ashampoo-burning-studio-12487-dp.exe

Kisi

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application ashampoo-burning-studio-12487-dp.exe, “Kisi Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Sacip   (signed by Mode Beta (Fried Cookie Ltd))

Product:
Kisi

Description:
Kisi Setup

Version:
3.2.2.4

MD5:
7d7cc4d8e452e976173c1342200f4b7a

SHA-1:
46d5d730364dbdd7f10d5aa75cd16649f31bde40

SHA-256:
cbf4ec529c931e2e52429b5e003d296a6036ca87cfe442b30b59e8ba4e6af0db

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/26/2024 1:25:40 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.4.21.20

File size:
952.6 KB (975,504 bytes)

Product version:
4.4.2

Copyright:
File Lite

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\ashampoo-burning-studio-12487-dp.exe

Digital Signature
Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 2:37:06 PM

Valid to:
7/7/2016 6:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:+jJz9OiMv1hlYlmHZRY5L5H/9x7NJXH6:+lZMb/5RYRV9h36

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file ashampoo-burning-studio-12487-dp.exe has been seen being distributed by the following 38 URLs.

http://www.appsfunbyte.com/WVl6OTRQVUZOYmpKaVZYbGFTVWwyVlZsUmRraEtObGR6TTNwaVluazFTWEZVZDBoRU9GQkdKVEpHWVRKRU5uRnhRU1V6UkNaalBVeHBkemRIT0VKVVEyMGxNa0pYVERGdVZ5VXlSbk41ZGpkdlEyVkVXbFJIY2s5VFNFMUpSSE5JVjI0d2NIRm9jV0ZNYTB4WU1rTm9NMlZvV2lVeVFsQnRjbTF5TVZsWFlUTWxNa0p0UTJkUmVISkZWWEZrVUZaV1dtcFZZbXRCU1Vrd1ZVTkhjRWxqWW01NE5tUnVTemhCVFZnbE1rSmpaM1J6VG1aa1VrVnlSRTVNTlZCbE5WZG1UMDV3VWxOV1VqTnpRMFJqSlRKQ056VmtiRmhRYWtsWVp5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQnpKVE5oSlRKbUpUSm1ZMlJ1TVM1aGMyaGhiWEJ2Ynk1dVpYUWxNbVp3ZFdKc2FXTWxNbVo0Wlc0bE1tWTBOakV3SlRKbVlYTm9ZVzF3YjI5ZlluVnlibWx1WjE5emRIVmthVzlmTWpBeE5sOHlNakF6T1M1bGVHVW1aRzkzYm14dllXUkJjejFCYzJoaGJYQnZieTFDZFhKdWFXNW5MVk4wZFdScGJ5MHhNalE0Tnkxa2NDNWxlR1U9

http://www.capitaltoursoftware.com/c?x=r2/oYORckuf08x1BoPSxTKY6weNSXDChAe7ZYXq72E0=&c=6J8KnufDSJdn92 CNnwmrgtQYjmGlJSSnQYgazXVlpOhflzZR27Rlwb/r9g8m1IncL9BOrfr5zR/wWIO7aoWoCE4eauDgA4ck4k7cHL/P3mLPCd5uOJW/YMUzFJN0Rr6mkHSENy2H1da mhAqQ2PqTM2WyApsj6MFOAQ8lX7BxZyaxjD keI4sn/fs3Z22oD&e=0&fallback_url=https://cdn1.ashampoo.net/public/xen/.../ashampoo_burning_studio_2016_22039.exe&downloadAs=Ashampoo-Burning-Studio-12487-dp.exe

http://www.cycleupdateguard.com/WVl6OTRQWGg2VlRCMFNIbFFXRXRZVVU0M1RqVmplak5FU1UxRVl5VXlRbGhpUkVkUUpUSkNjM1ZvVkc5V00wSjRaM0F3SlRORUptTTlUekZuYldNeVlYZExlVlptYkd0a2NYazNjamxCWmpkbGVYVWxNa1pOZHlVeVJsZzBlR05rZEVaSmExcHVVRzVYV21OWE1ISXlKVEpDVFRSNU16WnZTMWhUYkVkdWFVaGplbmhzV21SaU1YWWxNa1pLYlU1VllrczFNRTlXTjNsMFprSmhTSEF6TW5Gb1JUZFhkbEJaV1c5TEpUSkdWMW8yU0VZNWFXbFVkbWxsZDNoUGNqSk5PRGcxVFRScFlVdGlhV2RJU2pKalNsa2xNa1k0VEdab1FVdDNKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjSE1sTTJFbE1tWWxNbVpqWkc0eExtRnphR0Z0Y0c5dkxtNWxkQ1V5Wm5CMVlteHBZeVV5Wm5obGJpVXlaalEyTVRBbE1tWmhjMmhoYlhCdmIxOWlkWEp1YVc1blgzTjBkV1JwYjE4eU1ERTJYekl5TURNNUxtVjRaU1prYjNkdWJHOWhaRUZ6UFVGemFHRnRjRzl2TFVKMWNtNXBibWN0VTNSMVpHbHZMVEV5TkRnM0xXUndMbVY0WlE9PQ==

http://www.cycleupdateguard.com/WVl6OTRQV3RXZEZCcmJsSWxNa0pGZWpkT1pWcG1UVFZxY0VOckpUSkNiVk5yWWlVeVFqTXdNR04wZVdNbE1rWlpkbUZOYW1WMlFTVXpSQ1pqUFhCd2JrbHNNVk50ZURWME1raFBSMUpvZDJWVVNuSlNUbGhEWTJ0Vk5qQkhUVzFYTVdWMVJFNWpTbVF5UW5GYVpGcG5NRmRTY2psdVNDVXlSbFpRYWpGR1dUZHNObHBRWkhoeGFsQlFja2xFVDFObk9VeFBSbUpETTNZMVprcG1ORkZXSlRKR1UyeEdOR3hwVUVVMlRXcExRMk5NVkVaNU5Vd3dlV1JZZDJjM1pHeFFTbEpWZDFkM2RubENjMVpDTVZoVGNucFVWekZwVkhjbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd2N5VXpZU1V5WmlVeVptTmtiakV1WVhOb1lXMXdiMjh1Ym1WMEpUSm1jSFZpYkdsakpUSm1lR1Z1SlRKbU5EWXhNQ1V5Wm1GemFHRnRjRzl2WDJKMWNtNXBibWRmYzNSMVpHbHZYekl3TVRaZk1qSXdNemt1WlhobEptUnZkMjVzYjJGa1FYTTlRWE5vWVcxd2IyOHRRblZ5Ym1sdVp5MVRkSFZrYVc4dE1USTBPRGN0WkhBdVpYaGw=

Latest 30 of 38 download URLs

Remove ashampoo-burning-studio-12487-dp.exe - Powered by Reason Core Security