» mediawidgettrialtype40setup.exe
Overview
Analysis
File Details
Downloads (4)

mediawidgettrialtype40setup.exe

MediaWidget

Bootstrap Development, LLC

The application mediawidgettrialtype40setup.exe, “MediaWidget 6.0 ” by Bootstrap Development has been detected as a potentially unwanted program by 4 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.

File name:

Publisher:

Bootstrap Development, LLC. (signed by Bootstrap Development, LLC)

Product:

MediaWidget

Description:

MediaWidget 6.0

Version:

6.0.64.1622

MD5:

45450735c35ffab19a54d4fe3ed8e56c

SHA-1:

d5a44b717a8e9498c23b56d9ec1bce96af471cfe

SHA-256:

5083c7ec9f6032292a1803f33d79a2a9a90a879a83d02401d5a994917faaf530

Scanner detections:

4 / 68

Status:

Potentially unwanted

Explanation:

Bundles that Ask.com toolbar as a third-party offer, a web browser extension that may modify a user's search and home pages.

Analysis date:

4/25/2024 10:07:51 AM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

Riskware.OpenCandy

7.1.1

Dr.Web

Adware.Toolbar.240

9.0.1.0214

ESET NOD32

Win32/Bundled.Toolbar.Ask (variant)

8.10183

NANO AntiVirus

Trojan.Win32.OpenCandy.cuziab

0.28.2.61148

File size:

13 MB (13,610,728 bytes)

Product version:

6.0.64.1622

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Common path:

C:\users\{user}\downloads\mediawidgettrialtype40setup.exe

Digital Signature

Signed by:

Bootstrap Development, LLC

Authority:

GoDaddy.com, Inc.

Valid from:

9/18/2011 11:02:47 AM

Valid to:

9/1/2013 2:11:08 PM

Subject:

CN="Bootstrap Development, LLC", O="Bootstrap Development, LLC", L=Boulder, S=CO, C=US

Issuer:

SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

043458A3AA8966

File PE Metadata

Compilation timestamp:

6/19/1992 3:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

393216:aQJfFMS3DCWtf/jkc3v7P7xwKMmIHfEp+5sq+FlOg:aQJfFR31lN3v71wK5aL5sjSg

Entry address:

0x9B24

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, A2, 95, FF, FF, E8, A9, A7, FF, FF, E8, D4, C9, FF, FF, E8, 1B, CA, FF, FF, E8, 0E, F3, FF, FF, E8, 75, F4, FF, FF, 33, C0, 55, 68, DB, A1, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, A4, A1, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 9B, FE, FF, FF, E8, 02, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 04, D0, FF, FF, 8B, 55, F0, B8, E4, CD, 40, 00, E8, 53, 96, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, E4, CD, 40, 00, B2, 01, B8... 
[+]

Entropy:

7.9995

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file mediawidgettrialtype40setup.exe has been seen being distributed by the following 4 URLs.

http://gsf-cf.softonic.com/d5a/44b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=93074&instance=softonic_en&type=PROGRAM&Expires=1476160721&Signature=C0EfPolfN41LAi1uqDx096EPF1cRFFLUN70H34ljTmFAhs9RwW3xZmEjIZktRolZSulUUmamtk0w5eOMTjwNxodbSxkmoiO6RVv--s1ehNqS9Eq-j4oYuAjkOYkEfBlScS17-hIMtOolRni9ywKdVF-iGm~Np~84K4kR0rKy3Cw_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=mediawidgettrialtype40setup.exe

http://dl.bootstrapdevelopment.com/.../mediawidgettrialtype40setup.exe

http://gsf-cf.softonic.com/d5a/44b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=93074&instance=softonic_en&type=PROGRAM&Expires=1442504117&Signature=XkxxAS7yWo5DxjKeze1UW2wb5~cAt2e-1Ld78fuuCNVP-JzGkr46BXnmA~MTw45rO51KGoG0YRa3tqMv-Sj8YdSg7ryCJS0G91wox533FCkWUztKMOcfT1awgSW32~Cds33ZaoVuulBHHvSODaMhZpuHojijIFn7sbTvvSoZwuU_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=mediawidgettrialtype40setup.exe

http://gsf-cf.softonic.com/d5a/44b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=93074&instance=softonic_en&type=PROGRAM&Expires=1431865651&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=PiyvpvO1Ccgf19mj25855VjO55sp7tgLUV-i1ushBcitc3cwDsclvrg8oOPt~9EqETc96u173XsDNasMlOD1IxYHLRHFzJSfaUihgOHoS7Mh8bucMT-t70bbRkfDl46U410t6R568f6P4maj7~w276bw0D2Yl6zX0tSqyBNQoIo_&filename=mediawidgettrialtype40setup.exe

Remove mediawidgettrialtype40setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.