home

12f89ffe-7e4c-6b31-d6b9-cb5db1686925_1d1b3a093d21c6e

Baromaroro

The file 12f89ffe-7e4c-6b31-d6b9-cb5db1686925_1d1b3a093d21c6e, “Baromaroro Setup ” has been detected as a potentially unwanted program by 4 anti-malware scanners. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.chucklebodybits.com and multiple other hosts.
Product:
Baromaroro

Description:
Baromaroro Setup

MD5:
3e95ec7f93873419b7479ed16f0c24f3

SHA-1:
b0f61f0d6e54b38268462e664d5d1443cbfe43b6

SHA-256:
688966e509d384c3f72546a45fcccc99c404a3783780dc31342e05b6425e4148

Scanner detections:
4 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
12/28/2024 12:51:58 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Trojan-gen
160518-2

Dr.Web
Trojan.InstallCore.2011
9.0.1.05190

ESET NOD32
Win32/InstallCore.AHB potentially unwanted application
8.0.319.0

Reason Heuristics
PUP.InstallCore.EST (M)
16.5.21.3

File size:
1 MB (1,052,999 bytes)

Product version:
2.5.8

Copyright:
Fast Wizard Software

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\ProgramData\microsoft\microsoft antimalware\scans\filesstash\12f89ffe-7e4c-6b31-d6b9-cb5db1686925_1d1b3a093d21c6e

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:fHsXdMZjAomR9Ev5OusSFoaa9x1rk8+rzEv++0uacyC:fMtMZjAlHEvOSFodNrP+rZ+gG

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9187

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file 12f89ffe-7e4c-6b31-d6b9-cb5db1686925_1d1b3a093d21c6e has been seen being distributed by the following 6 URLs.

http://www.chucklebodybits.com/WVl6OTRQV3BTVW5ORWNYZGFXV1pxWVVObmEwVkRRalpoZFZwcVpVRjJNREpQYTJ0SFYySklaME50VUc1UFJXY2xNMFFtWXoxRk1rczJOMVZMVFdNNFNrSkVNMjl4WkRreU9VaHpTVUpPUmpWaFVrUkNORFJzVDI1eFNtMVFTemRqVUVveWVXeGpkelJNSlRKQ1ExTnBiRlYxV0hSNFpYUjJZVVpGWlRSRlVDVXlRbEp1U21WVVNUbEVNMmR5UlVFd1UyeFBaMDVZWkV3d1RWWm5WSE5LTlVseVpVRXdlV1pxUjFadVozWldWMjlKUms1Q1dqVkdhRW81VXpGWk1FNDVhbFEzVTIxS1ZESldUbFV4YTNOUkpUTkVKVE5FSm1VOU1DWmtiM2R1Ykc5aFpFRnpQVVpXUkRJd01UVlRaWFIxY0M1bGVHVW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMEVsTWtZbE1rWjNkM2N1Wm1sdVlXeDJhV1JsYjJSdmQyNXNiMkZrWlhJdVkyOXRKVEpHWkc5M2JteHZZV1J6SlRKR2JtVjNaWE4wTG1WNFpRPT0=

http://www.flashtourslaboratory.com/WVl6OTRQVU0wT1ZOS05VZHhUMk5ETTI5ek1Hb3dVMHd3YkRoVVNFZElZazFsWWlVeVFsUnBZMFIxY0c1bWVHWk9TU1V6UkNaalBUSlVVamhsZGxwbFlqVjBORTVTTkhsSlZtNVNOblZxT1dsbFNtVnNSRkZZTURCcFVXYzNXRmhqT1RSbVdWcERhR1ZrVGxoSGIzVnBUM0EzUlc5cGIyZzRNSGROWm1GNmVtbHVaV3RFYkZOUlpYTkxXazVCWTNkbVVWQnpkRmhCWjBSSVNVTllZeVV5UmtONFlscE5UVlZZV2tjMVRGWWxNa1pFU3pkbVZGb3lkVmRsV1hsVVpXc3hKVEpDTjIxamNrMVVKVEpHVkdjM1ZEUmlhMnRCSlRORUpUTkVKbVU5TUNaa2IzZHViRzloWkVGelBVWldSREl3TVRWVFpYUjFjQzVsZUdVbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0wRWxNa1lsTWtaM2QzY3VabWx1WVd4MmFXUmxiMlJ2ZDI1c2IyRmtaWEl1WTI5dEpUSkdaRzkzYm14dllXUnpKVEpHYm1WM1pYTjBMbVY0WlE9PQ==

http://www.appsapplicationshare.com/WVl6OTRQV3QxYUVkVVRVUndVSGxQUjBSSWVUTjZaRWRsYWxkcFRUWjVRMlZEU0hWS2VVZFVha1p6WWpsR1ZtTWxNMFFtWXoxVU5uaDBja0pvZVRkRlVrOHdNa0ZhUTBSUU1sZHZXWEFsTWtaSUpUSkdXalJ0VFVSd1pIZDRVR3BZYUhsM1EzcDRPVVZxT0dscFRqQkZiMWRZWWxjM0pUSkNNWGxEYmpFMVNXSmhUbTVVVTNSamNHTlJiMVJUZEU5NGVHMVZTbk5KSlRKR1QwNDJUMlUwT1RVbE1rSm5USEJoUWtKaVduQWxNa0p3UXpKRmVGSjBaSFJ2U0VVeFMzaEZPRWRXVUNVeVFpVXlSazR5T0ZKc2VsUk1hVTFVY21wVE1qUlJKVE5FSlRORUptVTlNQ1prYjNkdWJHOWhaRUZ6UFVaV1JESXdNVFZUWlhSMWNDNWxlR1VtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTBFbE1rWWxNa1ozZDNjdVptbHVZV3gyYVdSbGIyUnZkMjVzYjJGa1pYSXVZMjl0SlRKR1pHOTNibXh2WVdSekpUSkdibVYzWlhOMExtVjRaUT09

http://www.chucklebodybits.com/WVl6OTRQU1V5UmxveVVqSWxNa0ozWlVkUUpUSkdPSEEyVUhGbGRGWXpWemd4WlhKb1FuVm5kMkZJWkhOWmNVVTBVbXgzV0ZFbE0wUW1ZejFKVG13M1pXWjBlVFZHVlZkMlZEa3pWblpqWjFaWVMwRnBWMGhGT0ZWc04zVTFhRzgxVW5JMFoxSXpPVGg0U0VKRFJYRkxhVEJvUVNVeVJtVlZiMk0xY0RBbE1rSnhlVVpKVkVKWUpUSkNiM1ZoV2tjbE1rSjRTRUl5V0U5UGNVY2xNa0l5WmtveVRYUjJWRUpHVFdoTFkxZzBkSHBLV21rMmJtNVVhbFZxVUZRNFJrOVpjeVV5UW5aV2RXSXllVnBtWkROSVFXaExVekF3ZFdSRk9YWlBja0VsTTBRbE0wUW1aVDB3Sm1SdmQyNXNiMkZrUVhNOVJsWkVNakF4TlZObGRIVndMbVY0WlNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVelFTVXlSaVV5Um5kM2R5NW1hVzVoYkhacFpHVnZaRzkzYm14dllXUmxjaTVqYjIwbE1rWmtiM2R1Ykc5aFpITWxNa1p1WlhkbGMzUXVaWGhs

http://www.softwarecapitalfarm.com/c?x=5SdpeUuIuFzMAhRlPe/Z7fdUvykdD9yP6D1 VPYdZ5s=&c=K/fCahZLN9O8VBgEIFBLXgcBn5zP0T0E79c7c5w9/Ml6TDmCfbkOoZrOBQvmdsRDQxDnkRomtlUvP8Rjy2g/05xAEwfgCQRCjAXJ6k5r/Fmt7KxlQOFw3MQe5Mr0D wRMRCzlVXVe9DX2U7qXfWM69kWk0ki1dnHcmC3h4Hi94CKXCINrNf9bakAKG4d yXt&e=0&downloadAs=FVD2015Setup.exe&fallback_url=http://www.finalvideodownloader.com/.../newest.exe

http://www.currentappdownloads.com/WVl6OTRQV0Y2TTNVbE1rWktiVTExVjFCbFNsRTFjU1V5Umtab2RuVTBWa2h2ZWtWWGIzWklWRTFLVXpWcGRVVlVXV0ZWSlRORUptTTlXV3BIY0ZWRmVGcFZkM0pPUkVJd2QxUjRVRVEwV0dSUmFEUjVNMkU0V0ZGSmFXbGlhV2xaWTJsd2JWTnlTak4zWjFWME1VVk9WRE00U25Sa09GQm1TWFp2V0VOR1RFbHlUU1V5Um05VlZWcFNUa0ZwY0U1NlNFWWxNa0phUW1rNFVWQkNlVUlsTWtKblRGSTJkSFE0UkZsVFUwOWxibTlHY1dFM1JHVnNhRk5zUmxWSVVVUm9Wbm9sTWtZemNGaEVRVk5KWjI5SWVsaDVVekIxVEhjbE0wUWxNMFFtWlQwd0ptUnZkMjVzYjJGa1FYTTlSbFpFTWpBeE5WTmxkSFZ3TG1WNFpTWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpRU1V5UmlVeVJuZDNkeTVtYVc1aGJIWnBaR1Z2Wkc5M2JteHZZV1JsY2k1amIyMGxNa1prYjNkdWJHOWhaSE1sTWtadVpYZGxjM1F1WlhobA==

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.