» adobe-reader-xi-21590-dp.exe
Overview
Analysis
File Details
Downloads (15)

adobe-reader-xi-21590-dp.exe

Lite

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application adobe-reader-xi-21590-dp.exe, “Lite Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. With this installer, users are expecting to download Adobe's free Reader but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.

File name:

Publisher:

Mode Beta (Fried Cookie Ltd) (signed and verified)

Product:

Lite

Description:

Lite Setup

MD5:

b8ece6c7caf5c1d15901760a2e680e6d

SHA-1:

d33d50bd466c36551f8bb9116803556a3773ffbc

SHA-256:

fe5611c7bd2056bda8e3574aaea17babee5655490092255feff550770286e621

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

11/25/2024 6:52:49 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.Installer.Installer (M)

16.2.15.20

File size:

944.3 KB (966,936 bytes)

Product version:

4.2.2

Application

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\adobe-reader-xi-21590-dp.exe

Digital Signature

Signed by:

Mode Beta (Fried Cookie Ltd)

Authority:

GlobalSign nv-sa

Valid from:

12/16/2015 2:37:06 PM

Valid to:

7/7/2016 6:06:18 PM

Subject:

CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:dTtBYvtCO6iNum4dvHgNoW+iN6jEvZJCblnxIGX:dBWvL2HgJ+iNFRJwIGX

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file adobe-reader-xi-21590-dp.exe has been seen being distributed by the following 15 URLs.

http://www.laboratorysenddl.com/c?x=teC4Vb JiyfeoHePOU1oIu6rl2lAhdbo4Gq7YKfZJsw=&c=/sGxRVneXCRvtdL7FOx6IOgFiGMU1MI 30XsYGqe6lOELWLWENmR7qNo0WEERQLbNC0kWwdOFg/hszXZEo24JPLiBx0VCo45w8zW7F7eU7IHkazVqRiV1Oj Ofh54uHH&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.laboratorygiftvaults.com/c?x=PAyprxReOMoMrb49jtwsanTnPy3ma8hVff8jnPC5tBQ=&c=vFN/vOnCHlUUnKwpe/FmzMxxNRbseiATh33XeKgSc5Zcf6gdgM0ZfcicLU355isBb5XcI0CaE1njJwWt1RaG22pMflV L4ANumy Y9iAO9GA9EnF7 ZwC4iccoPm NgF&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.contentdlapplication.com/c?x=5d9We5pUvsyHjasyICmpL4dk2pANx16RD Uky8Xa3bc=&c=5Vw1hM9ptLtEWs5oEPsufIvJh8IVnBaGABoXQtb8Fim8Y9me0NDSlEizGBOIaRw/NEIX XY13Ct/ejmCGETFy8LZ1kIEqVMvYT1kzYBNb7SjRU/Vj9a40vJ/NTaxgOoB&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.laboratorysenddl.com/c?x=C A 8Dlew4Crt5dVXOBV7PxlvtvbTApSAEzxH5L671g=&c=FwNomqTSX1Fw6tB2IVBKeEruk1E2K976Q77M4Br6fu/ZZRlsw4OIpz4NjMsuzEVQGOojCNoa L 3ZYkq04tGoBOTJqUAmI1CzWHotSTEOK9Srr4kXdnqI4BgMZ251YXV&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.contentheadtowers.com/c?x=ppxF1wZNaSjV7b6SYiIqk//FZKTAUor2rdOda0HDikc=&c=YG96H K9dE2UPkrRhXLyIDUT JMKBgAaIQSEaONcpen8x7nIAWE1iH/Fe 3 OPeEdBal7SW3C1atodZ/3Tovy9w/zKdzYs8BrFs2cWHVv0Hn8Bkr1cBPddT0SI3zX6uP&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.laboratorygiftvaults.com/c?x=fcFjwb3 X5VdBInVOXwi1XQ6w82g8aHSmhMdqj5bUxU=&c=zQyLpYFvIwT8jTSsZxNvQI1x drw7AjqEZ7vFNoItXblmlBaI8QwjA0AMo /TLaWxZfgfORS/O6W1J uhi5zIeVgqWJo4V5SGO4yXiXl2wB16hQiB9OHemr6nCEBObNJ&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.contentdlapplication.com/c?x=PoFigX UOlmvKljhmEU 0JUaZThqlx ojlR KrTItlk=&c= RcgE1yajBeLKz3N920g gbxa0cwMNnNlOI1L5QnJaX PBc7fFIGCS9 1S5Rgvvz0sXaY5Psn6q7IVRP68Hn7E1IY02Y9MsuhnzF/gWRAhibDA0i4vWWxim br9o5ZPf&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.sharetowerbyte.com/c?x=pU0mfli36kX06g4ZOjLYqnD7YL0VaG4CjNzHVm1NdW0=&c=8XYsVbcLdTUJrD AFQJ2B16Zz0rzlV YDMM15USmNYkV2ZiUQEv5hGk aEDxAfDrD Wzl1ACDH19UoWaKNJzAtjQn lLWRIdynpiiKp8pc8xeykY/hXwoKfSjAJR9oeU&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.laboratorysenddl.com/c?x=Y5yzPlV0LNibPSBhjOu5tHIDPM/o4ytkl6ZC8aZw87M=&c=EpzmJzcqfFso3vYh3XBJl8WcA3Gmq79DGoYoN3frN4/uiSbXXTYEtwGM3y690SdjXA Dr9IVC87jZBnqaucydwmqYu2MHvUY60lcisN7sV Y8NbtKuYQW0uNVPBAbPsY&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.contentdlapplication.com/c?x=GbyGG7u2mXwyUDX6odlz4D2Ri6rOSn7sEQjzed0ozss=&c=BHmiJUti1Qz ETae2/VIfi4lBYokt6O9AckxcmMjzhVFgI4C2O98vadCG2WLEJPv1AMpRkr5Y4 05O/hEKCr8Fsqlju1j/eNwbbOnRwh0k5/hQQov5yn6dCJp7cA9Pl4&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.contentheadtowers.com/c?x=V68uI01NoZn8OjkGuLrQE4Pynd6LiduLLBwBF7ESRbs=&c=oXs6J9DRq0w6HT2SXCm9Zo3ro2LTGbEHOHUkqp02OLwN7B4soxu28EuZYQPMxS2AUDkBnz92XIEt qMVXoh1vuNqWE L/MS/iR Xk2DCmiQi2GtY3sCiB0Vdn6waE2Fv&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.stockcentralcycle.com/c?x=a3p/F G3s4YlNQV3oo9/mkc7i3QQo4k3eO/6kWNvj8s=&c=zZ3FiJhbZ6eDQa sId81 YUp87g9VfvlmQCxH5v9SD693UjFI0Qtd2eQSGTOqITH0eEQTxzgWPIcJsALlqMdiejO/ZUr/bM ifrLVieuooqSCN79IoYl0f6jKFmMgC9j&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.contentheadtowers.com/c?x=Tu1IOnmU pnAdiIfrnXDSH/xTfbRjujvH/5Tci4yTps=&c=UGNh2IBnzJTUxJ67ys/XvE96osy2 2r9siV44dm8KbaSWw DVD3/2La uKWvEFlBGgdMMvbFpDpiXl1RlLX9QZ5UkMz2bzBEKA3n/bgiRzIMv1mrLs/dQz0K90MZ30pI&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.contentheadtowers.com/c?x=FwKWgEbuaGnv02NT81FDYUyd8VYdszRrXBEuKg0D6fU=&c=QbB/agRd/fbQHKnL6BYTWKrH7tlhJ 1SbyqbHbzKDBXQHmlBOseGIwTNsPBTHH1WiacqTV/zNl/C2VzpktBuGA7TteT8hrWQ/B4xV4V/Hwn0AIa5/r16H/h6KlRl85lg&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

http://www.contentdlapplication.com/c?x=umO90pQL5Kn7OLXicgR0/4gk/TEvAPZTYpPzueDm5fU=&c=DTGsSA8tm1FY4eC/CARZ E 1lvFHTC aOSFbO2BTCRdFa/jIYivxGgLsnd0BM2TGMGZjwEJLAuBK2g2h0Pel8tv6SY6tGuxh/QfL3bxsvIYljhXV QOB/IYim8juxLEQ&fallback_url=http://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.00/.../AdbeRdr11000_pl_PL.exe&downloadAs=Adobe-Reader-XI-21590-dp.exe

Remove adobe-reader-xi-21590-dp.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.