home

cossacks-european-wars.exe

Des

PlatformPrompt (Alpha Criteria Ltd.)

The application cossacks-european-wars.exe, “Des Setup ” by PlatformPrompt (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.giftchuckleflash.com and multiple other hosts.
Publisher:
Dogosifuso   (signed by PlatformPrompt (Alpha Criteria Ltd.))

Product:
Des

Description:
Des Setup

Version:
2.6.5.0

MD5:
8247a0a0e109af17acd03ce14ad303f3

SHA-1:
8de9109fe14de6304fcec298ece72cfb3dc7738a

SHA-256:
f8a5f9a0e22749863ae2931e55add03646178bde8610c76345e4c6c28b58078e

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/25/2024 1:28:13 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC (M)
16.8.11.3

File size:
952 KB (974,848 bytes)

Product version:
3.4.8

Copyright:
Stub Web

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\cossacks-european-wars.exe

Digital Signature
Signed by:
PlatformPrompt (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 1:17:26 PM

Valid to:
9/2/2016 1:02:46 PM

Subject:
CN=PlatformPrompt (Alpha Criteria Ltd.), O=PlatformPrompt (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112111817CD313A533F2A76178D4452F81A6

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:z7vDPwUFhDqNzcU16jVXw4VXNLnMXugux2TrhbIC:zjzwUFJqpKpVxnMXvq2TdbIC

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file cossacks-european-wars.exe has been seen being distributed by the following 2 URLs.

http://www.giftchuckleflash.com/U4MGiMbgjzPTISyubtAyQx71mPpLFc_WizeP5aZUXn8KfahUdkqFHHWszxKx5SITV5uV2xaInbH3mgNQpJ5BAZ4plKrJvo8XM CtPYHJhymfhKQ KylnNcIoMl7ffr9OUw0F06MjZcUvTwMfby74D7Gg0A3MkD cWU1e8tt_Wy62K h03w0o1y_o 316GWdWbk7rtpPxzwe3c7tCk1Bn2FQ45O2pnA==-G10AAGRlW2s0k8SIbk39R2ADDlwCCnDQAXSiO9u VEbEMwnwTU37frSr0UwiujkAqmYB8mHz7aqd_KobqO7vVEDFvMvdkUuIoquomA0cVoswIDqFFWS2QAUG

http://www.giftchuckleflash.com/o3DBDi9xHHJC4Ap3cIJDskpwMTu6BI4yDC6U8Of0x4ElhPILdoGz_7uoEEeD2wXNmK3lf RbsK9kGmVyHu1QII693C0Y0B5DXw8qmFdoOZ81GCExmOtSL4x32zYVXbfEC98cdXBNeBQTTT8NW_92YFWV9dchrbZrXThYiwHkvl1yitjZDgE4FXeHLP5YJO7akNOxaxqtfBVJ31dFQIIDjSefOn_3VQ==-G10AAGRwXmtvZqL6DgA24MAlokAD0I3ubPtSdte1JQG SL8sazUZzSxBy_U8QTme8MPmUYMFfsFxIvVXq clmyAfOEL3_DAbjKUd7yEd_giqZZxiMZbhCYoF

Remove cossacks-european-wars.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.