home

ares-12480-dp.exe

web

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application ares-12480-dp.exe, “web Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Internet Program   (signed by Mode Beta (Fried Cookie Ltd))

Product:
web

Description:
web Setup

Version:
2.2.3.1

MD5:
0eb003f56700c40fdbd4d3c6646b5f1a

SHA-1:
1b2208047ac4d0033d4b66edbd60a3f3fdddd066

SHA-256:
ff803cedd6e10b169e07f65de1b7aa49eab2bb99b4050e75e7c4af789d423f77

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/26/2024 5:48:22 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.2.3.0

File size:
945.5 KB (968,184 bytes)

Product version:
1.0

Copyright:
Installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\ares-12480-dp.exe

Digital Signature
Signed by:
Mode Beta (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 2:37:06 PM

Valid to:
7/7/2016 6:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:nfTpRTDleJhejpMM9xkEfKuwBOioow6zXqOImo9GPP9DanXoGM/5pvAyVyNHc/7H:nfTL/ZxfK1OioQyGPVDGevALh/8FlCh

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file ares-12480-dp.exe has been seen being distributed by the following 8 URLs.

http://www.safecapitaldownloads.com/c?x=/q0Q7cXAFVJPIm6cEJ/f1QQKeKzg1X9IYfEuU7mdqW0=&c=LaK0T5DGKL6ib3uAVWQQVIHvTH93Qvcvl1Giaqjw6wwwLF2z3/zHSGk6wlB9mQAWrvm8vh1hXVww400N0juOTen5yL4f E80ZxC2iGt93C4oX9OkZxFUJj4kS8oRJ2ZJ&fallback_url=http://vorboss.dl.sourceforge.net/project/aresgalaxy/aresgalaxy/.../aresregular238_installer.exe&downloadAs=Ares-12480-dp.exe

http://www.todaybundledelivery.com/c?x=LVWOccvfbG1AYWH9Kor1VvwklnnAH3cHY7Gn5 tJL9Y=&c=uZ4ojahZWCDziaKq 7mlMOySgKCmkYorSirP00zG 5l4t6gZshJEPx9s/X0VBEKHfv2teF6ldqZOX6Ood8jZITEK cUTylxl9IcMaXSHY7hyL92c4UcglxHaldnCDgQ3&fallback_url=http://vorboss.dl.sourceforge.net/project/aresgalaxy/aresgalaxy/.../aresregular238_installer.exe&downloadAs=Ares-12480-dp.exe

http://www.safecapitaldownloads.com/c?x=SaUga7uySUEilxgkmQuvo wu4WLw8EICAzFUyvrYQns=&c=ogFt/H/3rAtDbU1ijq/ Ui3 9mEc9iyEvsKsIOLIlG9yxjICRtVfdwe 8 odiMA95Vbjuv4OBo2O5Sj1fV8 ycb8O8a21IysViET6LbpaitzywMlEk2vUcInuTm30nsQ&fallback_url=http://vorboss.dl.sourceforge.net/project/aresgalaxy/aresgalaxy/.../aresregular238_installer.exe&downloadAs=Ares-12480-dp.exe

http://www.headsoftwarebody.com/c?x=46Seph 8BRn0mTYH TJO3pJdmrZsc/ G6hBO ZUTiio=&c=T/pBk9oZjbXsnAhm5dRg Ug4tUYaWmy49ryJDr3mOHxAPxOF1 NCFeH8Y7/jacv8950aQpZG3Nl3BhrfPPLAM5zFizMuXfCW7kvYtw7gnx0zmDU/YAdbBgEuwfl1McMA&fallback_url=http://vorboss.dl.sourceforge.net/project/aresgalaxy/aresgalaxy/.../aresregular238_installer.exe&downloadAs=Ares-12480-dp.exe

http://www.downloadstowersupdate.com/c?x=KfnLlzGxhfb03y9K4gA2VkMZ8qgy8bnxS1e1idbQzrE=&c=ZogTjkPjrRFSLAK3rgt8Oc8mN ZSeXsn7NeoTE4be2y/L7yi d7cAz/Sy3Xgsm5OSTZUTWSu0bq/ttlacihEuxcZTB/GSfEatD5HoEO/ikl6Tj4QItdjttTh BNgvcBy&fallback_url=http://vorboss.dl.sourceforge.net/project/aresgalaxy/aresgalaxy/.../aresregular238_installer.exe&downloadAs=Ares-12480-dp.exe

http://www.headsoftwarebody.com/c?x=aoowF2CmCLwEV3q4e7X4PIgnTp5XiSBt3ab0bbKqPy8=&c=tlpedggxaIXjioRveTEWbN6vDEqnEXt7tTQKpSS1j4urxjwDquIj1Ppx0xfp8H6V2PQ6zh06iQoWlMXvLaKKAsJLYB08kI2wsWDRO lad8aRvV657XzMr4jwe68bKoVJ&fallback_url=http://vorboss.dl.sourceforge.net/project/aresgalaxy/aresgalaxy/.../aresregular238_installer.exe&downloadAs=Ares-12480-dp.exe

http://www.todaybundledelivery.com/c?x=aNkQL896kh5mBAbrV1wz8HXlqW3ZvsFKUqhvGHWWb0I=&c=DifaO2LvTu3pqo1MeMTdGHOmgcv20tXzbQuheDX/bl2MoQXd7bZs6bWhiHc5CYjBihNoDQvM2AVST3 1nfF6ApTbFDUjCabN70862BPPPWeRMwakAid/nbZfEzUPoxUx&fallback_url=http://vorboss.dl.sourceforge.net/project/aresgalaxy/aresgalaxy/.../aresregular238_installer.exe&downloadAs=Ares-12480-dp.exe

http://www.headsoftwarebody.com/c?x=dLxdnOw/1eseK1woLq4CNhEFhuGL /5P4w/EOoKEfxg=&c=sz1mEXLspdzwyPLi0XrCUF3bsXJ52flm7bUm2qjMB0JeaCwxakdjzd8Y85237Mi7 Xb7PLitkWXXIZ0bVJBrsCO00kQ6dVezkQGGzguZiMaIR5VCZCOw9YoDs6cw M6Z&fallback_url=http://vorboss.dl.sourceforge.net/project/aresgalaxy/aresgalaxy/.../aresregular238_installer.exe&downloadAs=Ares-12480-dp.exe

Remove ares-12480-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.