home

7zip.exe

Bidedarafa

Platform Beta (Alpha Criteria Ltd)

The application 7zip.exe, “Bidedarafa Setup ” by Platform Beta (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.worldbodybyte.com and multiple other hosts.
Publisher:
Platform Beta (Alpha Criteria Ltd)  (signed and verified)

Product:
Bidedarafa

Description:
Bidedarafa Setup

MD5:
1cf978b3e0df473e36eda06c949b663e

SHA-1:
fa8baa2b5fd126a6a3c842811caff765e47cc62c

SHA-256:
6f7d452118cddf5f75d0a137f547adc7a03a0b0c8c633dcc35b4e5b671c6ca15

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
1/7/2025 9:17:21 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC.Installer (M)
16.6.14.11

File size:
936.5 KB (958,984 bytes)

Product version:
1.8

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\7zip.exe

Digital Signature
Signed by:
Platform Beta (Alpha Criteria Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 4:52:04 AM

Valid to:
7/27/2016 6:46:42 AM

Subject:
CN=Platform Beta (Alpha Criteria Ltd), O=Platform Beta (Alpha Criteria Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121ECC46F7F85712126CA9617071FBF3734

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:RbvjTfzHL8D3hGCsdFlSO/uUfJiRGe1ZO:RDHzHLy0CsllgRGl

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9338

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file 7zip.exe has been seen being distributed by the following 18 URLs.

http://www.worldbodybyte.com/c?x=SELN36ZXaNVcod1 JGS/tVpZVz8lH4h4OyNF0N3agso=&c=JI3EdVG8N33qecmfDFyKiiFFZy5Un1gGuWn9dJOH6N1C1aSdwrvHNX9/bnr8tK20i7kxfsa6hiEvICGNRlxZ9I xt8vwGwGO/A/GTHcT4Jdm9aPF9wBccC71snr36zsCd/5Y1qrPMZ3f8R5MzaaSprotfwidvPJhuI5GA8Ijf9A=&e=0&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

http://www.worldbodybyte.com/c?x=f8ILjtjbVtex3F25VNi/fP cnwLtdia3HWFnfFAwvFI=&c=Utd1GfeOrDcLi6WEWWNEar6P0iAEsy3K3dpiVnRrxQdrm/cpqFk/7VmEXbyreT0KuHcBbzl5tTGyUJRQMzP77UAdqy9jHUeY/Ll5rV7UWj2XrcU//9ORfrboSmzqSosgWAALADSSQSXOTr2Y6x6Dy3v56Ty3FYkBDEBrtKMviwA=&e=0&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

http://www.worldbodybyte.com/c?x=0LoR25Ul1K9A5cN MUGPmff2xAs0wHnNJH5Rf lRlRU=&c=WcwfdyGH7otIWMUdsrVF3qXzG3A4NKbKLiVoUgMDAFO1Jz/wtS/ZyXDX9UjSWiZDjLq7NmPhW2tq6N/yAt9/lsjRNdLJ6y anyjXKeRUpeUmMglMdXAqGt0WnShBF49Ryck3KCx4Rr9j1Bkghlx3i3THUs1SSDzPV6lhVqT8N1c=&e=0&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

http://www.worldbodybyte.com/c?x=uRZHuhOPLrc5QNbzG5uyVJVbrPGubBWNastXWYNK0II=&c=gJvlmyH9mnaErF2ZaQewG5CSlL9bYtJ8V2Q9i3YF7ufqHTxTKIUMZOU7lQLRAhQCzlkyh7YKa73CiioMSEZSYCZQi455N2oXtgpDfDV2neZVBbeZ0ZMWOZmAnf1ku MZQevBF5r2Eoq6 mo2kuXh7TO3 0MHKnvpcWWtydXDvn4=&e=0&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

http://www.worldbodybyte.com/c?x=rpV4G4I3SCb7KXdqodYugAG4GFbQOyLmIdCAJ2mYMl4=&c=LLgPSv0uFIfD5kYkqrWfcW4/vkRfj2yCif4iTIqL5l1xKRwY5d 3WWxV/TYydtqcedLwrFI0iU3cdLi9nl RSpPJ1kDKf4wIbP iqcd3vowqlEbRVs8xbFz3m6FfOaWiAVQuvD1sJ6c0hveNHo jh 9scEyPkcyogeF78JbS0Gc=&e=0&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

http://www.worldbodybyte.com/c?x=4HKkQbalU3qA9MD454wMQ6hwiAzqqNlWNADUwOyNZso=&c=/9vX3JjUL58qL580FmGjuKDykOIdOMfwTDLNG4UILzAGoVcHJfmZcb6PPjyR0ApT UvX8CG6deCKHl9aLWh/juojUUr6RbyuOhsQh63izmDSoNwkZU8N/r FlFmCP0prNh lPJd39fcrjxOavtTiuzVkIAg5Vazepd81IMWNa88=&e=0&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

http://www.worldbodybyte.com/c?x=k3iSBpNi OMVg2dCIL40JX7V5kxyLPPmidmi/lPrwHY=&c=XKcrazxgkhK9pWHhK325l9B1EYs1WSwieAKfwavqNLH6Sv1hmj9qS4bcTko0o1LRiIIOarf EcifEvSQrG1x3rsLE6GkL8OglAgdcoGl4DopmXbCCI90lQKdh5WwKVP5LeSJhCTN6c8l3gQ2nArkThxR5PoaD71oJshgj7aFKVY=&e=0&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

http://www.worldbodybyte.com/c?x=dKO2zVQ1hJ1D0BbssDkV88QI3XAC3ky5i4odaNHocQM=&c=gAV9AJLwCKjC9dxLHI98xnD50OwErXRTqgrxljGPEbT9IvNQuCM6UBVs Yfp2hHk1xgUsrffixt/kJfyHcBB21dE69oTXX4kV/mofPhl9QFhTUFFDG6Kht5tUjuthEGs8hsZNbX05tVUi5Jw0BwXhz9JtO1Dz58Om7OL0d/ib4E=&e=0&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

http://www.worldbodybyte.com/c?x=kB7jmCjUCrVYd5si3fRcgZndbeJmGO1O8AdwAaa0vIg=&c=CGMa7Rn9yHPAmieQpU7JFHg0f7qzdSiZvmtT0VdNpKNofV64ibJuIN7tBPpUVRICjlFU20YswXIX7HLs7ZKMpCAODtZJW9fvBqjd/H1XIFixcWVttLw9D/kGpDzJquGQVGVZlhtrCC bNddpf30HQtHeUZ0sxMoPgwWxUBrmR7M=&e=0&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

http://www.worldbodybyte.com/c?x=WrQ5ugKR8nXBoglz63UDHsW7LuB7yuHyYCZfCT1 8qk=&c=2gV2VAp39X1Ii8RSgHW7J Z2OYC9YawrOYnbX0o26YPZtHU nz6nOL5Dq98FMWlL9kssxF726ILrV4p9JCtdQLvQd7ankxdZ3DqPZdjjWLx3v/J3bLb0K6o6DbZDHhUZzlcsrqJnKI8eCTQUF3czghl5McvRd5x2bFRqpasrTPU=&e=0&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

http://www.worldbodybyte.com/c?x=BxvBXLpd7J3kIPmvUktuZBLdLbfj4mUcFABDqvxHN7M=&c=SRiSBxknry3ClmmtAWsltxgbJ2WQB O/2fCeXcPTqB9WpGuBL4mlGP3zdGe/tcD2RHOerhQRhXkgv aAjXNhyh3Z4ks5 7iRF/nkKaZrEbUrpt1ysbFU2eow7qpQp8HPl0ccPyu8beyCtDU4hyODIs/6diQ2U1G4zpdkvRKvKIw=&e=0&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

http://www.worldbodybyte.com/c?x=PLNGMxToalglkxrELwnb3RGwH3FcU tLymZiD8l65rY=&c=Dub7vAYBTJxFOEcIDJG/sdaw MIjkq2BDb02DmCnNw51ROsddETQRLPOq6e/sMQ7/ZU224eXG7JSFfw449L0dwVIvmriagE/Rz7bpoGDi l2ybMqbIiYM2sI7SUr6exshw8DYGYRSLXNAwv9PWNE1gEW/IgGfqvl9fo0VxG81BI=&e=0&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

http://www.worldbodybyte.com/c?x=hp1C44eyDo7HJYnGuKMU9Scq0RT0BxukZWwAAYvwwrg=&c=CN49lpfKdKXsVOxXoF9Q6bOKj03vtoFsb0jj6btodnXnU8 ZGfalAQBb3YR70XFvt24vP5bRsiaSmUMwfojbN6cPjH6hydTgGeOAG2k3WWGeD69t9PmkE0C5y/rdDtqXu3ngvOe1vhrDN8DDvlvD/cl35GibKuQAp6ywYfTHGKQ=&e=0&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

http://www.worldbodybyte.com/c?x=yIGvwlzHN0CkbnQrRD8dRwe/3TWHBeZ1XD03/VDN6BU=&c=EwpEzCoe9YrqtFxTfkn59flyydr 9IflRtD6vDXf8sXGDmlQ1GkTzauSTmdAQeZGVQrHisoQwlXYr3AY56hd0v6o6EEus5hrmio8VN17aEzCfvwkmFT2FrSjV0G7ZKChlo1nwHaxWwwh9mpnj0lVFacQ9M8FZnb/6i3u/p/xHw4=&e=0&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

http://www.worldbodybyte.com/c?x=mtSegMeoXxgMftbskVRqgBX/wnyMt54H2pBxbL7HDi4=&c=PFURa3EzW9SzL5hO6eve0KSlDzELiAdNodNkrF Ck jca W7BmgvpSHE rr0hJOlKJfHjHr 5Tc62zzon8FpeF2pcMr5nYe5TpV5ATsrPY/XjHccrnZt75KWqev/JcQuha28DjL2/JWgttcaksDL7wkOkvgHmlcQV2Hkk10vFYg=&e=0&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

http://www.worldbodybyte.com/c?x=ph7TpfpHxQc2sb5x6 SsALTmZ07QifZAIsMlosatoMs=&c=mEpCdpQnn/0Q3/ueUIhiNffqesWEKjmdPLQFn31cSioVpjvx C3pojdRm5 bOd61F/FLcAblhjJ6JT9x KaM3hekYJTE8ImyaVADthioI5JQaUDxUMFT2/il6W5i3ppKcbtmrt1HV2hEXbe2IPAXX3AwtTwlK2HJ4H6fQmwlhYY=&e=0&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

http://www.worldbodybyte.com/c?x=6LYXSp61eJcmZ9U6fp1y3pFBNZX1Fijf4M/kTzbrGBE=&c=byKrAw/ hNzwh0W0wNe31WMHJF9kR0QsFgYSe4QXCym22izp6qHYwTkmp5G8HKS0wsrN y4HLT8wy9AsgDBrtK3xTZFAEm1IzL4XPgKgcVlJj1fYFoX9Njl8qdoC5Qb8T4iUOX06zd//QIhsH/WNCXgWNFb1Ueu1Ip3dSHjsIcQ=&e=0&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

http://www.worldbodybyte.com/c?x=lDKUyPEQMBs59LfGKc Q1xQ0 cZronIhRujZL14bNXA=&c=Zeqe0yieRgIgyAeXKsut4PgBCg4mUye8bEKp0K reaKAKmBDcv3FKSjfb3tjqvqkY38rQK4cCAiKS5zLgttV00FUCygnLkfopIANXV2aY80KdWDGl1oZhuNMsgq98y56XdtnBxQ73M7iC/wX/A3JI0qRJcBV65c/q/iDlLK8USk=&e=0&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

Remove 7zip.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.