» cyberghost-vpn-19195-dp.exe
Overview
Analysis
File Details
Downloads (14)

cyberghost-vpn-19195-dp.exe

Rukimakin

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application cyberghost-vpn-19195-dp.exe, “Rukimakin Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.

File name:

Publisher:

Mode Beta (Fried Cookie Ltd) (signed and verified)

Product:

Rukimakin

Description:

Rukimakin Setup

Version:

3.7.4.5

MD5:

5e82ad6c8601aec804cfebca4803ac9e

SHA-1:

55ff1a8c15fb7e5ff3d61ec97cb19db199916a9e

SHA-256:

4d0500b4fc4dee34049d24fbbf71f309cfc13c74c5ae486ab1955b6ee544b351

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

12/26/2024 6:29:42 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.FC.Installer (M)

16.6.10.5

File size:

960.6 KB (983,624 bytes)

Product version:

1.2.5

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\cyberghost-vpn-19195-dp.exe

Digital Signature

Signed by:

Mode Beta (Fried Cookie Ltd)

Authority:

GlobalSign nv-sa

Valid from:

12/16/2015 2:37:06 PM

Valid to:

7/7/2016 6:06:18 PM

Subject:

CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:iCi46vIpWeGEvHstSIgFnM2MXLk03/hNcQQicg6pxiEW8:irrwwXEvHstlgJM7k8DNcggxC8

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file cyberghost-vpn-19195-dp.exe has been seen being distributed by the following 14 URLs.

http://www.todaymetabundle.com/WVl6OTRQWE1sTWtKb1dHMTRla2h4VjJ0YVRGWTBaMnM1YVRrNFJsUlVkMXBUVnpkM2VGVmhSVFZ2TTFwSlYwcEpUU1V6UkNaalBWcFBNazF0VVU5NmNIZzVVR3cxTUZwTk5WZE5jVTVEZGpkYVEwMVFUV3d3TW1sa01rdEdKVEpDVDFKNlpUTnFkM0V5SlRKR0pUSkNhVTh6VWlVeVFtZGlkVFJ0TmtVMEpUSkdiMDVCVUdWbWVFVnhlamh4YUNVeVJuZDNPR0Z5YWtoSkpUSkdaVzVHYzFsdmNsSlBTRVZrY2pSNE5qZGpiM2MxTVd4cVZGaExaV3RIT0U5bVZFSjJlak5ZVkhWdFJIRWxNa1kxU0Rac1UxTXdXa2RZV1VWWVQwMVlUVUVsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptWkc5M2JteHZZV1F1WTNsaVpYSm5hRzl6ZEhad2JpNWpiMjBsTW1aM2FXNWtiM2R6SlRKbVEzbGlaWEpIYUc5emRGODJMakF1TUM0eE16Z3hMbVY0WlNaa2IzZHViRzloWkVGelBVTjVZbVZ5UjJodmMzUXRWbEJPTFRFNU1UazFMV1J3TG1WNFpRPT0=

http://www.tagtowerscapital.com/WVl6OTRQVm8zTlVkR1MyeFRlbmhYUTBsdVZWbHRSek1sTWtZeE9YUlJNakZrSlRKQ2EyaGFRV1pFYnpWTmNTVXlRblZuUjBFbE0wUW1ZejFxYVRaR1RVeERjemQ1VG5sd01HZDFOVGszTlNVeVJrTlBjR2R5Y2psdVMwUkNjU1V5UmxOWmRsRXhKVEpDUkcweFFURlJaMDl0VUVreWVubFBSbVYzTm5NMmRVOXBSalJ6ZEROdlFXdEhKVEpHZWt4YVprSTRKVEpHYTA1bWIwbzFSRlJQVTA5NEpUSkNKVEpHVWxCc016ZEtSVTFqYm5rM2FsUndTVWgwVVRrelZsVjNOR3hYV2paS2FIb2xNa1pHTVZkVlVXZHdTSFY0WkZrMVpsbE1TbW8zZEdSQkpUTkVKVE5FSm1VOU1DWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpZU1V5WmlVeVptUnZkMjVzYjJGa0xtTjVZbVZ5WjJodmMzUjJjRzR1WTI5dEpUSm1kMmx1Wkc5M2N5VXlaa041WW1WeVIyaHZjM1JmTmk0d0xqQXVNVE00TVM1bGVHVW1aRzkzYm14dllXUkJjejFEZVdKbGNrZG9iM04wTFZaUVRpMHhPVEU1TlMxa2NDNWxlR1U9

http://www.todaymetabundle.com/WVl6OTRQWFI2ZVZKVUpUSkdURWR2YlRaRlpWZFRkR2xOVms5R1dXaDJkWEJZT0dwUlYxTnhiMEp0VW5aRWExazVZeVV6UkNaalBTVXlSbmg1TTBwMGJEUTJSMkZuYzJFemQxRTJiRFUyVjNsTFpVeGFZbTh3V2tSc04wZFhOMUpJVDFkT05XVlVOMDF6ZDA4d2VUUkVOVGxSUkdaeVRFbG5NR1JFZDJGWFIySnZPVEJ4VlhOc1pHd3hOSGh4VmprbE1rWk1jRE14TlVGQlQwaE5OMkkwUjNWNFVWZEZVSGRpUlRGUFpURnpaVmhGVmt0Rk1XSlpTMW8wZUU4MWFqTnFSMm96VVdkVVdYWkZPRlpwUVhsMlJrRWxNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5oSlRKbUpUSm1aRzkzYm14dllXUXVZM2xpWlhKbmFHOXpkSFp3Ymk1amIyMGxNbVozYVc1a2IzZHpKVEptUTNsaVpYSkhhRzl6ZEY4MkxqQXVNQzR4TXpneExtVjRaU1prYjNkdWJHOWhaRUZ6UFVONVltVnlSMmh2YzNRdFZsQk9MVEU1TVRrMUxXUndMbVY0WlE9PQ==

http://www.presentheartapplication.com/WVl6OTRQWGxuWVU1dlRrcG5VVzVxUkhOMlZITlZPR0lsTWtKU2JIcFlOVGd6YXpGbFkxcElOa0pZTkd0UFRETklRU1V6UkNaalBVZEdWbVoxWkVJMFFuSldOWFp2Y0U5Nk1USm9OR0ZVUTBOR1ZDVXlSbGhpU1V4V09TVXlSbE5OUm5aaFJVSmFRVlpqVkVwUWVrTkZlV0pHWVRjd1ExbzJhaVV5UmtSUGJWRXhWMlJuUTBVNU1YcHRKVEpHTTJsd1JYVkZUelJ4V25GbWFta3lKVEpHVW5BNVNrbHljamtsTWtJMFZsTXdNVWxpVHpjMmFXRkliVk14YlNVeVFpVXlRbW80ZERocVFsSnZjemxUTVV0dGJHZ3lWbkYzZG04NFpUWjZXWGNsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptWkc5M2JteHZZV1F1WTNsaVpYSm5hRzl6ZEhad2JpNWpiMjBsTW1aM2FXNWtiM2R6SlRKbVEzbGlaWEpIYUc5emRGODJMakF1TUM0eE16Z3hMbVY0WlNaa2IzZHViRzloWkVGelBVTjVZbVZ5UjJodmMzUXRWbEJPTFRFNU1UazFMV1J3TG1WNFpRPT0=

http://www.tagtowerscapital.com/WVl6OTRQVU0xVDJaTWJtWXhPR3BFV2xacVpHZGFibWxxTmt0NlpWWnNVa0p5ZEd4SlZtdHdWbU16UlhBeFFUQWxNMFFtWXoxRVZVeHFWemhrWVhGU1dWQlVWMWRHVW1OWmQweG9hV1ZGZUZkVGQxYzNWVXRxZVcxcGVEUnNSR1Z6UVZCd1F6VjZkVzV2V21sMVYxaHlXR2RwWmpZeldVSTViMXBtUkhseVVYRlFSbGhvVEhaaFRteGhieVV5UmpBeGVWaEdUa1ZFZDNOaFdtdzNjR3N6UTJKamVGbENZMDAzTUdVMGJGbFVVbFJqVlZSeWFrZFZkazlKU1RSSVIyOWthakZMY2pCdllXcHhjMDVrZHlVelJDVXpSQ1psUFRBbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0yRWxNbVlsTW1aa2IzZHViRzloWkM1amVXSmxjbWRvYjNOMGRuQnVMbU52YlNVeVpuZHBibVJ2ZDNNbE1tWkRlV0psY2tkb2IzTjBYell1TUM0d0xqRXpPREV1WlhobEptUnZkMjVzYjJGa1FYTTlRM2xpWlhKSGFHOXpkQzFXVUU0dE1Ua3hPVFV0WkhBdVpYaGw=

http://www.clearuniversecapital.com/WVl6OTRQV04yYVZsNWVscHJXRk5HVlROTVZXWnBSamh2VTFkTmFVZE9KVEpDZVZCcWRFaFRlVFZUVldoYWRqRnFSU1V6UkNaalBXZG1NVXczYzFkM1ltWlhXWHBHTVhsMU1sZENNbkZGV1ZrbE1rSTFjRkk0Y0ZaTGFUZHBUemhKWm1wMFMwRkZNVFZ1YkdwRWEwWldNV3htVVdWeGJGZENXVkF6WkhSNE4zZFFXR1J1U3pFNVNXOUJNbWxPZENVeVFqUXpTVVpXT1c1dllrbzVZMlUwTlZOTFRHRm5VRXg2WVdZNFMyOWxXamh1TUdScWVqbHJUbnB2TWxGd1QxTnJUWFpXVkZneFFsTlRUSFF3U0VkdlVFRWxNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5oSlRKbUpUSm1aRzkzYm14dllXUXVZM2xpWlhKbmFHOXpkSFp3Ymk1amIyMGxNbVozYVc1a2IzZHpKVEptUTNsaVpYSkhhRzl6ZEY4MkxqQXVNQzR4TXpneExtVjRaU1prYjNkdWJHOWhaRUZ6UFVONVltVnlSMmh2YzNRdFZsQk9MVEU1TVRrMUxXUndMbVY0WlE9PQ==

http://www.stockbundlecentral.com/WVl6OTRQVGhIYmtocGVHcEtXVEF4Y2xoVU5tVktjVkl6WlVvbE1rSTRhVEJSVDFFMmJtbHlTaVV5UmpnMVEwOTJVemRqSlRORUptTTlRV3d5Y1V0SlJUVlNPVEJZZWxKMVowUk9jWEF5VDA1WFRqVm1aeVV5UmpKdk1DVXlSakZ0YWtGemVraFBTVkZpT0dwc1NVUnZXRllsTWtJNVZGTWxNa1phWnpobllWVmphemg1YzFoaVRHaEpURlpvVTBaWFVIRTFhRzl3VjBGTE5qQnJVMlZQWW5CUWJWVXhUaVV5Um5aVVRHSmhhMGRVSlRKQ1NXeDFiR0p6U0dKYU1GRk5SSFJCY3pkUmJEWkNiV1JVTW5ad2FERmhXRnBGYW10YWFEaDNKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabVJ2ZDI1c2IyRmtMbU41WW1WeVoyaHZjM1IyY0c0dVkyOXRKVEptZDJsdVpHOTNjeVV5WmtONVltVnlSMmh2YzNSZk5pNHdMakF1TVRNNE1TNWxlR1VtWkc5M2JteHZZV1JCY3oxRGVXSmxja2RvYjNOMExWWlFUaTB4T1RFNU5TMWtjQzVsZUdVPQ==

http://www.stockbundlecentral.com/WVl6OTRQVXB4UVhwNlJHaEZhV1o1UlhvMVVEZFBSM2xMYUUxUU9HZHNOV2hEWWpseFZGQkdibWc0ZFRKVVlsa2xNMFFtWXoxYUpUSkNaalpWUVNVeVJuRXdjalEzU2s0NWFtcHVXR3RZU0VwVldFTkphbFJYWTJJeFZGbE5OVnBtZW01SVdYUjZPR0ZUWlRGcGVHazNUelJuT1doNE1EWlhUekZQVlRkSVQzSm1USFI0V1hGUVJtVnRVamxtYUdkbGNsTlVWRGhTTVZKTGVXYzFiRVowVHpkaGFta3hWbTlFUjJSM1ZXcFRPVFpVZVZNbE1rSjBTVzVKUlVzMFptbFRUWEZhZFRadmRrMVVVME5RZWtKSVRFRWxNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5oSlRKbUpUSm1aRzkzYm14dllXUXVZM2xpWlhKbmFHOXpkSFp3Ymk1amIyMGxNbVozYVc1a2IzZHpKVEptUTNsaVpYSkhhRzl6ZEY4MkxqQXVNQzR4TXpneExtVjRaU1prYjNkdWJHOWhaRUZ6UFVONVltVnlSMmh2YzNRdFZsQk9MVEU1TVRrMUxXUndMbVY0WlE9PQ==

http://www.todaymetabundle.com/c?x=AItfAI61bXNTMS2f kWzQzNW9LelJInQ2QYjNaf4bR8=&c=BEP bKTkfFjByVozd GHEraqZz9XAAl43SnD xHpEgtcYWUIF1s0ycBRdEAkGLTz5xk87RBUPIhwZm5mUl7qscvLSZfqfLv QCJGCisPOW iyDgbtcu1YhLtS hmVV4cghKfjsl95WljzAOlQEF358AU9NDQCkkM7vYE0LV70w=&e=0&fallback_url=http://download.cyberghostvpn.com/.../CyberGhost_6.0.0.1381.exe&downloadAs=CyberGhost-VPN-19195-dp.exe

http://www.clearuniversecapital.com/c?x=pmHqO1XrQpbaYjKw otr9mIy3Q5eAWLxckQNoWZgI0o=&c=/w/PCNWFCjVjioAHKWosSybfVgKL7J7lT/CJZA6StVUXr1M4cdF3gLDRqkAW i ZyA/tuqtTWhxyeziQ9G5c2KxreALsF19CnQa/1U3YbM 6wagaWW065M0bMGknhDBtnliie5Ypt6ffCs6W obiKXCNxEQDNeEjAQ7gps4d8x0=&e=0&fallback_url=http://download.cyberghostvpn.com/.../CyberGhost_6.0.0.1381.exe&downloadAs=CyberGhost-VPN-19195-dp.exe

http://www.headcycleuniverse.com/WVl6OTRQVXQzV2poUlNEaFpSbmhQTXpORlpqRTRTWHBDTWsxaUpUSkdRV0pJUVhkdGFsTlVaMWgzVmpsNGVuSnJTU1V6UkNaalBTVXlRbFUyYTFkeGFFNVhaMDE0T0d4T0pUSkNhbkZZYTFaMWMydFRkRGR0YUdKMlpIWkxRazVMYW1FbE1rSmthSFpqZEc1NlZtcFJhM1pqUW5reGRESnRKVEpDZWpkaGJVRTNXV0ZYVGxkdlZuSmxaM0ZFWmxkVE9YSmpTVEEyYWtaUFVFcHZRU1V5UW1OWmVtOUtjalFsTWtab1VHcDRNVGhQUlRkdFExUmFjVWhqVDFwWWNFdHdiSGxHWlVFbE1rSmhNR1JpVVRKS1NrRjVjbUpRVEdSUVZ5VXlRbWNsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptWkc5M2JteHZZV1F1WTNsaVpYSm5hRzl6ZEhad2JpNWpiMjBsTW1aM2FXNWtiM2R6SlRKbVEzbGlaWEpIYUc5emRGODJMakF1TUM0eE16Z3hMbVY0WlNaa2IzZHViRzloWkVGelBVTjVZbVZ5UjJodmMzUXRWbEJPTFRFNU1UazFMV1J3TG1WNFpRPT0=

http://www.grabappsdownloads.com/WVl6OTRQWEExY0RSdU9FeFNia3BIU0daRE5uTlhlREp0VjJkS1lXWTJjRFYzWmpSSldIcHFNbGR0UmxKWWJXTWxNMFFtWXowMlFqWkZVM0pqYUhaR1QyRkJWRXAwYjBaNGRWQkRXa1ZYVGxrNU1VRTBPV2g0UlZadmFtb3lWMUU1TTNwUFREVXdVMnMyT1hkNVJGZElNWEZ5TWpGWUpUSkNaR0Z1VWlVeVFuRnlURnBHVlRaa2JuWkZOMmc1U2lVeVJsVlRWM0I2V0RNd1UxZzNXU1V5UW01YWVsZ3dRbGxSUWtKek1HczRaR2xyZHpWaWNEWkNSMXB3TWsxNWQxRlhiRTVhZEZaMmFuRlROakZUYVZneFdVaFdaeVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVprYjNkdWJHOWhaQzVqZVdKbGNtZG9iM04wZG5CdUxtTnZiU1V5Wm5kcGJtUnZkM01sTW1aRGVXSmxja2RvYjNOMFh6WXVNQzR3TGpFek9ERXVaWGhsSm1SdmQyNXNiMkZrUVhNOVEzbGlaWEpIYUc5emRDMVdVRTR0TVRreE9UVXRaSEF1WlhobA==

http://www.stockbundlecentral.com/WVl6OTRQVGMwY1RBeVJVMUdjMDRsTWtKS1RIVnFjVFJDWm5oeVRuaHVibWswYjNrM2RWQXdaRlJUSlRKR09HSnljSFp6SlRORUptTTlKVEpDVUhVekpUSkdjVlJIYkdGVGFFZDVVbVpOVkVkbVVGaHhWM1ZMVVRadk5GWklUbE5oU0VkSmRFSTNReVV5UWlVeVJsUnVWRWRLUjNoNVptdFJUbkF5SlRKQ2NYUXhWbXB6UkdkNk5YUjJaRWhaVFZwa09GVkVjazU2UWxWNGNsTXdNbTFSWmt0bGIxRnNSbE5LVG1Kdk5FSkZaVEpMY3pRMU9HVnhNemt6YW1GRGNWSkJWQ1V5UWtoWmQxcGpTV2RvYzJGTFkyRk5ZakpIVGpVMVRXcFJKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabVJ2ZDI1c2IyRmtMbU41WW1WeVoyaHZjM1IyY0c0dVkyOXRKVEptZDJsdVpHOTNjeVV5WmtONVltVnlSMmh2YzNSZk5pNHdMakF1TVRNNE1TNWxlR1VtWkc5M2JteHZZV1JCY3oxRGVXSmxja2RvYjNOMExWWlFUaTB4T1RFNU5TMWtjQzVsZUdVPQ==

http://www.todaymetabundle.com/c?x=hUDAlQnQgFa6F/NLErJi4C1wTBvWF086IYyNi/54QAs=&c=k4Q37qjQJS7AMe8lYuMGRulQ85 aLHe1CVgrmT7FsP4PRSpcTWIjpCWPgweVWgFtZqysA1hoHOABG0PljNejnXzQ9ZUb78XfjwPqY3FFo gopTM46pMQPLCNXFH x1FWJAwAf40bIPUUwRC/Z0piSOiocef7EGn1ABrjubs680=&e=0&fallback_url=http://download.cyberghostvpn.com/.../CyberGhost_6.0.0.1381.exe&downloadAs=CyberGhost-VPN-19195-dp.exe

Remove cyberghost-vpn-19195-dp.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.