allplayer-13217-dp.exe

Kisi

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application allplayer-13217-dp.exe, “Kisi Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Sacip   (signed by Mode Beta (Fried Cookie Ltd))

Product:
Kisi

Description:
Kisi Setup

Version:
3.2.2.4

MD5:
362c318282f3413bf7c8c037d305daef

SHA-1:
76271c6fac160493a55eaa118b2438b6f9371ed0

SHA-256:
97f29a456312b8c596d87b895aa4ea9bb69e371e84a349d84e9642ba4a24ef7a

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/23/2024 3:32:30 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.4.27.15

File size:
952.6 KB (975,504 bytes)

Product version:
4.4.2

Copyright:
File Lite

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\allplayer-13217-dp.exe

Digital Signature
Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 2:37:06 PM

Valid to:
7/7/2016 6:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:SjJz9OiMv1hlYlmHZRY5L5H/9x7NJXH6:SlZMb/5RYRV9h36

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file allplayer-13217-dp.exe has been seen being distributed by the following 43 URLs.

http://www.capitalsoftwaredownload.com/WVl6OTRQVWxyY1hBeWVEUlJXVWhGWjB0bGJHbzBha2RWWm0xSU4xSllNekJHZVdOdWNtZzJlVU4wT1RWTVVWa2xNMFFtWXoxNWExUjRKVEpHVjFGbFFqQnJaVlpPT0ZNMGNHMVZiSFo1Y3paU1JHNVpORmgxT0VOQllVUnJTVGRKZVRGMVJrZEhja2sySlRKR2EzWWxNa0kyWm5aU2NsVnZaMGhEZWt4aWNTVXlSaVV5Um5SWmJDVXlRakl6VVc1bFRVNW5iRXBtVFRCRU1YQlFSRXBwVVdOM2RrbHdXamx1VHlVeVFucGpjRGd6ZWxCbWJWSlhNVTFhT0RoR00wcFNNa1ZOTUdab1FXVnJPRVJEZVVabGFGTndhemRGZUZoWVp5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWjNkM2N1WVd4c2NHeGhlV1Z5TG05eVp5VXlaa1J2ZDI1c2IyRmtKVEptUVV4TVVHeGhlV1Z5VUV3dVpYaGxKbVJ2ZDI1c2IyRmtRWE05UVV4TVVHeGhlV1Z5TFRFek1qRTNMV1J3TG1WNFpRPT0=

http://www.appsfunbyte.com/WVl6OTRQVlJFTVVwUVVqZEpialJxWkRsUlJWaFhWRmxTWVhGVWRUSTFUV3RtTWpFd1VXbG1KVEpHYVRGaFkxVlpNQ1V6UkNaalBWTnhZVTVhUWtrbE1rWlBiMVpOUW1sbFRERnBNRTluVGtaVWJqUklOV3gxU3lVeVFtTkRkamh2YmpaV1NEUllhM0JwY0ROWWVVdHFURlpDWTBNemRqSldOVTFTUm5aRmVVdElRbGs1T1dkVFpUZHlSMjlDYkRacFIyaDJZbXRTVnpoMWRGazJRMkZxT1dacWNVNURVa3hZYjFCRVprOXdlVmc0YmxaSWRrUkZTVVk0Y0hSMk1HaHFURlozYURCVFFWZGxRVTVVVUdaclVtY2xNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5oSlRKbUpUSm1kM2QzTG1Gc2JIQnNZWGxsY2k1dmNtY2xNbVpFYjNkdWJHOWhaQ1V5WmtGTVRGQnNZWGxsY2xCTUxtVjRaU1prYjNkdWJHOWhaRUZ6UFVGTVRGQnNZWGxsY2kweE16SXhOeTFrY0M1bGVHVT0=

http://www.clearguardapplication.com/WVl6OTRQVkZHWmtGUWVHdHphV0Z5T1VWVldWQk9URmx6Y3pORGVUTmpWelZ4ZW5aaVVVUm5kMkpNVnpOYVYwVWxNMFFtWXoxR1NYZHhkVVJEVkVKUk4xbHNVR3h5U2pjbE1rWnJTR2xsVjJKNVppVXlSbE53Y2paWkpUSkNkbmtsTWtaamVWUnNUMjVzWVhvemRXNUlPRFEyUWxVbE1rWmpOSFJpT0dwRloyZExORE5XT1ROeGQyZHdaWE0yTjNGVGJrdzRZbFZoZW10WU5VNW9PV2RJTW5ZMlIyczNPRmhCVVZoSU1FeG5UV3AwY0hWV1RVWXpOVlJxYVVNeU1rWXpRazg1UWs1R09IYzNiRkZFSlRKR01XOU5aV1ZDZEVFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbWQzZDNMbUZzYkhCc1lYbGxjaTV2Y21jbE1tWkViM2R1Ykc5aFpDVXlaa0ZNVEZCc1lYbGxjbEJNTG1WNFpTWmtiM2R1Ykc5aFpFRnpQVUZNVEZCc1lYbGxjaTB4TXpJeE55MWtjQzVsZUdVPQ==

http://www.capitaltoursoftware.com/WVl6OTRQVWxaTlVnNGQwSlFSSFpNV25GeGMxZGlKVEpDVEUwbE1rSWxNa0pIWjNOdlJXWXhkMkZvVVUxd1NXWkhZV3hVT0UwbE0wUW1ZejF3ZUVweGFVWTVlR0Y2UWxCeGFUbEpjVTQ1UldwRWNEWXlVVmh0T0Vnd01Fd3dTVWhzV25SS09TVXlRbUozZDBoSmR6QkVVVXd5WlZsbE1YVmhlbUZrTlVkMFEwaFlWa016UXlVeVFsVnVjbUZWTlVWUFVEa3dWRlVsTWtKR2RVVm1VbFowVGtReUpUSkNRbmRpYkNVeVFqUnRRM05IZFRST1UyUldPVkpyY3pSUmFVWlRhRXN3WjNvMVZsQlhkSFZDYTNOc2RWUnllVXRVVXpkNE5FdDNKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabmQzZHk1aGJHeHdiR0Y1WlhJdWIzSm5KVEptUkc5M2JteHZZV1FsTW1aQlRFeFFiR0Y1WlhKUVRDNWxlR1VtWkc5M2JteHZZV1JCY3oxQlRFeFFiR0Y1WlhJdE1UTXlNVGN0WkhBdVpYaGw=

http://www.clearguardapplication.com/WVl6OTRQVTVvTUZWQk1VSkZNM3B3UlRWcFNEUklSRTFJU0ZwNFlVVkljVU52VXpNeFZsQkRVVU5TVkhWT2NGVWxNMFFtWXoxUmVUUnNaVzg1V0ZSVFMxQmhZVU0zY0hOVVJVMHdVMFk1TnpWUWJHWk1VWEZWVWlVeVFtVjFVVUpDUkUxMmMwbGpUak5XWWpRNFVGWjNjREZUVURaTmNXeFJjMUJ4YURaME9HVXpiakpYTTFKUk9WSkJaR1ZyWXpWWk5UWjNTV042V1c5b01TVXlSbWx0ZVc5U1dtMUVZbkp5VTJSUlVYVklKVEpHUTJ4S1JWWm5OMUJpTVZsNVJYbDRlV1pEU1VwblMxcDRVMDVXTVZoamMzY2xNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5oSlRKbUpUSm1kM2QzTG1Gc2JIQnNZWGxsY2k1dmNtY2xNbVpFYjNkdWJHOWhaQ1V5WmtGTVRGQnNZWGxsY2xCTUxtVjRaU1prYjNkdWJHOWhaRUZ6UFVGTVRGQnNZWGxsY2kweE16SXhOeTFrY0M1bGVHVT0=

http://www.laboratorysafehead.com/WVl6OTRQV2RGSlRKR1JISkRjWGxvYURnM09VTjFPVWMyV1RSVFlVTkZXV3h6U1hCRVRFbE5aVWhwV2podFpqRndheVV6UkNaalBVTnZUV3RIZERCcWJrZElibU5WU2tJelZXTlVSRzVoTlVSWFkyd3lkbFpGUzJKcFVXdE1XazFWVmtSU1F6QjZla3MxVWxKRk5FRnRNVXhwY25Gc1dIZEljMWRYT1dGcGFGbHNjemxOUlhsWVpHOU9iMmxqYURScGIzcEhSRWR0VDJ4WFFWaGtZemc0YjI5NGFuWllaMjFRTjBNNFpHcGxaVk55VGpoaFlYSnNPVFJzU0RoS1EwSTJUV1ExYmpCWVdYaHRhWGN6ZHlVelJDVXpSQ1psUFRBbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0yRWxNbVlsTW1aM2QzY3VZV3hzY0d4aGVXVnlMbTl5WnlVeVprUnZkMjVzYjJGa0pUSm1RVXhNVUd4aGVXVnlVRXd1WlhobEptUnZkMjVzYjJGa1FYTTlRVXhNVUd4aGVXVnlMVEV6TWpFM0xXUndMbVY0WlE9PQ==

http://www.clearguardapplication.com/c?x=b8XJVKG6kTQjHqrf4NL3PNfndatIWKFwwUHkv5yVOCs=&c=VhSII3A9bR9f7AEBDdOZILgGCSZdxyThLMlOuLlynHyRsAVns8xgD2tDbDFF8k6l6pS4AfA/71dGIoIV8Go3Z74lQujLgEv6bqrhaur4l2zG0qaCQu7iKhhrQjXV2nuHWWRKw5G9lq9f/w2vJO6aTgztnu1F80K6Pq9f9hqVzGY=&e=0&fallback_url=http://www.allplayer.org/.../ALLPlayerPL.exe&downloadAs=ALLPlayer-13217-dp.exe

Latest 30 of 43 download URLs

Remove allplayer-13217-dp.exe - Powered by Reason Core Security