» open officesetup.exe
Overview
Analysis
File Details
Downloads (1)

open officesetup.exe

SuperCool Applications

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application open officesetup.exe by SuperCool Applications has been detected as adware by 12 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.downloadablecdn.com.

File name:

Publisher:

SuperCool Applications (signed and verified)

MD5:

79dd674aa9f8d55a6873559c3b8c06eb

SHA-1:

e4ecde42030a8d2a6ff3ac9d858972d5749ff786

SHA-256:

adcd81fb94bfee4813af0d390a341df1ae25b6566866c922a6af074e6aba7570

Scanner detections:

12 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

4/25/2024 10:31:16 PM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

PUA.InstallCore

7.1.1

Avira AntiVirus

Adware/InstallCore.A.389

7.11.181.56

AVG

Max Setup

2015.0.3310

ESET NOD32

Win32/InstallCore.JO potentially unwanted application

7.0.302.0

F-Prot

W32/A-dbe1ec51

v6.4.7.1.166

K7 AntiVirus

Unwanted-Program

13.185.13805

McAfee

CryptInno

5600.6966

NANO AntiVirus

Riskware.Text.Drop.deoyhe

0.28.2.62841

Reason Heuristics

PUP.Installer.SuperCoolApplications.Q

14.10.25.19

Sophos

Install Core Click run software

4.98

VIPRE Antivirus

Threat.4788237

34232

Zillya! Antivirus

Adware.InstallCore.Win32.44

2.0.0.1967

File size:

680.3 KB (696,600 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\downloads\open officesetup.exe

Digital Signature

Signed by:

SuperCool Applications

Authority:

COMODO CA Limited

Valid from:

8/15/2013 3:00:00 AM

Valid to:

8/16/2014 2:59:59 AM

Subject:

CN=SuperCool Applications, O=SuperCool Applications, STREET=63 Ronthscheld Blvd., L=Tel Aviv, S=Israel, PostalCode=65785, C=IL

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

7239B70290995A99967AE1DE581942C0

File PE Metadata

Compilation timestamp:

6/20/1992 1:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

12288:KwFapU8ZdbvMoEC6o/Z81LIfQbsG3OP0Vxcq7SueR+m4GThtt9INbGp8UK5dlZ2w:KwFgdLH6oieCsaOPWxc4QBTvtWNbGgN

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file open officesetup.exe has been seen being distributed by the following URL.

http://www.downloadablecdn.com/?dl=1&meta= 3sl QsJDmDp7dLJ rcJ dAJhdREhXxyUzWPDrFthXtjcmVP2rldDX0mIT1zvm2yIKiWvmREhXxyvmNjhVxSvmNBDz10cQDjhTnmDZ0wvmNpDZ1fOTnzAjayNzMyvmt3hXtGDXl3 3vCfSDt2Z1Y K507dP0eXslfSDt j1YcrRP7dVtDKF0fSDj2Z1Y2r5yDdV0fSDu2Z1YIKDZ dF0DKF0OCxWedlmLdVPcmNoOlxWvmV4cHaWed5jDKlCfSDPcZ1Y7Kxw 3Np2rlJ E0mDH7Wedxl2mljDX0mvm5EIKiWXzCzAZc0OTAwNZAR&chnl=gr1_0614

Remove open officesetup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.