» youtube_videomusic_downloader.exe
Overview
Analysis
File Details
Downloads (1)

youtube_videomusic_downloader.exe

Youtube Video/Music Downloader

SuZhou MorningSun Information Technology LLC

The application youtube_videomusic_downloader.exe, “Youtube Video/Music Downloader Setup ” by SuZhou MorningSun Information Technology has been detected as a potentially unwanted program by 18 anti-malware scanners. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars.

File name:

Publisher:

YoutubeMusicDownloader.us LLC. (signed by SuZhou MorningSun Information Technology LLC)

Product:

Youtube Video/Music Downloader

Description:

Youtube Video/Music Downloader Setup

Version:

7.2.0.1

MD5:

a7d80aa9bd1f7258fb582feb88349dc6

SHA-1:

4bebe7bdbda4e34efb6b8e5a4ca64fb2b4575f38

SHA-256:

f3c3782ccc26920318b82693683c795d5bdfdccff5b909a0e820d13d4922340f

Scanner detections:

18 / 68

Status:

Potentially unwanted

Explanation:

Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:

4/26/2024 4:15:49 AM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

PUA/OpenCandy.Gen

8.3.2.4

AVG

OpenCandy

2017.0.2850

Baidu Antivirus

Adware.Win32.OpenCandy

4.0.3.16128

Dr.Web

Adware.OpenCandy.115

9.0.1.028

ESET NOD32

Win32/OpenCandy.A potentially unsafe application

10.7.0.302.0

Fortinet FortiGate

Riskware/OpenCandy

1/28/2016

F-Prot

W32/OpenCandy.A.gen

v6.4.7.1.166

G Data

Win32.Application.OpenCandy

16.1.25

IKARUS anti.virus

AdWare.Win32.OpenCandy

t3scan.1.9.5.0

K7 AntiVirus

Unwanted-Program

13.212.18051

McAfee

Artemis!6372102A01E8

5600.6506

NANO AntiVirus

Riskware.Win32.OpenCandy.dyofpx

1.0.10.5081

Reason Heuristics

PUP.Bundler.SuZhouMorningSunInformationTechnology.Installer.Meta (M)

16.1.28.23

Rising Antivirus

PE:Trojan.Win32.SpeedingUpMyPC.a!1075357520

23.00.65.16126

Sophos

PUA 'OpenCandy'

5.22

SUPERAntiSpyware

PUP.OpenCandy/Variant

9357

Trend Micro House Call

Suspicious_GEN.F47V0522

7.2.28

Trend Micro

ADW_INSTALLCORE

10.465.28

File size:

754.2 KB (772,296 bytes)

Product version:

7.2

File type:

Executable application (Win32 EXE)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\youtube_videomusic_downloader.exe

Digital Signature

Signed by:

SuZhou MorningSun Information Technology LLC

Authority:

COMODO CA Limited

Valid from:

12/17/2014 3:00:00 AM

Valid to:

12/18/2019 2:59:59 AM

Subject:

CN=SuZhou MorningSun Information Technology LLC, O=SuZhou MorningSun Information Technology LLC, STREET=16-A305 International Science and Technology Park 5, STREET=328 Xing Hu Road (Suzhou Industrial Park), L=Suzhou, S=Jiangsu, PostalCode=215000, C=CN

Issuer:

CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

4AA69CD8367C1BA3A552A6B6B5767830

File PE Metadata

Compilation timestamp:

7/9/2014 10:58:13 AM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

12288:iSxG05888888888888W888888888885CL8+iDNdRaRAfH7HEol6pQP50GG7/uuz9:JxGai8Dd/fx0G6BzzwNMWPPi

Entry address:

0x113BC

Entry point:

55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, 2C, 00, 41, 00, E8, E8, 51, FF, FF, 33, C0, 55, 68, 9E, 1A, 41, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 5A, 1A, 41, 00, 64, FF, 32, 64, 89, 22, A1, 48, 5B, 41, 00, E8, 16, D8, FF, FF, E8, 65, D3, FF, FF, 80, 3D, DC, 2A, 41, 00, 00, 74, 0C, E8, 2B, D9, FF, FF, 33, C0, E8, 80, 32, FF, FF, 8D, 55, EC, 33, C0, E8, E2, A3, FF, FF, 8B, 55, EC, B8, 50, 86... 
[+]

Entropy:

7.8585

Developed / compiled with:

Microsoft Visual C++

Code size:

63.5 KB (65,024 bytes)

The file youtube_videomusic_downloader.exe has been seen being distributed by the following URL.

https://db.tt/eEwqNUID

Remove youtube_videomusic_downloader.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.