home

apache-openoffice-12754-dp.exe

Lite

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application apache-openoffice-12754-dp.exe, “Lite Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. With this installer, users are expecting to download the free Apache OpenOffice but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Mode Beta (Fried Cookie Ltd)  (signed and verified)

Product:
Lite

Description:
Lite Setup

MD5:
391350a5fc78bd630263acde511b64a9

SHA-1:
03b24e7500f65ff50ff88d1fb9d9d3f47a9d6d9d

SHA-256:
8633bfd3fa7feb86689b7783180bd4c568b0d96a4548b1efd2495afd527025ce

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/26/2024 4:10:06 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.2.15.22

File size:
944.3 KB (966,936 bytes)

Product version:
4.2.2

Copyright:
Application

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\apache-openoffice-12754-dp.exe

Digital Signature
Signed by:
Mode Beta (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 2:37:06 PM

Valid to:
7/7/2016 6:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:ITtBYvtCO6iNum4dvHgNoW+iN6jEvZJCblnxIGX:IBWvL2HgJ+iNFRJwIGX

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file apache-openoffice-12754-dp.exe has been seen being distributed by the following 9 URLs.

http://www.laboratorygiftvaults.com/c?x=PpLuJZXBBqe1y njYTMzA4YMj7Ii1LrWH2yv5g nxcs=&c=FtjKZOnjn9Zl020X4VSPdAgPrEzcRBUJ C6ax974XRY1E9NZ2/OmAXuSNJpMMv70OcTGG36fCmEmGUQcSz/8YA025g/BzqDQaZFscdj gIAdA/oQv7n PKga/nx4ePpa&fallback_url=http://storage.dobreprogramy.pl/.../Apache_OpenOffice_4.1.2_Win_x86_install_pl.exe&downloadAs=Apache-OpenOffice-12754-dp.exe

http://www.appranchsoftware.com/c?x=F6oHBdh h1Cx7GaDcyhT9rzGiH5cTxenuT8Zz87XV7E=&c=YWTTqGGYlZGAUPN4rJ71q3gtb1yAMYlSjP8Z lKfGc3UmQQmat3hDahhN87ONzH9oEKiVQZGC5wIAj4r dY2Pn3dmKOQ788s6 NU7aUnR37NzuWWbrs1p8eDdc7L2X60&fallback_url=http://storage.dobreprogramy.pl/.../Apache_OpenOffice_4.1.2_Win_x86_install_pl.exe&downloadAs=Apache-OpenOffice-12754-dp.exe

http://www.contentheadtowers.com/c?x=7G728GMNtVzD0tV7bYSEyGu8 7WabV3JEo3 L 3U1j0=&c=8J1sD2LFgPhMudm2Jb9DMWWnpF45K3AGXkl2JRGPLta9iT8fG4K1e7iYkzzZTiqubTpUclRXihW Ss7Z5IYhQE3oQ4ST0s366Pso3p/87R67djCs6 2wtthcGAmIyuAf&fallback_url=http://storage.dobreprogramy.pl/.../Apache_OpenOffice_4.1.2_Win_x86_install_pl.exe&downloadAs=Apache-OpenOffice-12754-dp.exe

http://www.bodytowerfun.com/c?x=nRU1ZUd1EsfW/eNVz5R8TR2IL/YWIhq1J5 3BvwhUww=&c=ygdvaw1wInRJnZROv6l/8LYGeBHMC wxsFZNslwfdBrp2XV1bkeaVrr9Yhlbg2U60xB2O0yMudu9macgSd2anM0gyw5sZ6F8la/7rI0kpeZhW1PuincuaWu6TzqRgW3t&fallback_url=http://storage.dobreprogramy.pl/.../Apache_OpenOffice_4.1.2_Win_x86_install_pl.exe&downloadAs=Apache-OpenOffice-12754-dp.exe

http://www.funchucklecycle.com/c?x=UpFNHzOyluOnBP5xOrTAjEnnZGcIAwUmOCHNbG PtfM=&c=cxt2sSbTUlqmcDk7hXLmTMur0gUW5hMnfRUEdclb7aL8RqXXhv3sS1aB2LuRTV7Aw1Lf9KBxNIAcdoKYSRjfJyHnnIuprU4CASD4ZlFRpke1GropUq3xreq/0xgKaPBC&fallback_url=http://storage.dobreprogramy.pl/.../Apache_OpenOffice_4.1.2_Win_x86_install_pl.exe&downloadAs=Apache-OpenOffice-12754-dp.exe

http://www.laboratorysenddl.com/c?x=wgUCe27a1YopJpvnxXUPyNiAAjggFoB7RpwUqCeB1Ys=&c=251VCcWstFUDi2hW/JMEwJ/Cu02P2xQhlKkNiEYvqXnDUvlXfefxdU0QFX7L8q8q/K5As5WkX6mptQxWoQGLVGBJwsWySnDlGzjl6EJYQk86IBGIrtItwlAxcQgq8hHR&fallback_url=http://storage.dobreprogramy.pl/.../Apache_OpenOffice_4.1.2_Win_x86_install_pl.exe&downloadAs=Apache-OpenOffice-12754-dp.exe

http://www.laboratorysenddl.com/c?x=s6x3Oaw420ZB4CozYaaz7p gZZQbbbnHjU0mj9XhyNk=&c=NzzM5XUxa5VH8mXDUinUCI2gr n5ILcykFuJME4WIFoXO mz FHTwfu51H0dldCZ2lMkzvqP XT/Oy3aCFeD/zC6rEsu6qMIeL29UF9JrbqOuxCAzBI7TnHWrLkakpIB&fallback_url=http://storage.dobreprogramy.pl/.../Apache_OpenOffice_4.1.2_Win_x86_install_pl.exe&downloadAs=Apache-OpenOffice-12754-dp.exe

http://www.contentdlapplication.com/c?x=3WE6ZlLShHtMo96Bw8P53CdCSs9gERU2CeYeSXyxlhE=&c=KS65XjwxZvAi7afEYl9qIUUuOQW8 338AL/BUsKdtKWxSCTVe1f9bCpVIrLtRVCJIMcvqoh2uioIK6uiff2P9tgIiO2ig5kDDC5YcbvPb1084etItc2VnuiPBjeJgZP9&fallback_url=http://storage.dobreprogramy.pl/.../Apache_OpenOffice_4.1.2_Win_x86_install_pl.exe&downloadAs=Apache-OpenOffice-12754-dp.exe

http://www.contentdlapplication.com/c?x=BtPkGRJaTUr/SVk3I9QAEVDkijnMg9eSpLzXnvOx4qk=&c=V7ERGTWRqsThqc hdigzcdRLcuCacPJmQVKshEhYR5uCgQJgw3xNfK4Xkxpkj3YTm/zzbVav6pPBqMHKvE8g7CzOYVaEPgv1BdSRCzmt85NRtMvE9cJ3Y3e7VwdEBt8n&fallback_url=http://storage.dobreprogramy.pl/.../Apache_OpenOffice_4.1.2_Win_x86_install_pl.exe&downloadAs=Apache-OpenOffice-12754-dp.exe

Remove apache-openoffice-12754-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.