home

clickoncesetup-1456415328.exe

Lomikela

Bibado Investments, S.L.

The application clickoncesetup-1456415328.exe, “Lomikela Setup ” by Bibado Investments, S.L has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Bibado Downloader installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from www.conecptbodyuniverse.com and multiple other hosts.
Publisher:
Gelodo   (signed by Bibado Investments, S.L.)

Product:
Lomikela

Description:
Lomikela Setup

MD5:
49d6683cbd3cd69bdf617030f4433335

SHA-1:
1ea62ab81535f377400b58e71a7edcb097f83315

SHA-256:
48024f62be387c26a78a95680b56eee34d50b9d62e1c86f4d36eb6e3fc192155

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/27/2024 1:48:36 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Bibado.BibadoInvestments.Bundler (M)
16.2.25.23

File size:
1.1 MB (1,156,184 bytes)

Product version:
4.1

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Bibado Downloader (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\clickoncesetup-1456415328.exe

Digital Signature
Signed by:
Bibado Investments, S.L.

Authority:
GlobalSign nv-sa

Valid from:
1/12/2016 5:57:03 PM

Valid to:
4/2/2017 1:32:01 PM

Subject:
CN="Bibado Investments, S.L.", O="Bibado Investments, S.L.", L=Alcorcon, C=ES

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121212301396FAE08B19C17F8D9578163C9

File PE Metadata
Compilation timestamp:
6/20/1992 2:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:SxmdsKWEqY0axg2TjCfH5orzzog3V3sltXyTBXWSwlvP:SwXUMZEozzog3V8nCdSv

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.8728

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file clickoncesetup-1456415328.exe has been seen being distributed by the following 8 URLs.

http://www.conecptbodyuniverse.com/c?x=nTukxLfxn8yVXa5snRJgPd7gdCzkvVOpgtX4rOeFr A=&c=BXxOK6nE2AHLMk3rnZPUNfOpdwg kxlEEvG5fBrqv3hk3Gt59AG1a4U0ImiNvkS 1pHwJRVoCSFILXs80LNdPbfGjQLyU2oIdJdCG4wkn fhZVfAufoSb5wzNgOUcJrnmbFP3J0aF8CF2TDB67gPfb0aTyEpHUG7mK8rboFsbwCyggCLMKIkRqC GAjEM4Ic&downloadAs=garry-s-mod-full-version.exe&fallback_url=http://store.steampowered.com/.../4000

http://www.towersbulkmeta.com/c?x=tpQf57MzhmW9c8eEmVx xGruL5VYN3JSddLeTaYN960=&c=Tbvb3R9FwaEmew5CbAWzIXcv063ak7TkWNXPiG/26e520F41N hGpPWgFOAUtd7m1qbfuml5H8Y6vXUKaPVdCN1qogDYw6nVDadR0XDfq/PykxWkaX0DTqFlvHQp3p3NSymng0OuBE2MAIlNjs9PansD64T9gownuyF8qAziazCEeQf gJdn32DAoy3TlmOH&downloadAs=garry-s-mod-full-version.exe&fallback_url=http://store.steampowered.com/.../4000

http://www.conecptbodyuniverse.com/c?x=aa6N/RFm8Ucobtr3cXZ1f6ay0NEC24xDYKxA4RvSU98=&c=u2W323fYo4gSaZF9eeqVuD mKC6uQeJJSHsUh9IaT6kOGTuQ6aVexPwRRQsvNr40jaGsHr1Z40zHBG6YKzDklWLfRZeRga3o2QG6UYxBcJfl6BpPoQAyoZPhMPixWO9QdJKl0B8kYjrBVW/QeRMWNswCSLyU4DBurLOq vFxZDtrWZyHo2acV0BP6lo9gUnZ&downloadAs=garry-s-mod-full-version.exe&fallback_url=http://store.steampowered.com/.../4000

http://www.towersbulkmeta.com/c?x=BzSB7twSU9hVaGH2TdduU48jV8o1JeYd4GSGDzcMr74=&c=qyJ4bgUBhG92pkwpO4sEAEaSQUWZJROA8j8DFUZNUI yJDYTUI7AdqyI/6m9BfePQ1Vtg7xbOIpnYwO1yMTf6/0FejNuICz3OSGPoKh8OBmRpag5Atl15EYrEyGgtfmDrgNtgf0ZAL9j08T66hHvd/FtVkH2bLqUD16 NrCupR5YeICFJg58kScuMuisXu7t&downloadAs=garry-s-mod-full-version.exe&fallback_url=http://store.steampowered.com/.../4000

http://www.towersbulkmeta.com/c?x=OsV nvq GOe7LPKtze4DY4cRNYeEgctQBh94SXC cn4=&c=6Gca Fy1hWESIvYt0IAV MVGgTU6vkvgCjjZAP9UivjAWvc3TXt8XAKRGdvJGATa9XqbHIxIbB7r2khCNVLfQO79RcW2yX ECqgEYkACbpW QsYm3OEBZLpNoyM7LbvKbHe5kyifxEAZcbCtjedUNDj5Qfg6FGGWJk my5qAyLJLqY5mL7zjyCSwzU8GsbQW&downloadAs=garry-s-mod-full-version.exe&fallback_url=http://store.steampowered.com/.../4000

http://www.towersbulkmeta.com/c?x=opBuZPrYFHm7RHfI/dylG/EUHAf546WjdlNaObj7rrQ=&c=akz66F3TRQ2ztUCOo4z5fi6 UbIMyUZWmuu rRr0mtF7HKiNij3FXfA13YPwookyqi4uAK/yW3NtHctWBFpY7Gab4lSbSZlBrIJoHsXvinWR1SvROlu41lJzTopCI1Jrs VAVRxUTQMirxGOgxRtauHcyVBxG4cEXDAYI7w/SOrIFpNrnbq8W97i9na11WhF&downloadAs=garry-s-mod-full-version.exe&fallback_url=http://store.steampowered.com/.../4000

http://www.towersbulkmeta.com/c?x=9zGQ52w2SV7eit4stcUiXbgo5c0TdZhuda9OP1ByrP0=&c=d0WyzKaDMixtbT1Ejh7XzKr O33J/WRm7BJJ9J8132ZonA3nZi75BuWBRhulFPljR4mvXmKijO1p58xyqQwxm5YjkPEgP5yv4XYVZMMEOdaf/JxkbzVXQUfxWG/krJZYm/JeJaX2hjrtesicN862qmK2AUQsgNyGER0Oucsx63GjFp9EdaE6TrqHh/8S5qDh&downloadAs=garry-s-mod-full-version.exe&fallback_url=http://store.steampowered.com/.../4000

http://www.conecptbodyuniverse.com/c?x=jruymK d2fSDwsLslN8UUmdwLvI0bnPVAWIZHg3wq7A=&c=pods MQpacNW15j2CWVzrxBTze7zsSUA8E3Qm FhR3y7a/VPeSrN3 i5HehhEwjIH06vsbOzKcb096 30J7fi/Y7ohbW/uiReCrd0ij2H5ggUDthVtNbj4WjSzGF4SHIH/R3PE0FuV0B5JOmNmlNFvE2a2PqnByZpPTkkL5jmsWWq2F HOxL1/TETo K/l1y&downloadAs=garry-s-mod-full-version.exe&fallback_url=http://store.steampowered.com/.../4000

Remove clickoncesetup-1456415328.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.