» adobe-reader-xi-21590-dp.exe
Overview
Analysis
File Details
Downloads (21)

adobe-reader-xi-21590-dp.exe

Software

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application adobe-reader-xi-21590-dp.exe, “Software Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The installer is marketed through download protals and search ads as Adobe's free Reader but will also install additional software offers which include adware, PUPs and browser toolbars.

File name:

Publisher:

Mode Beta (Fried Cookie Ltd) (signed and verified)

Product:

Software

Description:

Software Setup

Version:

2.0.3.8

MD5:

bbdb2b637f35e3eb2a0d6212c823f262

SHA-1:

2143461e3d8b02387208388024dede8ce9a72f3d

SHA-256:

7fc9522d899a9030f8edf6fba4562042c2b216cabcf3ee96fcfc0cc8dcb054a2

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:

11/2/2024 3:27:38 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.Installer.Installer (M)

16.2.10.7

File size:

937 KB (959,496 bytes)

Product version:

3.3

Web application

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\downloads\adobe-reader-xi-21590-dp.exe

Digital Signature

Signed by:

Mode Beta (Fried Cookie Ltd)

Authority:

GlobalSign nv-sa

Valid from:

12/16/2015 2:37:06 PM

Valid to:

7/7/2016 6:06:18 PM

Subject:

CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:JWUQ/n11wfgcrmT73yaNxj9Xuf1pHhok5xyJAQtv2RTwN:JNMUrmT7vX8uknWA42RTg

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file adobe-reader-xi-21590-dp.exe has been seen being distributed by the following 21 URLs.

http://www.contentworldcurrent.com/c?x=uBNuXV8m 4DWqJZJH87qhfaUbTRn4Py2xCNEOMkeHQc=&c=VOlzaXmP2ozKW7mhlN6nSdVqcvWbcDNMx64OyjImZrQOc/st98bVQGXGLIx9FUPKSAR5xCJSXbyvh18ODBNE2sdAAF 1pyiyvn9Zd8yRKTHISUz2RxucoA99DBbWDzzA&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.packageheartfactory.com/c?x=ziQjHLdZyt5DxDw7pCZJNVHG01UCDhwEbawwFepjAN0=&c=nQgjCub Ug5ybx1Rz4TU XtqukCfiSKYf6BjJoNLKWuw6urxCYyJ8/LRM/whEYVijesH/2coOWKrzp5TDxPp1/zoLv2Zzpi6h364acccsj2YABaT9sFsp9B6j2MTk0z0&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.deliverybinariescontent.com/c?x=N4bl1mudm9TFhrreOyUxbHT96u6rprdWIPODRqgdqYE=&c=wEUC1NFGuvwJhHdVpWOZVkpqYEFpBv1LgB6lGYe1XfN/xSmSloEkVxvH/5/h5Dj/oiFcFrj4Z7u7ottAMynksRlvqdmFhenBUMupsrMhxwr80Az 2KZ9hsGHW0r7xvNM&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.currentconecptapps.com/c?x=NeR8Xkg3WmdEkQPUyah9uDg9b8cLvXrbVWObMqdLRHU=&c=k79F5m jbzn9EZ9A2XMljrJLE3Qtzu1pzaSPmRGDj5m8ZxN9pxtWagWiBepUO/bv9Ya6udGT0lNhCa8z n wfXW9hPrF5ldI/pZbEXSXI3N8XSntSUkKPoLC7cIhkj6f&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.stockappssigns.com/c?x=AmSBvs9cbHnQuLbUdQw/DoaBCYTpvgb3yw1ObQDr6wM=&c=sD5uWdxUNKCtbuvfQqb4QCN658rzSlOsJxr12YRvwjbUTiaCoejOwCDOSmHLljFkdp wSpwczVncXzVMiWEKPwcBgQlFVxLhtMzfK1lLKA d2cEy89xgO/FdP AMj5 Y&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.bundlestockbits.com/c?x=cULgZauj9lvIIH5UeGn8VQJTd7voQ6cTFxNwJQPkifQ=&c=rDysPrS P3AjzMbthx SZwIb6Wulc/ywEya9vjZ4w3behwbTzYg4ceonU2WYEQe0QG8N/8FtLD6LhqDqJMoCK3e /5WZE1HhJhphy 5HVXSajpG6lEpQ26QyHupROLaC&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.updatecyclevault.com/c?x=2PXIP6jLHaFKfFWHRo4Tzu5WgqZzw58hC9gpa5vznB0=&c=PfRPbgnp6kWP86Qp105vM3ibdxrNJP2utPNQHZfS867oPvPHBX6mHUFZ2XWyFIyEEiju4eaocYUgafSetw3Zu3/jYmv/j0QUE85KaFRwroUgOPSfo0Qf6ZHjSkhTFanL&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.packageheartfactory.com/c?x=opNo6G F3Cnk2SmZnb9tgpzzNcF46l6B9tWYjZgrc7A=&c=jR9jBHqqgJu/y1HnWMmPu/DPXDvnLImfXKLkjHAb0g1OEhAC2XHVVcNhNdKXpToUpJPtYPZ6jcMNJkjNwKNxS7Epd1y/P0GH8d/FJ32Ob5apc/TQKBEq3epgAERmmazR&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.megaquickdownloads.com/c?x=/mIN1eQVcz/i1YliXbnAYRQ8ZWLFsLwYOFtqvyMbB5I=&c=IPM9JasGXskQUmjax65ml2z5e SJcG4RT/tUl8va5XTzj0bWtlwFcc3FRcX9rs3aINOyHmt9O45xkYpSY EYrSuppGl1m9Kk11xOLyXTh5YYfdbXIcnvddgCOQR81RbN&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.packageheartfactory.com/c?x=6ELCqvUJUbzTTV05YnZFhkWRoGQYXALiKDdUO5/5I6Y=&c=ntURjz0NQgJqFQMrqmmEFze1bjw3HPWBlvQIr6a9ssv15qyKxGWfzGEhyPM8QIgcEKNN 4JsEtMv6Vr 2gKt8Bsphq1wUvlLt4pwil7z50GGUo2G0xSQr93D5ng5 Bbl&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.contentcleanpackage.com/c?x=rN5Lw1yqBXWaRGSiLo0v6W1rl56iHlFMwp7RuBjj5Hc=&c=xOLLphoawmbvPRozitoRG2Xk4mzFcZ1a1HEU9YOFES8mZigFbJvjKEWnE 1yUecWmdvhPc7YT3EdxaD00VMG57iWbRf Sf9B0BQccb95poDDMmmPdf5v k0YfaCUVRhX&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.bundlestockbits.com/c?x=7WodVOOrttc8V yI9IdQt58K1J/z98pgEk1r8WvHBdQ=&c=9OzB1Pq1Q2u4N3oHf1nhrZ10 H nE0pdD/aUeKx UaxzugfZkZbwunH5AXiBOdtf8QIEk3BwAO89haI4ND4y5ElaA33GXSq7SKH T9z5/4tA1 QciBbcbxHPmmhc5Ryf&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.deliverybinariescontent.com/c?x=2XUkSzM1O7KeOyxR4JyDGYSrz5xkIv8W8hTrp3eCNSI=&c=VWchogBmnV1o1qRoKlg5iz8p5reb1xnu8Pt5iZqRk6kj4JK71xNyx/q7Sh9W/K33uFlso1yA4bPSXyMjCP6Eyt3g9KZwKpzByJs2oerPZMmKHoAvjFy5q9ArRdqGynm8&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.townapplicationsmega.com/c?x=IJODMaPaB97QGe627Z40yELHVTStBrLDLSMaiGkP5JU=&c=QQeoATvAznnl8yeHuNcAVTgO7vIVWRo1qdhW8QNCf7jo4/QgeU5vYvlRDnWdu66x4f10KyFemXBXZYYwA41 l oyse1bvQeu32/cgjAwDoY9YlWfQyth3tPR gNESwfA&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.deliverybinariescontent.com/c?x=qHpxyGHSvBPLmfAWGhTJj5u8Jv9tatkcITtzjOktRKc=&c=Qk rFDS8v/fk65fhhpSigiMzuZ4QXRUto9NSPTyQg kGwP3Ae11otaySgeuSXqfRAoPImj8cY9iQ4ENpuGdj GTDE3AIOtWiffi5L SpDSLiHO7N8p u7yXzQ9GYBioK&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.bundleconecptapplications.com/c?x=l ws2WXQlpBcOxUkqn4OKuiBsjDlcVZ79hIF PchG5s=&c=9rEaUwXpcpDRG2at2K9ijwFkp2UOBuCpdg83oPGTlUqpK57QTiGJtgJJzFz8TBD kjr7ZHLkGQ06th6zFZhR3H7LjyZMpGU4hx/6VNGtdJ2 JLpkgjpQUza70hMWhk1z&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.vaultconceptsgift.com/c?x=IT6HA5Jw57rgMM3zj 4WPazybef WAQVVL8jdL4neHU=&c=poBJLvPl6QiHohgtDrb/U33Q2dArvxLtyWmSOkoTukBNq mgb81 Woid7vAzRE6sjvjhgj0itemJyu/x T WaAE0GPFeCf1C4XnpN/jzD0PVVt0sCaasRi9MgPdi3/4w&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.bundlestockbits.com/c?x=Pdvo 0U8 4ZD5LK8Z5yQM3mZnadQrmc TsKVr6iiA/E=&c=QoFhtfezWef3Wc6sOIndLc54fmX27ymtsLfEMwcC8V9wS0WwWYWpemr KYD8sNNkvMBiLFwDf3/txorDTWAdDYak8pf B7r8c1SpGitY9o8Nea4F 3rvOFxr3sVUl 7a&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.towntodaynow.com/c?x=kx8nDZKYApTk6dYWaW7bw5Ou 83vRcgqntCGOuBwtWs=&c=XjJkpmpDEfSKOjWtUDeqd2UzdYd00pe46BxY q3vl88M11hFCjgowPZCxLVKqIbdkQIRQ9t3AjcHipCEuVRfVDvDEY/WAfUHceGIoENH6TUAhqIBvhdiEywxeNjSocP6&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.megaquickdownloads.com/c?x=kKT0FspbmIM9BQuNzxwRjp8qi9W3Un8XItUorHq 0X4=&c=OLPNIMs8pfFEYrhJbiczaAKPuOTJz/WLAqOTVZ52 OxOnwMUeSleOwx9Q2XZZERSWWpauazTeqNbwAGi6vwDtbpIzvn8Yd4iT6ub1QBUl28g2V/gaP f66hn1H8t3suw&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.megaquickdownloads.com/c?x=IYu6J4eRtRU1RSsETr yT6xDFAX0LtQr5D xz H98RA=&c=muW/ 4fqjrIgIAG6qSD6ChSRR QJ7q ql6Bg/kjiyQ 7qZyjKVX89f3fFs1eOeFVK54fQmKniTWG78Wr mn2Mhkwksoyz owCk6J/y/TbQPjeGtWZdFeWZg7OptfvWum&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

Remove adobe-reader-xi-21590-dp.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.