» OpenCandy Inc.
Digital Signature
Analysis
Files (23)
Related (7)

OpenCandy Inc.

Publisher Information

OpenCandy Inc. is a software publisher located in San Diego, California in the United States*. The publisher primarily developes software that can be classified as adware. OpenCandy from SweetLabs is an ad-supported platform that allows publishers to include monetized offers in their software installers. Its advertising software module can be incorporated in a Windows/Nullsoft Installer and when a user installs a program that has the OpenCandy library, there is an option to install additional software that it recommends (based on geolocation). These offers are typically web browser toolbars and search extensions. Thre are 12 additional code signing certificates issued to this publisher.

Authority:

VeriSign, Inc.

Valid from:

6/28/2014 3:00:00 AM

Valid to:

6/29/2015 2:59:59 AM

Subject:

CN=OpenCandy Inc., O=OpenCandy Inc., L=San Diego, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

79d7802797db6e08c313832b63bda95f

Scanner detections:

Detections (100% detected)

Scan engine

Details

Detections

Reason Heuristics

PUP.OpenCandy.H, PUP.Installer.OpenCandy.K, PUP.OpenCandy (M)

100.00%

ESET NOD32

Win32/OpenCandy (variant)

26.09%

Malwarebytes

PUP.Optional.OpenCandy.A

21.74%

Baidu Antivirus

Adware.Win32.OpenCandy

21.74%

VIPRE Antivirus

Opencandy

17.39%

G Data

Win32.Application.OpenCandy

17.39%

Trend Micro House Call

Suspicious_GEN.F47V0809, Suspicious_GEN.F47V0820

13.04%

Dr.Web

Adware.OpenCandy.15

13.04%

Fortinet FortiGate

Riskware/OpenCandy

13.04%

McAfee

W32/Sality.gen.z, Artemis!0B813693290F

8.70%

1 / 68 (PUP)

dlm309b.exe (Installation helper by OpenCandy) (16dd495330af810c5bf314ed33d87cc9)

1 / 68 (PUP)

dlm309b.exe (Installation helper by OpenCandy) (a1f0241e7a4be8decb7ea18dd47b7712)

1 / 68 (PUP)

dlm309b.exe (1c639422f6d333c8dd7af19b80fc94df)

1 / 68 (PUP)

dlm309b.exe (Installation helper by OpenCandy) (d4e0b29684a2f48d0ae8f51655faf6c5)

1 / 68 (PUP)

dlm309b.exe (Installation helper by OpenCandy) (58cb8b88177ad936f61ceca635e5ecae)

1 / 68 (PUP)

dlm309b.exe (99c3af5df5b111600d42c55542f7a615)

1 / 68 (PUP)

dlm309b.exe (11868a19e2e375a7d41fd0a59a143945)

1 / 68 (PUP)

dlm309b.exe (095864ee22c0fbe98c56befa949e172a)

1 / 68 (PUP)

dlm309b.exe (Installation helper by OpenCandy) (ace1a271e77cc79249f2eb8c32db1ae1)

1 / 68 (PUP)

dlm309b.exe (Installation helper by OpenCandy) (769a9468f7fbbde7882c819eba8e71ee)

1 / 68 (PUP)

dlm309b.exe (Installation helper by OpenCandy) (da91571aa88bdec4fca47487f7449d25)

1 / 68 (PUP)

dlm309b.exe (Installation helper by OpenCandy) (c5527cd1efd05512c3669e4cd0521b3c)

1 / 68 (PUP)

dlm309b.exe (Installation helper by OpenCandy) (5ebf17e6ee2785f824c396b13c0d08eb)

1 / 68 (PUP)

dlm309b.exe (Installation helper by OpenCandy) (da45c57c04429681db1cba8dd10934b0)

1 / 68 (PUP)

dlm299b.exe (OpenCandy recommendation downloader by OpenCandy) (fb7f76cf356a0ae114acd7d9e9642016)

1 / 68 (PUP)

ocsetuphlp.dll (Rec Helper by OpenCandy) (685673a96abb5ee031817b20e52d205c)

1 / 68 (PUP)

dlm298b.exe (OpenCandy recommendation downloader by OpenCandy) (2def323e827733359169debfd087720f)

1 / 68 (PUP)

dlm299b.exe (OpenCandy recommendation downloader by OpenCandy) (0df18e2e6dc7cc123a393e782ff7a666)

3 / 68 (PUP)

ocsetuphlp.dll (Rec Helper by OpenCandy) (79994a15d9cdb3e6da15238f2a10fe08)

5 / 68 (PUP)

dlm309b.exe (Installation helper by OpenCandy) (627168cff57d3e8e13ad1a97839582dd)

5 / 68 (PUP)

OCSetupHlp.dll (OpenCandy recommendation engine by OpenCandy) (4073f12f8d2063dce0cb7f45178428b8)

9 / 68 (PUP)

dlm299b.exe (OpenCandy recommendation downloader by OpenCandy) (0b813693290f9245f6347928fc02ff01)

47 / 68 (PUP)

dlm298b.exe (OpenCandy recommendation downloader by OpenCandy) (1f1a3379c2d537de505a1d7aff23314c)

The certificates below are also signed by OpenCandy Inc..

064F7F3543BCDEFC1576F502AE200E11 (Feb 03, 2014 to Apr 22, 2016)

3D96F95B7280804943B22EAAD87771E6 (Oct 24, 2014 to Oct 25, 2015)

0B88C871F68A9102FD1B743704369247 (Oct 24, 2014 to Oct 25, 2015)

5407D8E1F2D0E6C4E6F068C2480628C9 (Oct 13, 2014 to Oct 14, 2015)

29CE9F5BE708FCC90C4937893D131841 (Oct 13, 2014 to Oct 14, 2015)

0098EBBE629C4556BF484A6F8F34FED191 (Oct 13, 2014 to Oct 14, 2015)

00C78CECD817AA361719203EFEE430C0AF (Oct 13, 2014 to Oct 13, 2015)

00BB7B40B95093A55585D1C267C0D46EE3 (Oct 12, 2014 to Oct 13, 2015)

00B0CC36BCEFA9A2F21227E1707CED355E (Aug 13, 2014 to Aug 14, 2015)

00C3779EB50F49E5634257CB77974A96D9 (Aug 13, 2014 to Aug 14, 2015)

10 of 12 code signing certificates issued

The following publishers (by Authenticode signature organization name) are related.

* Note, the details and description above are based on the code signing digital signature issued to OpenCandy Inc. by VeriSign, Inc. on June 28, 2014 with the serial number '79d7802797db6e08c313832b63bda95f'.

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.