home

ark_survival_evolved.exe

Befibir

Morava Group

The application ark_survival_evolved.exe, “Befibir Setup ” by Morava Group has been detected as a potentially unwanted program by 4 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.appscleanflash.com and multiple other hosts.
Publisher:
Kulat   (signed by Morava Group)

Product:
Befibir

Description:
Befibir Setup

MD5:
f1b20f9bef360b69b7201e19b1b6e69b

SHA-1:
541a3fc5838d33b249ba294236f1f04b5b5f7b94

SHA-256:
e5835a93c34015b8ff9d6cb7eafe63494b7c5729a491a957b460e8671036fa08

Scanner detections:
4 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/6/2024 6:24:51 AM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Trojan.InstallCore.1903
9.0.1.05190

ESET NOD32
Win32/InstallCore.AFW potentially unwanted application
8.0.319.0

Reason Heuristics
PUP.InstallCore.ENG (M)
16.4.3.13

VIPRE Antivirus
Threat.4150696
47926

File size:
971 KB (994,352 bytes)

Product version:
2.3

Copyright:
Software Internet

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\ark_survival_evolved.exe

Digital Signature
Signed by:
Morava Group

Authority:
GlobalSign nv-sa

Valid from:
3/7/2016 12:28:01 AM

Valid to:
3/8/2017 12:28:01 AM

Subject:
CN=Morava Group, O=Morava Group, L=Towson, C=US

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121A83F14C1C6D435814D1A4B9EC949DB5C

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:TmdmwFjzyzV8q8viESE6v3auceqLPmaNtz5DyP2jGnyO9:TgPBeRcviE503auceqLug8CGnyS

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9055

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file ark_survival_evolved.exe has been seen being distributed by the following 11 URLs.

http://www.appscleanflash.com/c?x=5u6SHmzFWD0yREZi wDoUOMDh3ChXVBDb1H9knxY0ak=&c=uTP7nYXKVgCTLKtH8W2MB7X3UNj4Pgdi McSLz1uaK9jHW2r50Gg3FeHGJsvnJK12h0uNCL T I3evV/.../&downloadAs=ark_survival_evolved.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=chvrmykjkWBH3GNVrWobyJupn0B reoSqjp5hMHVs78=&c=fLI4ZrMoLj8bGF627SHvfSJAEz4WZiQbOkakODfYsQt2vf0mMdsQ EQoc5BZ4DLSXOtNXTzdofDGdYRqtszCVdVa5s HQRdlXUeC6D37UnLaa1eBv Njvn0aoM jC hMRzTZAYuVtzD8bvYLmchQ9OuFAKBEND 1Gm0Zw2JDrJTazq0kCPhC6KcO71U oOJH&e=0&downloadAs=ark_survival_evolved.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=ilBVQC0/X8Y0ez4y/L0igLTvIKXKWBA17q9K5NkzFpI=&c=ajwb1lydOQQRIS/vm76SFP7XZhbGYkj/.../IFF2Jy6XdNNNyLES7vPBotZnFmoCwA9tt n 8g2AE0qWoYKnezVOvVo QzmSkWBcz5g&e=0&downloadAs=ark_survival_evolved.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=cx0Gm jJzVfLskKcJHZakC8mn5EkPzudWedDablewFU=&c=D/y8N984fTMP9k7w3BZcqF9jPxY3X7hzsWxAQTW2AYiZX9Kdcm7hcHGeI/WTYDTQSfjwb3/Og235ngbor/mKLX/N1HLCCdpd3z2RmdjpHOzeiBj KR34CM9IGYTSDVlkqxL7QEen/k08e7R9QqoF/.../6FyKllKgi36xBxhvrZu0=&e=0&downloadAs=ark_survival_evolved.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=NSqu5PAw65U/w4GFPJ9anPee/n8ctV8lj560RitqWmw=&c=Vpq3vlXA07ft4oSzR0B9k1jWv7jGW3lF3 USKf38 /.../6rG2GlOioWA5MV283Dicz1wgnsRPyi10ZORdSDNCWDiSgpAmoNCTY&downloadAs=ark_survival_evolved.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=hWPEUfsrommNeCesvPieCIfFF7cNWqk0Pgphu1Twf8E=&c=oTKyrAiVy8londXgQoI38663eWYQbhrcAdJZWehhCJ9QOHyv8/0rfiq6KttAblskEd0hziras0mPVOcPW eEX9Is4lwOzEh7YOeLHtusnmJv6i8oB9gCLpq7DAbv/TIWokiWH/gfV7NK/.../GEZe4TDPhn v7Yn1G53GR o3dFpFZy886V6U&e=0&downloadAs=ark_survival_evolved.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=zvGr7M31TKQxzA0bjw4uWYZ8B7szrKDOZSMPRYXf co=&c=iINkLQVsvSj8UXhryBHGvMTNGBfVMSWGDe9e4i2MRvQ1jhdUDZHJUPHGG1HcU0eAeRvrtpTIUi pWT1FAzn OvlRLw0/WiX2fNywA43ju6qaAAbFl/.../JJ8&downloadAs=ark_survival_evolved.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=9qBxsjncUpuZy3s/a2bkS9YIxq44RgIXF2UVQ568Wls=&c=WW63lmjFtNsHcc6daAwvnfBc2YNLuN gbWXw/.../jj1uy69l1FrNNtiZRKaPjAuGXGKQuQri74SzvmaophPsHcsHCqBTIHSSQcY8qDismPKfRTbEAkTBQ6obJAA8QvwB5r8iI3NR7MyPIg4GBv8Jc=&e=0&downloadAs=ark_survival_evolved.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=DswPcO0VOtmxahedUmnLOGRdboWeZNOu0xtltaOwgeo=&c=AFNhuUgUvMBizbuySblZvFbmzJgdxqN5qNPQbZPRNckDan2hXfofzj38rowInL7g2iGTIhaQ3cz8QBbUEFCdOpknlqwo1cN3 7AjYtwfLELrwqAtw 5vEVf21 e/.../E31sWLace0GIUODFAXpp8wiqWJKKs=&e=0&downloadAs=ark_survival_evolved.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=Yi3YSz4wm/QvhjEqjlkgKcp8NBnxhHurFz2NnhdhQU0=&c=jLDFGl4Znc2STZC7QQgyobPsbMuwmwmrOzrZ2407PNApCI5NohI2TmxtYzU3ng36lrrCxhSDWofhSYtyRian91ZCdCGR7TE0SZF0uCI0XTddkfV6mIcdzFP1a989qWnV4PgsLuH5ht9vMwZOK6riQYA/.../nsKiNsOp18=&e=0&downloadAs=ark_survival_evolved.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=iwTK kDteOfsHKvUTkzq1Iog7dyoE1O6PwILKY7Dv0Y=&c=sgj9 WgHdcep1t74K389LDTzVqk F0drHIyrAZxPLyapq6M071/.../5ihHgC1vUld75OcG9YIN7DcdOsGvo5ntFCJX5ULAVIf5fy50F8VURhs&downloadAs=ark_survival_evolved.exe&fallback_url=Fallback URL

Remove ark_survival_evolved.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.