home

apache-openoffice-12754-dp.exe

Getub

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application apache-openoffice-12754-dp.exe, “Getub Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The installer is marketed through download protals and search ads as the free Apache OpenOffice but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Mode Beta (Fried Cookie Ltd)  (signed and verified)

Product:
Getub

Description:
Getub Setup

MD5:
3e523e83a75459620bbc2f0a26ac31c7

SHA-1:
3a313024e115a1b41f1f86479dcf81adb3de24ad

SHA-256:
b48d2cb8bd5d46407183d3229a4ced26dfaefc09e6fcf1890a6d23cf1c603d69

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/15/2024 9:29:56 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.3.1.0

File size:
1.1 MB (1,103,152 bytes)

Product version:
2.0

Copyright:
Application

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\apache-openoffice-12754-dp.exe

Digital Signature
Signed by:
Mode Beta (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 2:37:06 PM

Valid to:
7/7/2016 6:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:6x3+YMvwvU+IujNc1NfKESTyt3RgEmfVtvpU304nZ51GmkLMjoc:6x/MvwvU+IujS1NCESTWmtoE4nJGDC

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file apache-openoffice-12754-dp.exe has been seen being distributed by the following 7 URLs.

http://www.townfilesdownload.com/c?x=rln7ptti18mhgV/UVnhHyq/xsnD18CLG/O wkpuDYlc=&c=BVIDhqbwdskJnJX2fAPmrWqFLUrIM7OnDHrek31CA3LOlw2IzZBV5AqQ82y9ufqyCV8YsJySjW3cx/8W2ohmi4mQFuelum3Zcdg6gk053C/qTATlL8XufvAFu9ne0GTs&fallback_url=http://storage.dobreprogramy.pl/.../Apache_OpenOffice_4.1.2_Win_x86_install_pl.exe&downloadAs=Apache-OpenOffice-12754-dp.exe

http://www.dlcentertower.com/c?x=CEQuB5 ySypD1PWPDXPP1l6M06vdiLMcwxZnxlbcx/c=&c=pdcJGNduviZ0pm7 Gw1r c ebpHP Abir1AIVm8hrEAjsOD35QFUJzlbL3JLwn9GD0WjoiB0zdPp40pis9E4as3Ee SbXIjIu2pVcUCib8wZMG9icAmwgg6NvI9Y9T0u&fallback_url=http://storage.dobreprogramy.pl/.../Apache_OpenOffice_4.1.2_Win_x86_install_pl.exe&downloadAs=Apache-OpenOffice-12754-dp.exe

http://www.presentsafetown.com/c?x=f1g9jFd8mRYJdocxnJCvaftoNoQRvDyCq2XQRY1J7Qk=&c=6m7CvR3JJBlQzHF AcqGIa7/bEnqkP8k6zIXlFrtmajU6YfP8PAvcrB6P890yPT0Zbh0AXbAArsZ0pPg/4kgaj58RQsQ1gpudheEMAPGdKMO3ZbyN96BHUi2Uq2FkjmC&fallback_url=http://storage.dobreprogramy.pl/.../Apache_OpenOffice_4.1.2_Win_x86_install_pl.exe&downloadAs=Apache-OpenOffice-12754-dp.exe

http://www.giftcontenttown.com/c?x=IEWUognsAiAGZuXbHBUI42xZ1IkD6AmMrX8v1c8f1bg=&c=EJhgnFys4wAmUYHXqek6OPXlynaaDlawp/N85D0W02vPPuGHp1gF5Q6iMLcUYKmpsULzJdDjn4Yc8HKaJDS3oxZ6XcCMyYfzDiv2y2js/1v8PkTzKcIdi/ MH730SWpG&fallback_url=http://storage.dobreprogramy.pl/.../Apache_OpenOffice_4.1.2_Win_x86_install_pl.exe&downloadAs=Apache-OpenOffice-12754-dp.exe

http://www.dlcentertower.com/c?x=9uKq1IkwrTrFCvCLfjJeKwVLZJsl6sJYXIpmUHTRm U=&c=WdcNMR8GnkoFvUWfZlpHmbbKx9Ztx 1wZ1daCfgJgW4eE35/7XilVTBinVgjQ7Sy3ifpmQbiolaiHVeTDumnUfiUaE6Kxr5TMn0yfz32xm7yVYhS3/Klh8Tx56kr8I99&fallback_url=http://storage.dobreprogramy.pl/.../Apache_OpenOffice_4.1.2_Win_x86_install_pl.exe&downloadAs=Apache-OpenOffice-12754-dp.exe

http://www.giftcontenttown.com/c?x=xuO2A Taj60Q4eh moCb3e9C yK9efp6N7l46xuAMEU=&c=RPSchlT/MXWDQ4vN3aBixWb4k9Plh2PjdNTH1YDIMGU6DpBBvvsWWtY1W9C2nBQwvIyAcDmgcT2JEyNiAk 0xTWG0xb2hCz1QwnYeVMw5KQ5hSnxIGVJZODRiBJlWgfg&fallback_url=http://storage.dobreprogramy.pl/.../Apache_OpenOffice_4.1.2_Win_x86_install_pl.exe&downloadAs=Apache-OpenOffice-12754-dp.exe

http://www.vaultfarmbits.com/c?x=kf iua1X1CRrRyMU9XSEA7MXQzuK9PIcVhI UCEAECs=&c=j6WxWP0ctzsJcHpivv263CF 5ohgc72eUXVCTLocsaRVFz2Vi5aPxLZZy6EmeEb1ioch7DFOGAwfye7d6MCFmEyHyG9D7RSwFAvg 9f5MN 8T6sD3RiEa lIO3rIaM 8&fallback_url=http://storage.dobreprogramy.pl/.../Apache_OpenOffice_4.1.2_Win_x86_install_pl.exe&downloadAs=Apache-OpenOffice-12754-dp.exe

Remove apache-openoffice-12754-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.