home

adobe-flash-player-13091-dp.exe

Rukimakin

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application adobe-flash-player-13091-dp.exe, “Rukimakin Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Mode Beta (Fried Cookie Ltd)  (signed and verified)

Product:
Rukimakin

Description:
Rukimakin Setup

Version:
3.7.4.5

MD5:
95f8f789b932e28edf94d3d62332f1f0

SHA-1:
7fc5eba02790cb98ddc6413eccdafb6e7bd61a01

SHA-256:
70af32131221071714fc8e1ca2e4b1292168e41a4a40377b024278f7e065c229

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/23/2024 7:57:04 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.6.10.1

File size:
960.6 KB (983,624 bytes)

Product version:
1.2.5

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\adobe-flash-player-13091-dp.exe

Digital Signature
Signed by:
Mode Beta (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 2:37:06 PM

Valid to:
7/7/2016 6:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:TCi46vIpWeGEvHstSIgFnM2MXLk03/hNcQQicg6pxiEW8:TrrwwXEvHstlgJM7k8DNcggxC8

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file adobe-flash-player-13091-dp.exe has been seen being distributed by the following 12 URLs.

http://www.tagtowerscapital.com/WVl6OTRQU1V5UWxBNGJ6WnlhVzlPZG5CcGFFWnZkVGhLY1hoTlFtVTJiWEEyZFdGVGEyUnhibTlIUTIxVFdVcERWU1V6UkNaalBXUnhlWEpQYVhkdmJVSndVMWhLVXlVeVFrMXFiVmRVTjJ3MWEyMVZVWHBsY2lVeVFqRkdPU1V5UW1zNFdsaFFUSE5sZG1aNGVtMU1VV2xoV2tNNFNVWkliRzFVTWxkMmFsYzNhV1JZV2xOellUSlFjMmxrTkhSdmNHUkdiMVUxVkRRbE1rWTNTVGRFVURKWE0yMVdOSFp3VFNVeVFtVlBNWEJ5UmxKeE9IZGFNVEJ4VVdGdmJHSlhlV0ZXYjFnNFMweG1XbU5JV0VaSmVTVXlSbmxyZGtOeVp5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWm1jR1J2ZDI1c2IyRmtMbUZrYjJKbExtTnZiU1V5Wm1kbGRDVXlabVpzWVhOb2NHeGhlV1Z5SlRKbWNHUmpKVEptTWpFdU1DNHdMakkwTWlVeVptbHVjM1JoYkd4ZlpteGhjMmhmY0d4aGVXVnlMbVY0WlNaa2IzZHViRzloWkVGelBVRmtiMkpsTFVac1lYTm9MVkJzWVhsbGNpMHhNekE1TVMxa2NDNWxlR1U9

http://www.grabappsdownloads.com/WVl6OTRQV3c1ZWxoT0pUSkNjMFJRVUZGS09FNUtXbTFpVTBGUGRtdHNaVkUwY2t4WFFsRjVVMUkzYW5wdlRrZDBRU1V6UkNaalBYWnVaMnhzVFNVeVJrZFhKVEpHT0Zka00xTlFiMFJ6WlhZeVIwNVNNMDQwZVhaSEpUSkNkRWRWTlRoalQwOHliMHhWT0ZKWVRqWnhKVEpHTVV4QlJtVnJNR2NsTWtKdGFVVkNjM2xGTTFKdVlXaEJRa3BOVWt0WFYwNU1NR3hYU3pJMU5uUmxSU1V5UWxJM1ZuaFVkRWR6V0VOVGEzWkljM05HV0VwVk5tWmxURlpLVUcxWVJqUnNVR296VVdoRGVFMHlaREY2V0V4M1JrUkhTU1V5UW1KMVdtRlJKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabVp3Wkc5M2JteHZZV1F1WVdSdlltVXVZMjl0SlRKbVoyVjBKVEptWm14aGMyaHdiR0Y1WlhJbE1tWndaR01sTW1ZeU1TNHdMakF1TWpReUpUSm1hVzV6ZEdGc2JGOW1iR0Z6YUY5d2JHRjVaWEl1WlhobEptUnZkMjVzYjJGa1FYTTlRV1J2WW1VdFJteGhjMmd0VUd4aGVXVnlMVEV6TURreExXUndMbVY0WlE9PQ==

http://www.headcycleuniverse.com/WVl6OTRQWEJ0YnpKME5tUmlTRUl5YVU5MmIySTNURVZpVmlVeVFqUm9ZVmxvUkhkTFNFNWxUakpDUWpsRU5IUmpTU1V6UkNaalBWWmpibk5TVnpkek5ERkJlSGxDVVVaVldWcHFkazA0VWtobFlVTjNTV0UwUVRsRVFtbGFPRzlaYWpsalNFbFZkVFZMWmxZbE1rWkJNbHBCUkdZbE1rWkRNM2gzVlRWUWNDVXlRa0V4WTBGTWFIWm1KVEpDVWpNMVQzTTVUa1F3YWtkWmFWQmFZalZWY1dGblduaHJPV0Y0WjNkRmMwNVpPR3hoWkhkR1NqUWxNa1pYY3pCalJsSTRjMGhuVjJZd2FUWkxhRUUxVDBaQ2NVcFRWV1kxYkVFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbVpuQmtiM2R1Ykc5aFpDNWhaRzlpWlM1amIyMGxNbVpuWlhRbE1tWm1iR0Z6YUhCc1lYbGxjaVV5Wm5Ca1l5VXlaakl4TGpBdU1DNHlORElsTW1acGJuTjBZV3hzWDJac1lYTm9YM0JzWVhsbGNpNWxlR1VtWkc5M2JteHZZV1JCY3oxQlpHOWlaUzFHYkdGemFDMVFiR0Y1WlhJdE1UTXdPVEV0WkhBdVpYaGw=

http://www.tagtowerscapital.com/WVl6OTRQV1Z2ZGtjelNVNW1VRWw2TWtOcWFuZE9WbEI1Ym5weFJHOUhZbE0wTlhOaVp6Rm9ObkJNTmxBeVpVa2xNMFFtWXoxWVZVSlNaVEpXV2sxMFEwTlNhbFpZWlhSSk5TVXlSa3BtTUZKTFJXSnBUekZ6WVVwNWEzQTJURmRSTTNWdFkwZExSV3RNT0VNeFdUazRaRnBKZDNoVlpURmtUWHBZTVZWd2JsSlBhbUpsYVhSalJWcHRTbUl3Ulc1eVduUjNOMkZYYkUxS1dFeHhjbVF6YjFoUFkyRjNUVmRFVGxCTmN6VktNVTVpVjFnMVMyeDNaSHBIWjFOSmFtSkVWRXhWUzNkdE1XbEtOMjlNZHlVelJDVXpSQ1psUFRBbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0yRWxNbVlsTW1abWNHUnZkMjVzYjJGa0xtRmtiMkpsTG1OdmJTVXlabWRsZENVeVptWnNZWE5vY0d4aGVXVnlKVEptY0dSakpUSm1NakV1TUM0d0xqSTBNaVV5Wm1sdWMzUmhiR3hmWm14aGMyaGZjR3hoZVdWeUxtVjRaU1prYjNkdWJHOWhaRUZ6UFVGa2IySmxMVVpzWVhOb0xWQnNZWGxsY2kweE16QTVNUzFrY0M1bGVHVT0=

http://www.headcycleuniverse.com/WVl6OTRQV1l3WlU0MldrNW1jamxMY1ZkaFpYSllVSEJDWW5NMGNtUmxWV2c1YzFkQmRFSk9aWEY0T0hsbVIwVWxNMFFtWXoxQmNIZzVSVGRLTkd4aWEwUTVVblZOZWs1UkpUSkNUWHA0T0dSeVdEVnRlblZyZFd0SFQzTm5RVVZSV21sQlNVOHpVV0poTmpsbmRWWlBaMGMzVXpobVVHSXhkMk5yTjBSR1YzVjFWV3MzVFZCNlRrVm5NVWs0ZG1FbE1rWjBSR1JPU1dWSWVYUWxNa1pDVWtRbE1rSmFVa0ZCWmxrbE1rWmpjbG81Ym1Sb1FrTjBjM2ROSlRKR1IxZzRWamQ1Y0c1TE1UTnFWMGRpT0ZCT1dEZGFTa1ZtSlRKR1FTVXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWm1jR1J2ZDI1c2IyRmtMbUZrYjJKbExtTnZiU1V5Wm1kbGRDVXlabVpzWVhOb2NHeGhlV1Z5SlRKbWNHUmpKVEptTWpFdU1DNHdMakkwTWlVeVptbHVjM1JoYkd4ZlpteGhjMmhmY0d4aGVXVnlMbVY0WlNaa2IzZHViRzloWkVGelBVRmtiMkpsTFVac1lYTm9MVkJzWVhsbGNpMHhNekE1TVMxa2NDNWxlR1U9

http://www.bundleflashapps.com/WVl6OTRQVlZaV1ZKeWVVNDJhRWR2TTA1dU5qZ2xNa0kyV1VodFZFdDZOMUptZG14Mk5HVk1OVnBSVmxNeGRrTnhUU1V6UkNaalBWbFlZbU1sTWtZM1ZrOUZkMUpyTnpWV2RrUlZPRmhLWnpGSmJHcEJVbEJuYWlVeVFsbHZaVzlrZVhjMFNGTWxNa0poV1RscVoyeDZlRVZqTWtjNFdtZFNjbEp3YlcxaVpVMVNkbFlsTWtJelNXMWtNa2xWUkdGYVdrVmhaa2hyVWtkSldXNXpTVVlsTWtaNGRubEVlbGs0V1daWGJHTklTSEpITVc4MU5teFpaeVV5UW1nelF6VjVaM2hUWkdaaGIyVm9Ubk0xUjBFd1ZWaHVRbG93YVhvMVFTVXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWm1jR1J2ZDI1c2IyRmtMbUZrYjJKbExtTnZiU1V5Wm1kbGRDVXlabVpzWVhOb2NHeGhlV1Z5SlRKbWNHUmpKVEptTWpFdU1DNHdMakkwTWlVeVptbHVjM1JoYkd4ZlpteGhjMmhmY0d4aGVXVnlMbVY0WlNaa2IzZHViRzloWkVGelBVRmtiMkpsTFVac1lYTm9MVkJzWVhsbGNpMHhNekE1TVMxa2NDNWxlR1U9

http://www.sharefactorybundle.com/WVl6OTRQU1V5Um05YU5VMU5ORVl5WjBvbE1rSjRVekI0ZERkUVdHVTNja3hRYXlVeVJtSk5WVnBxVmxwVmJIQTJVbVpvVTJzbE0wUW1ZejFXT0hRM1dqaEljalE0ZW5OamQwTkJSM2dsTWtadmMzRTBPV2M0VERaamRWUjBSRko1YUhBMVlYUjVaRnBCVkZSVlYxVjFjMEUyYVUxbVdGUnpNbXR3VlhNNFNsbEZSVTFyVURSelMzRjBTbXBGTVZJemNFSnZWbTlDWnlVeVJqTTVSVWxNYmpJNFlWZ3lXVmRuVFNVeVFtNDBOa0lsTWtKWlNsUnhUVFZWUW5CSlNsbFphVFZMWlhkSVVubGFXVzk1YzA0bE1rWkpNa1FsTWtKalpubERjVUVsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptWm5Ca2IzZHViRzloWkM1aFpHOWlaUzVqYjIwbE1tWm5aWFFsTW1abWJHRnphSEJzWVhsbGNpVXlabkJrWXlVeVpqSXhMakF1TUM0eU5ESWxNbVpwYm5OMFlXeHNYMlpzWVhOb1gzQnNZWGxsY2k1bGVHVW1aRzkzYm14dllXUkJjejFCWkc5aVpTMUdiR0Z6YUMxUWJHRjVaWEl0TVRNd09URXRaSEF1WlhobA==

http://www.sharefactorybundle.com/WVl6OTRQVTl4YzAxQ1owcHJKVEpHTUZCVU4wOHhjVU5xYkVSaE16VTNOWEpNTkZneVN5VXlRa054Y2tGdlRpVXlRbmt6VUhNbE0wUW1ZejFuY3pGM05HOXZiR1p0Y0c4elJ5VXlRblZpZFdVbE1rWTVNbWhuU21JMGFuQjVZMlVsTWtKUlRuUnBkMlp2Y0ZBNGVIaFFjbk5NWlRCU1JtTnBNV3BoTkhKVFoybzBOWHA0ZW1JNWFraHRhR040WkhNME0zTmpOM2hrYnpGUlZVUkdUMnRUVkdocE1tNXNVbUUwZW5SRGNXUkZhVXBaU1RjMmVGRndWVkkxYkhSc2FrSlNWakEzWW05eVdYTTBPVzl6YWpsVU56RXpXbmxuV0hjbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbVpuQmtiM2R1Ykc5aFpDNWhaRzlpWlM1amIyMGxNbVpuWlhRbE1tWm1iR0Z6YUhCc1lYbGxjaVV5Wm5Ca1l5VXlaakl4TGpBdU1DNHlORElsTW1acGJuTjBZV3hzWDJac1lYTm9YM0JzWVhsbGNpNWxlR1VtWkc5M2JteHZZV1JCY3oxQlpHOWlaUzFHYkdGemFDMVFiR0Y1WlhJdE1UTXdPVEV0WkhBdVpYaGw=

http://www.grabappsdownloads.com/WVl6OTRQWEIwZEZOd1J6UTVOM2QwZW5oME4zZHJRM1l6V1UxR1ZUSkpWSGsxVlROVVNsWmllV2hhZGxaR1ptY2xNMFFtWXoweU1rNWlaSEYwWVNVeVFrTlFaVVJzTWxvbE1rSlhUMll5VUZWUVRVbExiMG8zTmpGMmVqUldWRmM0YmpscFZ6TklNMmhGYlVvellXeDJTRk14YnlVeVJtTTNSRE16ZFdKa2MwMGxNa1p5V25oelpXcFZORlUxTVVkVlZEaGpiMmRuUTFaRmVIbExXakpEWlcxTlRWSjRhRTh6UTFrNWFGTk5Va0ptVEZSamJGSnNTbVJaTVVaUFZtaFplSEZQSlRKR1FUaE5UMDlCTVVNMFFXa3dSRk5SSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm1ad1pHOTNibXh2WVdRdVlXUnZZbVV1WTI5dEpUSm1aMlYwSlRKbVpteGhjMmh3YkdGNVpYSWxNbVp3WkdNbE1tWXlNUzR3TGpBdU1qUXlKVEptYVc1emRHRnNiRjltYkdGemFGOXdiR0Y1WlhJdVpYaGxKbVJ2ZDI1c2IyRmtRWE05UVdSdlltVXRSbXhoYzJndFVHeGhlV1Z5TFRFek1Ea3hMV1J3TG1WNFpRPT0=

http://www.tagtowerscapital.com/WVl6OTRQVm8xZVhSUE1uWndOSEpwZGpKRE0wMXlPRGs0TVd0RlUwTmpXVXhhVnpoMWRsTmhRV2RyWlc4elQwRWxNMFFtWXoxWVlYbExkMEZwVEc5VldFc2xNa1o2VnlVeVFsQnJlVUZVTURFekpUSkNSVlZwYzJFbE1rSmlOREpDZUZWeWIzRldXRGMzY3pkNlNrRTRSWGN6YVV4dkpUSkdWR3R0VFRoNWRIWk5URWRqUVU0d01EWlFWbFo0ZVRGc1Zta3hjMUl4TW5kRVFUVjBjWEphYVdwNFl5VXlRbU0zYm5wRWNpVXlSbGQyVUZaMFVUSlRWRVJETTFscGREZG9jbVZTZGpKRlUwdHdPSGRTZHpObmNFY3hVV1JqV0U5S1VTVXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWm1jR1J2ZDI1c2IyRmtMbUZrYjJKbExtTnZiU1V5Wm1kbGRDVXlabVpzWVhOb2NHeGhlV1Z5SlRKbWNHUmpKVEptTWpFdU1DNHdMakkwTWlVeVptbHVjM1JoYkd4ZlpteGhjMmhmY0d4aGVXVnlMbVY0WlNaa2IzZHViRzloWkVGelBVRmtiMkpsTFVac1lYTm9MVkJzWVhsbGNpMHhNekE1TVMxa2NDNWxlR1U9

http://www.presentheartapplication.com/WVl6OTRQVUp4VkhCYU1UVk5WRXRqWTBoNWQwbDVha0psVG05dVF6TlpkV05XZW01VVFqUldlamhuYVhKc0pUSkNjeVV6UkNaalBXd2xNa1l6TVZwTE4wUTJiSFk1ZEdnM2IxaFlhR1JFSlRKR0pUSkNSa28zSlRKQ01qWTJUbGQzWmxwVmJtbDNlVXAyTW05Wk1tSjNOV05yYkhGWFduUWxNa0poZVRWbVMwTTRhRTgySlRKQ1JGSlNia2RJYXpKb1pUbFhURTVMVkU1Q1ptRk5kRFJNUVhFeFptSnlNazR5ZDIweWIwTlhNemxVTjBoNVZHRjFhbTEzUkhNM04wUnFZWEk0TVhGd2NEVm9WVlJCTW1kSU0xUTJjM1VsTWtKbGIxUlJKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabVp3Wkc5M2JteHZZV1F1WVdSdlltVXVZMjl0SlRKbVoyVjBKVEptWm14aGMyaHdiR0Y1WlhJbE1tWndaR01sTW1ZeU1TNHdMakF1TWpReUpUSm1hVzV6ZEdGc2JGOW1iR0Z6YUY5d2JHRjVaWEl1WlhobEptUnZkMjVzYjJGa1FYTTlRV1J2WW1VdFJteGhjMmd0VUd4aGVXVnlMVEV6TURreExXUndMbVY0WlE9PQ==

http://www.bundleflashapps.com/WVl6OTRQVXhHV0NVeVFuVlhNelZoYjBWSlZESlZUalJSYTFRMGVVY2xNa1lsTWtKRlNqZHhNVkF4WjNwVGNFeHdkSFJ4T0UwbE0wUW1ZejFuY1dSeWVEaHdUSE5ZVTFkS2RWRlhhSEJ4ZVZZbE1rSkNaMnd3Vmtwd1FtWmtZbXhxWkVGeGVteEpiMWRCY3pGdmNuUmFjVlJ4TkZoVmRUVmpjMnhCUm1GdVVsaE5PWEp5VW10SWVXOGxNa0l4UjBSSVMxcDVNa2hJZDFoUWEzVllNMU5tUjBOdVMyZFZUWE5GVUc5QmJFZGxlRWhCTmlVeVJuZDBWRGROWVZkdmIzRTJaMmhMTWxWMGJsUnZiamhFYmtWcFIxbzBha016Ym1jbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbVpuQmtiM2R1Ykc5aFpDNWhaRzlpWlM1amIyMGxNbVpuWlhRbE1tWm1iR0Z6YUhCc1lYbGxjaVV5Wm5Ca1l5VXlaakl4TGpBdU1DNHlORElsTW1acGJuTjBZV3hzWDJac1lYTm9YM0JzWVhsbGNpNWxlR1VtWkc5M2JteHZZV1JCY3oxQlpHOWlaUzFHYkdGemFDMVFiR0Y1WlhJdE1UTXdPVEV0WkhBdVpYaGw=

Remove adobe-flash-player-13091-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.