» wiibackupmanager_build78.exe
Overview
Analysis
File Details
Downloads (10)

wiibackupmanager_build78.exe

Wii Backup Manager

Software Association LLC

The application wiibackupmanager_build78.exe by Software Association has been detected as a potentially unwanted program by 17 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from wii-backup-manager.joydownload.com and multiple other hosts.

File name:

Publisher:

Software Association LLC (signed and verified)

Product:

Wii Backup Manager

Version:

1.0.0.0

MD5:

b9097cb3afbb3988bfd90bd69301d611

SHA-1:

d5d823d2718546ee9af31b92ce538ffb809480a6

SHA-256:

fad6a99fc24d4a3b27613b7e81fcd369f4999beee423fcb3a6a68ba1f7bd4358

Scanner detections:

17 / 68

Status:

Potentially unwanted

Explanation:

Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:

5/17/2024 3:39:30 PM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

Riskware.Agent

7.1.1

AVG

OpenCandy

2016.0.3002

Baidu Antivirus

Adware.Win32.OpenCandy

4.0.3.15829

Clam AntiVirus

Win.Trojan.Agent-855157

0.98/21511

Dr.Web

Adware.Downware.9759

9.0.1.0241

ESET NOD32

Win32/OpenCandy.C potentially unsafe (variant)

9.12163

G Data

Win32.Application.OpenCandy

15.8.25

K7 AntiVirus

Trojan

13.2017031

Malwarebytes

PUP.Optional.OpenCandy

v2015.08.29.06

McAfee

Artemis!B9097CB3AFBB

5600.6658

NANO AntiVirus

Riskware.Win32.Downware.dqybgj

0.30.24.3283

Panda Antivirus

PUP/OpenCandy

15.08.29.06

Qihoo 360 Security

HEUR/QVM42.0.Malware.Gen

1.0.0.1015

Reason Heuristics

PUP.OpenCandy.Installer (L)

15.8.29.18

Sophos

Generic PUA CJ (PUA)

4.98

Total Defense

Heur/TrojanHorse.ZCIF!suspicious

37.1.62.1

VIPRE Antivirus

Sevas-S Installer

43258

File size:

418 KB (428,016 bytes)

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Language:

English (United States)

Common path:

C:\users\{user}\downloads\wiibackupmanager_build78.exe

Digital Signature

Signed by:

Software Association LLC

Authority:

DigiCert Inc

Valid from:

1/13/2015 1:00:00 AM

Valid to:

1/21/2016 1:00:00 PM

Subject:

CN=Software Association LLC, O=Software Association LLC, L=Dnepropetrovsk, S=Dnipropetrovs'ka Oblast', C=UA

Issuer:

CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:

0E1FC80B1C57AD69AA6F8D65D1CF90CF

File PE Metadata

Compilation timestamp:

5/20/2013 1:53:00 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

12288:HiunFIGfJISps/WgsnpSgs2hJxXXvVsICMqNTCmRHh68FO:ZnXJI7sp9XX+IqNTCmRH88c

Entry address:

0x331C

Entry point:

81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, 98, 92, 42, 00, E8, A8, 2E, 00, 00, A3, E4, 91, 42, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, 90, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, E0, 81, 42, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, 01, 2B, 00, 00... 
[+]

Entropy:

7.8296

Packer / compiler:

Nullsoft install system v2.x

Code size:

24 KB (24,576 bytes)

The file wiibackupmanager_build78.exe has been seen being distributed by the following 10 URLs.

http://wii-backup-manager.joydownload.com/get_azure_file/wUiS4WnYccXBwj sXP7oQkEsnl0kPTqmEBv0cteQv c8/zOn/j1gwJgEL0/tevylZiHtkw8dcj7dRbjwTfdYkfw5mJKaDxLEt3rqBwX9u3Gty6yFvNKbm2VBs5Q4i1FHXGSsSTR3ntF2vTnxGWmeSq4bkZm1aHBEerJxJR4FIfq/FiM9LdzFfxEjiKPsFSAlfoXw2q4/D2mwoA6W378wVdv4Mp68ZDJW3sm3D659xgBHvNumyBjlM/.../7M3Ez24ybPVJRo4vO3smounkFxhrnFL0xdYHGS3rFAzhqNnuxAU3fSuQqmFN19jYc3irT1OE0a5tYkH61yvFBwsnYjc=

http://wii-backup-manager.joydownload.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjykEB/6Zt7Qveh152T qHomkphOcRauLfmgLXj/ylVQOHHLQrC6SuRkmPwg2ZvMWV3Gqm3qBwX9u3GtyKyFvNKBm2JA4p8ziUcEDSK1AX1/ksk7/Cn7UmCfUrcfwsHrJWFYNO1nbQoEcKX0XGh9fMvcLVgoj6v2Un9xao6x2 s/.../zDU75oZD2g0s3NTHOuWAG3MvYc3irT1OE0a5tYkH61yvFBwsnYjc=

http://jdcdnnet.blob.core.windows.net/fas/wi/1/31/1/.../wiibackupmanager_build78.exe

http://wii-backup-manager.joydownload.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv E8/yG6sGMxwdoEP0b1Y/j2PHmugA0MIGjPEe tCrQ/y71lzNSWRAaS9T27VRLlsyK1iv6SpN/SgzUU/cFlwUdJF3ykACx3kMY79WjwWWmLGeUI2syiPTUNerozPRNMOav9RCwmJJvcLVgojqnuAGF8IdejgrZwTjTr7AuYyb0DVtfkLJapZ28Jl5SvFqounBcHq9Gpn1O7ZKx/hS6kAsde6NWwAHPvuYPF0mx5JeNRTt03OHsnteOkGx9pjx3z3dxEGT61X06z/.../dF hi3CAUUgnYjc=

http://wii-backup-manager.joydownload.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsnl0kPjCvHB36cteQv A8/yOn9np5iNEIJ1Xlarr0PHWuyxdSMWmeQrDzCr50ybtq1sWcFQfS9S3yHhm0qnD8gfLbvJ6BzzcU5tYiiBZIV3y1SWchhshw9CrxGWmbSq4YjNXqdD0GYqszPRNMOa73XGgrIY2OekpryeO4AC1mcoT62/9yVzCn4Aucx7osGc/.../ZIiT3GRWIyuh0Kgjz3zPVAA8nYjc=

http://wii-backup-manager.joydownload.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjykHhj7YdvStuh152b0sCgrn8kFbk3hYqn9N3u4xVxKOSCGGumtCuFugPk8lY/YRVCD9GzyDU79qjzm0uiD/4qD1CNW/MRu0gIXFmSsSTRxntF/p3evSGjaSr5UwtWmbm5VOeppalhSYvGmAS89F5yLf0d2i6n6R25wao6x2 4/HC/j5kjE3/VqDoC/.../5LflDxEihBW6xd9AFj7qRQfxqYi7hB0ufXjDsnhThIeHbzXrV0qegvl1e0GpgTPcXQA0Yjc=

http://wii-backup-manager.joydownload.com/get_azure_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxLzaNbB8rpv8Dev8TM3i8ZTfBm2P 6 LXj/ylZSICfICeLkErQ90bhyz4WXBAaDpnasHk20snm1mfbQvNKbm2VBs8Nv3wEXFmSsSTR2ntEr i7oUSCTQ7ZOiJ61JTxEYr84PRkHO6vyXmh0O8TKLAl01f2xAC1mcof62/.../4O h17yfP8913XkVt1Wt826R33tsJWTkywmbPVJRo4vfyZ3ounkFxxrnBSy1tVHFT7qRQfxqYi7hB0ufXjDsnhThIeHbzXrV0qegvl1e0GpgTPcXQA0Yjc=

http://wii-backup-manager.joydownload.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1Ghz3cteQv E8/yG6sGMxwdoEP0b1Y/j2PHmugA0MIGjPEe tCrQ/y71lzNSWRAaV9T2uVRqiqnD8gffZpMufyDoZ8MZrxhUfBSj2XWs3 5Fsp3euXWuHFfQJ2syiPTQNeuBrewoEcKX1XGh8edzFZREjjKv2Rn9mONmjmKh3Unux8VDOlPV Q8vkbZD/PCoZn9zgTLd1yEhX/4O h1ryfPU2hSflCchX/.../B5YxDy1yDfBwwnYjc=

http://wii-backup-manager.joydownload.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv A8/yan9np5ktEPJgTta7HuZiro0l8bOGGGCeqmCr50ybhgztTJXk/Ro36xSQSrqnD8gfTZpMufyDpW88Rj2BACSSv2VG8iwYE79WjwWGmLBPhOw4TrNj0Vaas5bBIMOb23Dy5tc43EIBEwjansFiMtao6x2 4/HC/j5kjE3/VqDoC/.../EAOy2r8mNVb33T CTF8nYjc=

http://wii-backup-manager.joydownload.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv A8/yWn9np5iNEIJ1XmYLP4OnuuyxdSNGmeTbb7TOB10bIjzsWXFQ6V j3zT0z0smn80qHDpYDSkGgIq5Y6kRMbAGSsSTRzntEr/CryWWWLS/9WzM3zYW5bPas5bBINO6XlESMmKp dfV5i0fC6Q3FwOuqglLRpWm6yrA Hye1nR5i7etD7JzEFnZSvFrAunhkW6I//j1DxaaE2nS6sEYsZ/Mz4SXjjoZCCkW8qZLxRHN1pK3RguuCtDxlgnB3z3dxEGT61X06z/.../dF hi3CAUUgnYjc=

Remove wiibackupmanager_build78.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.