setup_odm.exe

ODM

INSTALLER TECHNOLOGY CO.

This installer routine uses the Babylon network to include bundled offers of potentially unwanted programs (mostly search adware) such as toolbars and browser extensions. The application setup_odm.exe, “Open Downloader Manager” by INSTALLER TECHNOLOGY CO has been detected as adware by 7 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from opendownloadmanager.com.
Remove setup_odm.exe - Powered by Reason Core Security
Publisher:
My Company  (signed by INSTALLER TECHNOLOGY CO.)

Product:
ODM

Description:
Open Downloader Manager

Version:
2.0.0.0

MD5:
98b31260f9e7d3f25e301407e125dd59

SHA-1:
d361e80ded7efb78f2292650c839247f4c45bdfa

SHA-256:
21a55f953eb614f172cc808927ce7cc8de91c0996381d798f3a5b92ba04155ad

Scanner detections:
7 / 68

Status:
Adware

Analysis date:
12/4/2016 11:31:33 PM UTC  (today)

Scan engine
Detection
Engine version

G Data
Win32.Application.ODM
14.6.22

McAfee
Artemis!98B31260F9E7
5600.7103

McAfee Web Gateway
Heuristic.BehavesLike.Win32.Suspicious-PKR.G
7.7103

Reason Heuristics
PUP.Installer.INSTALLERTECHNOLOGYCO.J
14.8.8.0

Rising Antivirus
NS:PUF.SilenceInstaller!1.9DDF
23.00.65.14608

Trend Micro House Call
TROJ_GEN.F47V1230
7.2.161

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h
3.12.24.3

Remove setup_odm.exe - Powered by Reason Core Security
File size:
287.1 KB (293,984 bytes)

Copyright:
Free Author © 2013

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\setup_odm.exe

Digital Signature
Authority:
VeriSign, Inc.

Valid from:
10/7/2013 8:00:00 PM

Valid to:
10/23/2014 7:59:59 PM

Subject:
CN=INSTALLER TECHNOLOGY CO., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=INSTALLER TECHNOLOGY CO., L=Miami Beach, S=Florida, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
4556C69814691A6077AE1628567ACB9F

File PE Metadata
Compilation timestamp:
12/5/2009 5:50:41 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6144:dQqNY14MD4frcgZv57sbKN2ja89jH+89e2HB3E:RW4pTcC2mNp8FH59e2HB3E

Entry address:
0x30CB

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 38, 3F, 42, 00, E8, F1, 2B, 00, 00, A3, 84, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 30, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 80, 36, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.8002

Packer / compiler:
Nullsoft install system v2.x

Code size:
22.5 KB (23,040 bytes)

The file setup_odm.exe has been seen being distributed by the following URL.

Remove setup_odm.exe - Powered by Reason Core Security