» mp3rocket.exe
Overview
Analysis
File Details
Downloads (18)
Network (1)

mp3rocket.exe

MP3Rocket

OpenCandy Inc.

The application mp3rocket.exe, “MP3Rocket Setup Program” by OpenCandy has been detected as a potentially unwanted program by 2 anti-malware scanners. The program is a setup application that uses the OpenCandy Installer installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from cdn.clickgratis.com and multiple other hosts. While running, it connects to the Internet address unallocated.barefruit.co.uk on port 80 using the HTTP protocol.

File name:

mp3rocket.exe

Publisher:

MP3 Rocket Inc (signed by OpenCandy Inc.)

Product:

MP3Rocket

Description:

MP3Rocket Setup Program

Version:

6.4.7.0

MD5:

973948e0d82c0c6ece8c3a352dfa447f

SHA-1:

c6e8197d5af58182edb6900e5f83b9d505d2e947

SHA-256:

b0e624733dbddc95ad001d5931bd8d71c2df282dd470a3d3ba2f31494e9853e9

Scanner detections:

2 / 68

Status:

Potentially unwanted

Explanation:

Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Description:

This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:

4/26/2024 9:07:31 AM UTC (today)

Scan engine

Detection

Engine version

ESET NOD32

Win32/OpenCandy (variant)

8.9968

Reason Heuristics

PUP.Installer.OpenCandy.J

14.8.7.20

File size:

549.8 KB (562,984 bytes)

Product version:

6.4.7.0

Original file name:

MP3RocketSetup.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

OpenCandy Installer

Language:

English (United States)

Common path:

C:\users\{user}\downloads\mp3rocket.exe

Digital Signature

Signed by:

OpenCandy Inc.

Authority:

VeriSign, Inc.

Valid from:

2/3/2014 6:00:00 PM

Valid to:

4/22/2016 6:59:59 PM

Subject:

CN=OpenCandy Inc., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=OpenCandy Inc., L=San Diego, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

064F7F3543BCDEFC1576F502AE200E11

File PE Metadata

Compilation timestamp:

5/29/2014 1:37:43 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

12288:1cmbimWupT9iosbZpXohVWPnjz1fPDh6vF6S+XtxBgbSMh:15bsaT9idZpeVk/1Dh6vQtfg2Mh

Entry address:

0xEC250

Entry point:

60, BE, 00, 70, 48, 00, 8D, BE, 00, A0, F7, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B... 
[+]

Entropy:

7.5948

Packer / compiler:

UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:

408 KB (417,792 bytes)

The file mp3rocket.exe has been seen being distributed by the following 18 URLs.

http://cdn.clickgratis.com/_upload/downloads/2014/04/.../mp3rocket.exe

http://www.mp3rocket.me/.../MP3Rocket_Setup.exe

http://www.mimp3musica.com/.../mp3rocket.exe

http://dl3.vessoft.com/files2/m/mp3rocket_windows/7.3.2/.../mp3rocket.exe

http://www.techtudo.com.br/_/software/.../download

http://d5.mp3rocket.com/.../mp3rocket.exe

http://www.clickgratis.com.br/download/redir/MTY2NA==/.../?installer=1

http://www.imusicsearch.com/.../mp3rocket.exe

http://www.rocketbackups.com/.../mp3rocket.exe

http://www.limesearchbar.com/.../mp3rocket.exe

http://www.safefiles.net/.../mp3rocket.exe

http://www.safefiles.com/.../mp3rocket.exe

http://www.onedownloader.com/.../mp3rocket.exe

http://www.allmusicdownloads.com/.../mp3rocket.exe

http://www.mp3rocket.me/.../mp3rocket.exe

http://www.musicrocket.com/.../mp3rocket.exe

http://www.psprocket.com/.../mp3rocket.exe

http://www.my-free-kazaa.com/.../mp3rocket.exe

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):

Connects to unallocated.barefruit.co.uk (92.242.142.8:80)

Remove mp3rocket.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.