home

c.exe

Tipo

SetupSpeedy (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application c.exe, “Tipo Setup ” by SetupSpeedy (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Pabete   (signed by SetupSpeedy (Fried Cookie Ltd))

Product:
Tipo

Description:
Tipo Setup

Version:
3.7.1.5

MD5:
261b3e4c5dde2c308af7c683ebbe6479

SHA-1:
24add94c0d9a49018d2674c5781feecc611f8f79

SHA-256:
05a750c20cb6e0ae9cef85c7563eec843b06eef0495bc4178cf613a4613352b5

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/6/2024 5:43:22 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.4.14.18

File size:
952.6 KB (975,504 bytes)

Product version:
5.0

Copyright:
Lite Stub

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\c.exe

Digital Signature
Signed by:
SetupSpeedy (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 5:09:36 AM

Valid to:
6/8/2016 8:12:50 AM

Subject:
CN=SetupSpeedy (Fried Cookie Ltd), O=SetupSpeedy (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121EF8B655959B1CFE34F05FAFC8D598305

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:6AWFaX8929zr/aKGFkrkiWHdjogCH2kebsIusDXozq3mMX:6J0XR9JEak1y2jbs+VW6

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9307

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file c.exe has been seen being distributed by the following 20 URLs.

http://www.towncyclesigns.com/c?x= SwZuPQ5znPaEVYfCJfToUp4aUF0MQnLDVD4bn1riTI=&c=DvIWB110yJC 2TsBFE47Rw6sd6d/5mqbahCfvZQwzifYg76znRG5Phs3UKezDUXcaQC4/wBoIcvlVh4pGJl bCiS5GqtEnzN0uzSCQe7MM35wschcAmMAl8l4aS 8N3&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.repositoryuniversegift.com/c?x=tXmUgz5/xxi/X8u0Yu3xbG/HNkNtVAziHHkrkuvfyc4=&c=b9bRjpYMN2ilKXPzINJ2vC6ILqANAu yuUDEYX9W7yax2b6gLREFCk NsHlBkZPLpODttx6hPk1mlC5qn4OZNXfEoI1PMtdwXjLg p6bBt9nMbe7aAROy /pQ/K2P20n&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.applicationsbulkuniverse.com/c?x=mq5f4MlKAyhzRrR4Yh0kQntZhaOp OAPoUqMyX6btZ0=&c=aICpWg2M Uy0Kjdji367GhtqQ7MTRm BWEXKoxBfWBF8nppeT4P2qFkvHQD5zGJ0ApMMqjw4H9hIKblvA5bEMIBDF6takWr22BFldHDuptdmr27WcImQdcYJxgNP1AV7&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.towncyclesigns.com/c?x=jE4hsV8rrTfWAXkAdvUPM RccTVRKBbgQ95 Qo adVQ=&c=jU 5Ny4bxKIUSfZFQOJq4lYca8PFhJYJmHkyv0NBd7 FEnuy4qrr/uepyPt9gNW0JGq38gqv/sfWBDDYdhqCl82/22hjW2ghn9H31L7akZtmdunJDiNMwHy2PC4YnpWZ&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.contentdeliveryfactory.com/c?x=HvueMOjnAUBjRqq/aVzA48jfWOsUPNO6vqHxcAl 8Cg=&c=coP1DmzukieJPHcxOeYN7NkFE8T5U urg8LVStlqm31uiA2KdGoW9HGRNG0ULnC0YfjTkDUhEnBs F6yAJGbkSVna7SI6AI9PcztORfulkv2GRjGZCtonk8HQ8vTMvGm&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.applicationsbulkuniverse.com/c?x=DDDOYghFrmYcayM3cMzgC7vNgKJl/vOB3eWokuSJXOA=&c=DtCOOx/j0PNC6yjb5D7gpdlM Igo6iz/Ls5CFtE22EKwSDgPsvONb5q65WbXJLOzQlsoqPDfuWz/r W5e5odROjH/uytaS89diQSpBMz994Hl7lWt DDljKF027S7zTE&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.towncyclesigns.com/c?x=qXyqpghRDS31deDL/lSd3cDtNZoPDgvthEY6S8u34Lc=&c=ysvltd5RKM0pYp7lMfNgLemw965vDC5DArhjOozxk6nXQinqNlVCyIRh0s07Mqu2mW2MUsdH5UnM4Ks 9x77PLJiGW0KF Ik60XE4NlSjvv2sDPNQDa4Jw6N39iSZeD7&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.repositoryuniversegift.com/c?x=0hVoIGY6l4If7BBQMTW8RUW7c72BsdzJFd Cg6bNeiY=&c=tb76B9DldKXRZD joN0liIQUxDLqfV20M3zPNyr xHXdKAPKHIz4H 1GB5VlPCEVz6PqEwxooHf56/QXAPn NozyE7G/jZ0FUJECcns6eZu 4cJ/DhZlpun5Y2LMBcMF&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.towncyclesigns.com/c?x=SSBrJ5t/7Gv4RhGo8RXiqHY3yA3VhYEkeBiMt3S2CqA=&c=mN817lYMOnh34j7Qkp3ZrlB2oG758mKH09M W2hgchB5XIvz0jquJABKPZ0nobw80BqCv7c2yxEqEr/0Sv1hoyRXlUNcu/fGIcglKmG8WvkvXaZRl11EIpGEpGVBfFaR&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.towncyclesigns.com/c?x=tjnpsIJ3ylwZEc1W19jxIc8Z6uaa8FrGH4nVRX8Puzk=&c=iSj2yrF7C88tHxM85ncHQ5V598Xu0LD BKDPCRw7dXM/y6pKMBVF/5scZbxfUykIcSyS SfP2tbx2iLlnTPmwVfZi2wl/K96JdhCVraovfJFc5w/uts6HT3/OkUjY5tR&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.contentdeliveryfactory.com/c?x=WoFNkD443oaD9pdxTOaMluXXkHxf jXh89MLbxv9aFo=&c=vLdj6GD0hIQME6mr9mFBGyc8q/2u8oPi3RW1h8ilwaYLARgnbuEH7GaKLpN2KFkGCEOTREAHGzl1RC6DIysgZcngccjvDh4BfTJDdFrHHRbhxqcbhALhc4bvcZbRRaAE&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.towncyclesigns.com/c?x=JdqvHLNdXyJbVzeVrfartJUva7HRzxkyQWszvuu7 Hg=&c=T1Z2dmM/1bMg65aLvWH9QSYkLjRDt8/cV5ADNFMYecPRYeXtnhM RL0JZXn9AI7bh5BpQzlksywJ 314A9zUMMEnKN/NuM3r/IoB3vbbCp 1hyCl3Rl7VOJ4/ThM/18z&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.contentdeliveryfactory.com/c?x=pvO4rKvf1/S0AI8cooIUY0xrqDoNSG2SaD5vn4CR0n8=&c=0TcGhX 1goahdMH31fnEoE0VqYAdOVgI8umUuG/rThG m8AfuCc4TFv6ms/YMoX4Dnj81Ai8YSaoTxRcnRjKpkne/RLWb7du2bA1Aib21IGghyVkMhaa 8z8sqmMPKj&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.conecptquickrepository.com/c?x=PHsKCHjprn2VhsHaF hvPblt3iN4RI/eooYMc6kAko=&c=DGw6GDzfalgj/RE72 TX955nHtqP/L0EaEHhui/wiLOlza2xWKQ2NWI8XX5gWX6LozVSyHssUV7oXDEXg/GUye1t263Zf4OxuuIJbXYaQ1HV65XqEWYC5ZAQ6V1Q4P2W&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.sendcurrentbundle.com/c?x=XLbGWndu3pJbCvpONSJycuwt5Mz7Grej7a2TJPfi6Xc=&c=7qssOoyZ/Wv0n7h98/ddThKoIgnlB7ZqMfCp YqJW2t4i4n/gf44zAYrna5FYx52qptRxfjoC1UiSH IzW7yE7l/V9FxNYL2Cpg0yeeoSFopKGZP TqxHIruzoa mfhd&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.contentdeliveryfactory.com/c?x=Ve3uN0Vq2EqVdprGJlJSjRJv4zAwQNZFTPO7t1WcKFY=&c=qeZeRI/ufGwU0uo5kYsgGLQq5y8WtLKbI OaDxCd06Sm7fNvB/rlvxLFmtBAKx7kWrTcUv wXPUmJ CO5LCJPqUE UpJ2QW9aP5mHCQrBjApsxfF7H9AkCX9SU9ljJrN&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.quicktowndl.com/c?x=NfJiKyp7b6136hCdmW3dNKvGHe1kIw2bhitxCWmN9yU=&c=/XWEt6uQ7VJG8/nZfgntKv05G7k7s9YWHrHh04HijG3miaU2392icrGG2VbTHiSGEgrKLvd8D/zkvnyiY5SqvBcQ2VxKBhpjWtTiNRzvnJdYPYktGRysqV3HC2ZBVg8v&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.applicationsbulkuniverse.com/c?x=iHc3nYVyAYWQWye9LNt1hSppPGEKMYT1bq11yUkorkU=&c=KYRL0tnLl/f2OJLU3Sv9gpnlGGED99EixY3Lpgo wb7mtiDq3/1UO131x9Db27 jE9agfxyXs1AUGJi7BAln/pLKnKezunvhlI6Y8cgImgmvgX4ET6HVRAvl4NGlxkdS&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.conecptquickrepository.com/c?x=U8YukioZYWRQRwTDOBJLEkLazYY66gYO91kPvEpTEgw=&c=wNtTB4jWP6XK7MLr5Qabji9r2p9PAZ1XyuRRViTM99V/8/MwyPbNB/OtYlqvvHxKmst5awgXc6dtUYvovVLSTD91sdyzm1GaEJUL8lO8OcqqOa9gxaKTz5t5x2CILfS1&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.repositoryuniversegift.com/c?x=5ObocW8glm7NlyFK8ZDYfqyW1IyJ4ewT824rZzYFdwU=&c=e4poanWZXrxbX8Fl7oPwSWa6MDXkM/z3T4lfYRTXPSfHOgqRnfwFIu03xK6iQfmJlDk25hF yHdkuuMK WL27xX8gsPZODDaCpQtg/Uvh/m3c77ti6XHJeIdxkN3McC9&fallback_url=https://secure.inndl.com/.../google-chrome.exe

Remove c.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.