wifipasswordrevealerinstaller.exe

WiFi Password Revealer

KeyFinder LTD

The application wifipasswordrevealerinstaller.exe, “WiFi Password Revealer Setup ” by KeyFinder has been detected as a potentially unwanted program by 2 anti-malware scanners. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
Publisher:
Magical Jelly Bean   (signed by KeyFinder LTD)

Product:
WiFi Password Revealer

Description:
WiFi Password Revealer Setup

Version:
1.0.0.3

MD5:
c30ae656a0168588b53fce4fc15f23c7

SHA-1:
7d2b0643946285148782bee82b516b190aaed420

SHA-256:
fd7fffd5c50b5a4e20bdee0e163f2aed2d7b85154ca5ada03c84d44ed38b3404

Scanner detections:
2 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
4/20/2024 1:58:14 AM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
8.9579

Reason Heuristics
PUP.OpenCandy.Installer (L)
16.11.29.14

File size:
2.2 MB (2,306,312 bytes)

Product version:
1.0.0.3

Copyright:
Copyright © 2013 KeyFinder LTD.

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\wifipasswordrevealerinstaller.exe

Digital Signature
Signed by:

Authority:
Starfield Technologies, Inc.

Valid from:
2/25/2013 7:33:53 PM

Valid to:
4/26/2016 5:14:03 PM

Subject:
CN=KeyFinder LTD, O=KeyFinder LTD, L=Eastbourne, S="EAST SUSSEX ", C=GB

Issuer:
SERIALNUMBER=10688435, CN=Starfield Secure Certification Authority, OU=http://certificates.starfieldtech.com/repository, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
4B12EAD0A0A9F5

File PE Metadata
Compilation timestamp:
10/9/2012 10:48:22 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:zLzbedyhlr8ceE4PZmH/rXVBfjD6CQ7uMLwX1MtN:XzbeUhlrnN8EfPj2a5FMT

Entry address:
0xF3BC

Entry point:
55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, 64, ED, 40, 00, E8, E8, 71, FF, FF, 33, C0, 55, 68, 89, FA, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 45, FA, 40, 00, 64, FF, 32, 64, 89, 22, A1, 48, 3B, 41, 00, E8, BE, F7, FF, FF, E8, 65, F3, FF, FF, 8D, 55, EC, 33, C0, E8, F7, C3, FF, FF, 8B, 55, EC, B8, 4C, 66, 41, 00, E8, 6A, 58, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 4C, 66, 41, 00, B2, 01...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
59 KB (60,416 bytes)

The file wifipasswordrevealerinstaller.exe has been seen being distributed by the following 50 URLs.

http://gsf-cf.softonic.com/7d2/b06/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69665659&instance=softonic_br&type=PROGRAM&Expires=1458313786&Signature=c0F2SS-jtKAquACyBsgnxzFcCc5GtuM3f8-~vMKRuoObNoVmJl2N57SN4kchYl9sqDnb~eryJlU6j-tlkNgQY9yxS2enSg0ujJGLLOAlW1ER4WCFKqAorlRU-zuFncA~UbklpS0fAz~dUkEnSSUX5RrX-a5RLGvUUv6eXyaGWls_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=WiFiPasswordRevealerInstaller.exe

http://gsf-cf.softonic.com/7d2/b06/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69665659&instance=softonic_es&type=PROGRAM&Expires=1428005589&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=caxgCjXjUV0QhbjojGRrAjb6IYD2G0XZtXlfRgVEnTNfiLb2T0A2SeC5rCxjggnbqZ7JrhJRmRdjoxTXQn8q17SfjgaBfq8WJvOEeVNTMcVrgtYjKXCdth6FQP-EycxS1SM1AVGyYrhFFa~fpslnxBicbaM--895gH47o9inF5k_&filename=WiFiPasswordRevealerInstaller.exe

http://gsf-cf.softonic.com/7d2/b06/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69665659&instance=softonic_es&type=PROGRAM&Expires=1478198046&Signature=Qvi8m3jNURGBXVjYUWUqFMb264QfcGasdYbPGdLCo9KvJzDlVQ8Pi5LN3ixybIC4F8eKEbDeMtgRaC5gBvCdKmEXMYJ3L7mB~7hNphE6UA3N31JrQR505r1YxFjVIP9~b1mUgLtyJEoalRRQpTbV14dIWqMj4Cnusr2G895jxaA_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=WiFiPasswordRevealerInstaller.exe

http://gsf-cf.softonic.com/7d2/b06/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69665659&instance=softonic_en&type=PROGRAM&Expires=1447274125&Signature=Jpaj3CZvEfGYdyFcu9BW0eg-DhFZOHsKISVKCv1qY051x~btx0BuJWMG7zEFiJbedCWxb~xxjvsV47D8ub3RIF39QSRYUGxVObMFNLOuSSSlBaGlievPiBhsdjOARtDrzQ1zUD5Mc07ctQcptC~RW3x85ctOrFNayVIjunweFNY_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=WiFiPasswordRevealerInstaller.exe

http://gsf-cf.softonic.com/7d2/b06/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69665659&instance=softonic_es&type=PROGRAM&Expires=1453986660&Signature=QEtGmPDKUTVu2yZOKxKqYtoKK6-Ur29piKkHnFu7BsC~ZbwUFa~rnXoFORF58vA7SLo9o7HzEuetqiDFkC0fZ3IclPdm9fSWK1yItPQfdDsIgqJWNKmZJKxNBMA7NkN0Wn3Y9IRtkecfXLuKYAsMtueTeCqouTPOQQWZnmpS2K0_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=WiFiPasswordRevealerInstaller.exe

http://gsf-cf.softonic.com/7d2/b06/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69665659&instance=softonic_fr&type=PROGRAM&Expires=1466435265&Signature=eOKGy3WtLJnmmYcrdGJJdwYRjvXCCvnCsXALEgzXfuMuZBWiTE65rTIm9JYRGuqfsH8RTBnY7qdhkCo~eBaLgkMUroGZYSoae06rfWT~Rf5HmzI4SuT5Lp7UUTeOfduxN3Xfq4LHW1qaqlhpJ-SnSPiCn6Uu6N5l3qNmgxcAcSo_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=WiFiPasswordRevealerInstaller.exe

https://dw.uptodown.com/dwn/vgnk7Z4u1ce-QnADnmchI21eIRq-gzreWiz-MBWMmgP4ICOQegBl0XZdnopAINQeQTjcETaY7yLqS6Ta850PJTQMDTvG9jaFrJc6irAw5HGVCt36Zn822-RfOvuVv6hf/4O_rWDKLEVfB9ZJStesNpEYNiRL1fGEHuGoieWjWPB4uz7jaTK6NMSy9A2nWI9GPfNqsU_wOpiNXNaPA4b3jGbF7-TuLlT6z_LbsadWXvX9MeoI1sYv7_IMmLRpSwvdo/aXxDFQ-VzeWpuhd9lI77qBt5J--htg2NzoYjQP7iw0PCsGLTMWqafmkjCubh3DjHNhY_fWXJca9dKHhuENM8wd7Lop1P03iO1WEizuERRLBLs3YlzRPtjlO_z38W4GV7/.../

http://gsf-cf.softonic.com/7d2/b06/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69665659&instance=softonic_en&type=PROGRAM&Expires=1451961376&Signature=MLg6V8cslxyi0HzWc~ib-2PTg7oGyST2Ux5ATuJp3ZsPKfPeIWXQJQOosxDgRO50WNq52R~b~kwdgiWQZsE0BTDMtHTxiG258FSNAgaaSrv-vb1QBZFCY09YEyXZE14zxVA66ryQIkjAplLKt9h8ZLOf-6nLKnVCJwY4~zscxck_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=WiFiPasswordRevealerInstaller.exe

http://gsf-cf.softonic.com/7d2/b06/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69665659&instance=softonic_it&type=PROGRAM&Expires=1422859041&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=VLm0SSEjL4OX4dRDROjr0nTBaFVQcSWRnf8fL5THe8SHTQWs989DySIPnF-vfmSueL~3XLQ0iGbtCOscFhWDBym~gRM8FOYHb3jwBTwV8XB3LFf-uo-DN~vl8~M9ulY0Jo87sh6ccYWMl~fASllq~R5fwAFV2b0UuzjhxNQBi8E_&filename=WiFiPasswordRevealerInstaller.exe

http://gsf-cf.softonic.com/7d2/b06/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69665659&instance=softonic_fr&type=PROGRAM&Expires=1466117219&Signature=KS-ss0AJTfyHlwed-B9ldIwyGV30j4j4yLNxtLgEhBpvHVDVLy0MXLuj2d4hDWfGcqiTCSRRjubgmcDKlFS27BSd0wj98jsykSmnd-hFTD-GUtNPtjJgB4UMz7b81o8OtsiDdgcLPz4aXWiOGmfYqx4bc3SS0Q7TVHDAeZQukXs_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=WiFiPasswordRevealerInstaller.exe

http://gsf-cf.softonic.com/7d2/b06/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69665659&instance=softonic_es&type=PROGRAM&Expires=1476438861&Signature=NHkWJsRNgMEaq5r6z52mUuPS3ULi9C-E572LrbxrrQCwgcoOGifeVqW517Rv7KFTZMjczxRRAYv41HqHr3fDQAbd4m9BM2LFzFESrhth-BfqAH99dL9jg6i4fBF~dcnG0dibmQVRpuzmsh8~GMf1x~C~v-FGJ67moA4nf25rl-Q_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=WiFiPasswordRevealerInstaller.exe

http://gsf-cf.softonic.com/7d2/b06/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69665659&instance=softonic_es&type=PROGRAM&Expires=1446696439&Signature=WxBenhYdIB9A32WLNtO--CON1UEga3q7wWqQLer7jovPd68m~SR6iFcrUusKzaSEJaCwg5O9oNX~LOmocfSgNMla2dRt3ptHPvGMBj7sEYTtFKVMd8YaYV4ap~QVlHgKB65MgzVPRwFXtxY9OD5HgOk~t1XfyEmq7cDblJc6vwg_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=WiFiPasswordRevealerInstaller.exe

http://gsf-cf.softonic.com/7d2/b06/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69665659&instance=softonic_es&type=PROGRAM&Expires=1448188320&Signature=NHnGSxlpr7pcxpE2RkSYcCi6Echk5m1YWDlSjuY4ubv9zHKzM-429RdDI5KP-ZubmFS7zqk6MV-rNyujS2qZA9wWBGvdjagJfKu-rPd5b6oXei0W5wopRu~t5rbQmMlaLXzOWow7vFKrue9UjuAikiqm4Ctz8TbHhW~xekB-FdM_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=WiFiPasswordRevealerInstaller.exe

http://gsf-cf.softonic.com/7d2/b06/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69665659&instance=softonic_en&type=PROGRAM&Expires=1470923169&Signature=BMTIKo4dJaeKEn-Uk3ISsmEPsjPX7ebWRUCM5xALVKs10Lq1mtaFIvIWDRrEyYcNwYUU64FmdV1sBLXnkwoAhGjS0uK-jW4rwQ5~kaUnmkNVQtG0OoSBVn8fkdDOMhhPWScf8oCAUqAawMxM4LXHrGggQAJ7gUTL3bYnG2S6ch4_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=WiFiPasswordRevealerInstaller.exe

http://gsf-cf.softonic.com/7d2/b06/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69665659&instance=softonic_en&type=PROGRAM&Expires=1474358569&Signature=R~97To9T60OoufiW-ZmSNYUgqXoTw0gZy~mFQlUfyHm9N9oiG1i0MhcAnn9NLrZFeZdr2xepnWP4WQE6iMJHRcmXxe2zD87YU6aG0Svzp8oTIUMhgMjb1zEhQnMhxvLCE2xHuW9v8SDojVnHEP912TmJXTayx5PCc736tOdd5RE_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=WiFiPasswordRevealerInstaller.exe

http://gsf-cf.softonic.com/7d2/b06/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69665659&instance=softonic_en&type=PROGRAM&Expires=1474247842&Signature=YMFLc4nVZk6aY~glrtFhzfWuU5pnFGx42LjxkmnsLFj4RCSCDV5c-i4Vls3SqQ1ODbhZpoMj0oV0EEqIhIdVR5S2ptd7aQ17NBq7pQ41t6rHFoS4-mgMMxqoXuOhH4nrOQQV47PWHEbvTTFq~f6G2o9agdLK8rRNOw9paO3C0RA_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=WiFiPasswordRevealerInstaller.exe

http://gsf-cf.softonic.com/7d2/b06/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69665659&instance=softonic_es&type=PROGRAM&Expires=1475318421&Signature=Eo~1SQvdIKVkijTs1oqCakvUKoZ3FgOTJBcG4qH~H7v6Spdi8vi06QQQJXjKrbyVmAVGLw8d3ESm810Dk~EPfObA4dOj5cVk8GcpiHgEtCjJ-7ruODXij331S2EeyTSQ8uNvrShhOcHW2IjCFugKpbKsOJf05-CPVuYMnUYwdhk_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=WiFiPasswordRevealerInstaller.exe

http://gsf-cf.softonic.com/7d2/b06/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69665659&instance=softonic_en&type=PROGRAM&Expires=1459998758&Signature=KEtsxo-nftNBJTiNepHlk29yHqE30qLAKg9GeINsXyYt4PdDBX6qBjv8YFyRUs-iZ4ar2iXxiGO3wVK-7a9U7N06rYCVlIkJFr9qYTq707FMtMY5~w~FQRS~NYSzsvfF~wF7sLnqbl8dH2fJmGpV0OQWmcsJEoCzh5Eos8UWXAs_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=WiFiPasswordRevealerInstaller.exe

Latest 30 of 50 download URLs

Remove wifipasswordrevealerinstaller.exe - Powered by Reason Core Security