home

6eeb88d1-fe4a-3e90-a8a5-ca67cec2ee9d_1d1ecadacad8723

Fudeto

Quality Install (Alpha Criteria Ltd.)

The file 6eeb88d1-fe4a-3e90-a8a5-ca67cec2ee9d_1d1ecadacad8723, “Fudeto Setup ” by Quality Install (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.bundlessendquick.com.
Publisher:
Cosara   (signed by Quality Install (Alpha Criteria Ltd.))

Product:
Fudeto

Description:
Fudeto Setup

MD5:
42c786d6f3a31e1397fd6a41fbe4556c

SHA-1:
15e51e74c0ed2b97ec5e7dd683d716a49ef27340

SHA-256:
563f455eac4c18011345d749589406e2d9a5c2f07f2ff262940034ea93eab0b1

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/28/2024 2:14:48 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC (M)
16.8.2.12

File size:
1011.3 KB (1,035,568 bytes)

Product version:
4.6

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\ProgramData\microsoft\microsoft antimalware\scans\filesstash\6eeb88d1-fe4a-3e90-a8a5-ca67cec2ee9d_1d1ecadacad8723

Digital Signature
Signed by:
Quality Install (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
1/6/2016 5:14:15 AM

Valid to:
8/4/2016 7:59:05 AM

Subject:
CN=Quality Install (Alpha Criteria Ltd.), O=Quality Install (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121BA484E4C31175E4A844ED055428DEC42

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:qgvSIxBZj69upcRK2jsUHc9KTscrqFjUugux2TrhbIC:q8H9cljmARqFwvq2TdbIC

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9287

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file 6eeb88d1-fe4a-3e90-a8a5-ca67cec2ee9d_1d1ecadacad8723 has been seen being distributed by the following URL.

http://www.bundlessendquick.com/24gR5cmCFfx2vty1mEaKjBaHeAkQUiuAtSADypPsAOtF2LMQ1bECgt0tCu9d8UEpgoSR63uU TFl0PtOcjpxnd9S4s5fKBX5dAx2pBrCSfG2PMs6kO3q2wYTToBHjOs1_4iazeXA4IF_cJqy3LAAVx7W2kgJ9ea1YsJK6D7ErMyubDpsYy0EKUglbIaW96Wr_7vHYLEVtu4OGbxy BXsLhbEKFCleT2bOtDCs9yiOSW2Jk3lIY61IkmVyvCj6EcBX3Cfu1H7Nx7CXpSH2GedZSOS6B9rT7M0HsJbmZLa1PyADU7LtLO6kPYvtq6D6WDxtljpCZJ1Rsn6FGhexY1aQ2IU3EFedsN6RcIBJCX fdiVc43Mpynjz9MM23lfHRvTfX5 uGW7IDFJ5z49pX_PT9rlLYyVPgm LQE7qBfBFAVR0XV2O57y6TovUnqOcIElfSRbD7hvQU7WLxE2uLKZoAO0GrYqpN1_7la DC6HWbjAqLZw1Tmn91Ah5Be4XBpMSSulNqYgewLXgo6cfnh5 8DsNFEEMiN_5v8pS04QmMJqvjYiVTsc_K7t9LB_hfriYpxzZ59fASRTxcoXGzpCQEcThZX2BW1YGLfN9YptYdNjpAhxO HFLPMyXvNEvLot_IpQmXibEE4Pl1F9yqkiU9z40gO1vGL0U iknBz6oM6AOlDOMXk=-GzIAAMTOFhOKWGwO5Wd7wj845IAPqN9KArca2zxQbmxAhU2FGP06VhJ9sPeT2xTjAQ==-e

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.