56, 8B, C5, 57, 8D, 50, 01, 8A, 08, 40, 84, C9, 75, F9, 2B, C2, 8B, F8, 8D, 5F, 02, 53, FF, 15, F4, F1, 40, 00, 83, C4, 04, 53, 8B, F0, 55, 56, FF, 15, 44, F0, 40, 00, C6, 04, 3E, 00, C6, 44, 3E, 01, 00, 8D, 4C, 24, 10, B8, 14, 04, 00, 00, 51, 89, 74, 24, 1C, C7, 44, 24, 18, 03, 00...
 
[+]

Entropy:
7.9690  (probably packed)

Code size:
52.5 KB (53,760 bytes)

The file kmpaddedcode_oppercd.exe has been seen being distributed by the following 18 URLs.

http://files4.downloadnet253.com/dl-pure/.../?bc=1188307&checksum=74441&cb=1766298868

http://files4.downloadnet253.com/dl-pure/.../?bc=1188307&checksum=74441&cb=1475856531

http://files4.downloadnet253.com/dl-pure/.../?bc=1188307&checksum=74441&cb=-1941637811

http://files4.downloadnet253.com/dl-pure/.../?bc=1188307&checksum=74441&cb=-1474974218

http://files4.downloadnet253.com/dl-pure/.../?bc=1188307&checksum=74441&cb=-1761063223

http://files4.downloadnet253.com/dl-pure/.../?bc=1188307&checksum=74441&cb=-1613026133

http://files4.downloadnet253.com/dl-pure/.../?bc=1188307&checksum=74441&cb=-1556434427

http://files4.downloadnet253.com/dl-pure/.../?bc=1188307&checksum=74441&cb=-157130464

http://files4.downloadnet253.com/dl-pure/.../?bc=1188307&checksum=74441&cb=-1652885753

http://files4.downloadnet253.com/dl-pure/.../?bc=1188307&checksum=74441&cb=-1213522861

http://files4.downloadnet253.com/dl-pure/.../?bc=1188307&checksum=74441&cb=674043232

http://files4.downloadnet253.com/dl-pure/.../?bc=1188307&checksum=74441&cb=-85886597

http://files4.downloadnet253.com/dl-pure/.../?bc=1188307&checksum=74441&cb=-2060807661

http://files4.downloadnet253.com/dl-pure/.../?bc=1188307&checksum=74441&cb=1520708909

http://files4.downloadnet253.com/dl-pure/.../?bc=1188307&checksum=74441&cb=340322370

http://files4.downloadnet253.com/dl-pure/.../?bc=1188307&checksum=74441&cb=615472367

http://files4.downloadnet253.com/dl-pure/.../?bc=1188307&checksum=74441&cb=-612847926

http://files4.downloadnet253.com/dl-pure/.../?bc=1188307&checksum=74441&cb=-2093752924

Remove kmpaddedcode_oppercd.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.