home

c.exe

Faferonaco

The application c.exe, “Faferonaco Setup ” has been detected as a potentially unwanted program by 3 anti-malware scanners. The program is a setup application that uses the installCore installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.conecpttagtours.com and multiple other hosts.
Product:
Faferonaco

Description:
Faferonaco Setup

Version:
4.1.3.1

MD5:
c317d703d7fc1995140859649d7c7a5f

SHA-1:
8d1edc2c6cecf50d5a7baaf9725800f39253f67c

SHA-256:
dccf082322f50ecc82157495583dbee8bfb5f280b7ba8f7124b07aefd553e51b

Scanner detections:
3 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/16/2024 2:57:52 AM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/InstallCore.ACH.gen potentially unwanted application
8.0.319.0

Kaspersky
not-a-virus:Downloader.Win32.InstallMonster
15.0.0.562

Reason Heuristics
PUP.InstallCore.Bundler (M)
16.2.22.20

File size:
1 MB (1,100,108 bytes)

Product version:
5.4.5

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\c.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:RskZjI1q6dxdT9FvFw0N8u0n3EQrzQR7cjS5debIl1Qe8iBUoX1:Rfedpvcu6zOSbSSey8

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file c.exe has been seen being distributed by the following 11 URLs.

http://www.conecpttagtours.com/c?x=TLa9lsky15aKmZszMVvTdF0xED3SgQ4ASVajkPLd0w0=&c=kc0I5Pcb4D0B8SNJHg3HlacoGhJT7CoMW8tse8/jaXDN5TZEmVK3sIDf/2lQQ9/e2bW/bvPkX/tqNH76 gkgFApheajNjk7z0lKBHZyBWKTqDPu04oGI B PsyF2qdSq&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.conecptrepositorytag.com/c?x=nouoL7FkOA4NaJqKXnpI3kHfeLAmXyDTHLTfiVLuWdk=&c=HKPS YYiQpcNUP/mqOGAw8fIeEUob/qFrBsNdjjnNv qk 8fv6tzGGK4512m9VCQIf9IKwpzWFebVKYYQvAUb/Wq5leZUC5Isd3W/sLts9jKFNCN0Ui26Q65CSkv8jVK&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.updatebestbits.com/c?x=n9R5NdglM4rGHVh7DVRh/2pekbDZTUFRSaisrNDadFw=&c=Ucbsrke3t9P8jmRlhjLH4srpeRHFicl3p8kmXUn6BquEmxthoSQj7tcjOfUNRaXKfUg2ymQMUM4/clgd7LVSN4rieXmxMjISBlUSRpDy04VbYEnxp1R63CMAfVrXo1Jr&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.tourapplicationshost.com/c?x=0qRE50iuuhEZpxItNX/9oCnpzi1//Hls GPI1dn27qQ=&c=cQ 7o20hNqL6GjB1JfAGKET0qIIhEo9DTBn21zYw/0qtyvUTHfRW1IN3lE84chqfAHYwDYLyQy NV67hZw9Nfa54F9/ZR YumD/vd3f3o 7NK07H4gSPFPPTvB/cwEBs&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.farmbundlecycle.com/c?x=9Oe1Q/m8PgWpemYnetE8W T6e8T bew xn73aB9cdNE=&c=GUSS7WAK2MxxtWwQF56D30jZAHlEIPUJXwtIo67tY2CJC4AfuZ48J8n1qKsAWdJ9 HwWK9NR02rKYJVsTQVdbHxz43lGFR5l8VO/CYW6f1UAV78cs4OAW5br93CNt3V3&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.senddownloadfun.com/c?x=tJ7wp3al4/zcI3YDtLDtveB5E8i7ab2dN7KJYugtp2M=&c=8KrH7JO3NN/ZYfemN9hL wTb33qYqaacuSqo15aCz3q8 0XMMwwgYPcL8CQ/ju0Thd17EjhNzIiUMC0TenrUAZE244fDQu/9a5Wt0w/K3ZQ3R9eek4V26XBBpt8uNL9&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.binariesbitsbody.com/c?x=dazfd021nrsmqwQGYiI97b QvYGZUdO0Zgv0c4jKDQs=&c=Jyu/cwkku8NFiMKkHOhqCslm1 2baDLh/rUFT3Oo2wo800k9yUBV7oDleq81T2 BbzjyGxA1VvRqy1qCCsW0M37Ikh7/XCJq5q5xuuVWegv9ibJb/oD0WzKqul1KVcdo&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.updatebestbits.com/c?x=W9XeVEBUX2BVxFkxWQmThJqdEz7jdsU9NYp/eX/DIfY=&c=D l70CRyO4ug VOlLbiaj2kgFXvVAFD/taG9TRl/QcDAZyi1YDM YGF3hDVLh2T1mIVLzimyjLY663KrAba6tKLVZDvePToAVI1tECZ6XmytDMVTWMt/dQYWnK9EfMka&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.binariesbitsbody.com/c?x=UMTZcoiISSGsUOYFvKqQr3repgrTaKclPFt4/HGept8=&c=U9v3LBxeXO9mcZ2KHqDkicZNVwDkl8LYUqTvly0l8iSBDdSYRbu2GgiPEt5KnNB08x2e2db3VTFetmgE36C/KS/7k3uKi2HdI7yPAbXtpLoNO3geqL/QdlXZeGKqfk6A&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.conecptrepositorytag.com/c?x=GzExoZQ2TjljVgn2tjdfzMoP3dbnBaTfWEwjH4SZDiA=&c=gA5tPRa53GW83Suwoc1lxwnTdb7lXssYA12h5i5719y1i/QZnxBMI3dF1TaE1HFmiq1DjrDvLwBQ1OEzDc/TStqEWd/ ys1kXQu2mdMmHSkLnFBzZh092GtfLl4uqyEH&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.conecpttagtours.com/c?x=DdZK3C/dr1xMorP2iu942CF0JOIBZ9UjBv8KI65Sd/M=&c=KnBFy7PuDtm3fgW84pwlcmmHbC2QXu CJQFroHpsXeR NQWzrGlAhzIqoB4DyxEAcbTMQqBnM 6I5EuhBlgAfLuBSPmzGKsmCf1X79Sr6BuniZY17PocmXvAchBMrlhY&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

Remove c.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.