home

daemon-tools-lite-12708-dp.exe

Sera

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application daemon-tools-lite-12708-dp.exe, “Sera Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Mode Beta (Fried Cookie Ltd)  (signed and verified)

Product:
Sera

Description:
Sera Setup

MD5:
1faaf0aa49cb1128800c76aaf689d48c

SHA-1:
59ce1827183e1c6ab5140611a8e4175fb4e23cb1

SHA-256:
3d35325b115316abf049599db6c1157a7f88260bdb82378accf8bbe2c3413f76

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
12/25/2024 3:42:17 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.5.22.13

File size:
964.1 KB (987,216 bytes)

Product version:
2.2

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\daemon-tools-lite-12708-dp.exe

Digital Signature
Signed by:
Mode Beta (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 2:37:06 PM

Valid to:
7/7/2016 6:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:FL9ipPc/HY7+5AxnJ58fr9rWh4WSa82P1YbAqxh5d+u0o1O/:FBUPc/47+a8fr9rYoa82P6kgh5dL0r/

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file daemon-tools-lite-12708-dp.exe has been seen being distributed by the following 8 URLs.

http://www.vaultsgrabstock.com/WVl6OTRQV0p5VVZaWVJ6bHhNbFJhUldOWGJ6Y2xNa0pRWjFCd1lVazRRM3A0UlhVeFFWY3dZbVFsTWtaRlFWVm5PVWgzSlRORUptTTllSGhvYm14MWIweEJSRW8xUlhBeE5EUkZhMVF5ZDFaMVMwdzBTWEJoZFVnM1VGZFhPRlUzZDB0eGREVWxNa0o2VUdNbE1rWTRXblJwWmxWNGVDVXlSaVV5UW1KSlJsaEtXbkZSWkc5SmFVOU5WSE5tY1c5cFpFNHdkMmt3VFZKblJWbG5XVGcyUTJoTmIyMUVPVzVpT1V0a01UUlpVamRVTjJkUE1XWmxVSEJCWmtwM09FOUlablpXUVZsTk1IWXdjSGhtZGpsRVUybEhPQ1V5UmxRNVFTVXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWnpkRzl5WVdkbExtUnZZbkpsY0hKdlozSmhiWGt1Y0d3bE1tWnRkV3gwYVcxbFpHbGhKVEptUkZSTWFYUmxTVzV6ZEdGc2JHVnlMbVY0WlNaa2IzZHViRzloWkVGelBVUkJSVTFQVGkxVWIyOXNjeTFNYVhSbExURXlOekE0TFdSd0xtVjRaUT09

http://www.vaultsgrabstock.com/WVl6OTRQVU5xYWpaVllXMWlZelY1VUVoS2IwdzBSMW80Y1haWGVVVmlSMHB2UkdWeVpIZHZRMWgyVG5wTU5rVWxNMFFtWXoxaFZXbFpiakIyYms5Rk1YWTBjbWRvZVRkT2FqRmxhV1ZpYkZBeVFXSjBZVTU2WjBWVmJsSXhZVzlUVW14WGRFMU5kSFE0YTBnelVEVk9lVU5HYjBwV1pWcEhOVzlKU3lVeVFuVTFlVEVsTWtKT05FcENObWxyWTBOcFNGWm5lVUpYZURSQldVdEtiV0ZaUmxSeWNFNVVWbkZqV0ZGTmFXTlVkelJvZVcxM01GZDNORGxzUVRZNVRtbDRiMkpKUVZZNGNuYzRXVWhZUkZKbkpUTkVKVE5FSm1VOU1DWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpZU1V5WmlVeVpuTjBiM0poWjJVdVpHOWljbVZ3Y205bmNtRnRlUzV3YkNVeVptMTFiSFJwYldWa2FXRWxNbVpFVkV4cGRHVkpibk4wWVd4c1pYSXVaWGhsSm1SdmQyNXNiMkZrUVhNOVJFRkZUVTlPTFZSdmIyeHpMVXhwZEdVdE1USTNNRGd0WkhBdVpYaGw=

http://www.vaultsgrabstock.com/WVl6OTRQU1V5Umpnd2NYRjNWRFpaZDBWR0pUSkdiMUJZUlNVeVFpVXlRbkIxVjJwcUpUSkNkQ1V5UW1sSWFtRXpKVEpHWVRWdFRVdzJNVzVNYnlVelJDWmpQVlJ4Tm5BbE1rSmlibmhMVDFoSFRtczNjMVZpZEUxTVlrTmlSbkZPSlRKQ1dFMXRVVEUyTTJKb1RWSkVNMVpzTmxaa05WVkdUbmxIY0ZGNVQxTjVKVEpDVFRacWMyVWxNa0l4WjA0eVkyZGphbVpSVVhoWGFXaHdiVWxVYmt4VmVrUmtWM1ZoYzI1bVEySk1KVEpDYUZGUk4xRm9aR3RsZFZGc1RWWjRVMlpXTms5cGFVNUtlbWxrUzFwV016TkhSV1JMTjBsdEpUSkdXU1V5UW13eEpUSkNPWGxKSlRKR1p5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWnpkRzl5WVdkbExtUnZZbkpsY0hKdlozSmhiWGt1Y0d3bE1tWnRkV3gwYVcxbFpHbGhKVEptUkZSTWFYUmxTVzV6ZEdGc2JHVnlMbVY0WlNaa2IzZHViRzloWkVGelBVUkJSVTFQVGkxVWIyOXNjeTFNYVhSbExURXlOekE0TFdSd0xtVjRaUT09

http://www.cleantowerspackage.com/WVl6OTRQV1pQTkZSM1luaE5abVFsTWtaUmJtcHNUMDRsTWtabVNpVXlSbWd6TWtSUFVUUk5WRWxsU1hGamNVdzJUbGxtVmxrbE0wUW1ZejFuSlRKR1YxUkdTQ1V5UWtoTkpUSkNWRlY0U1cxNE1YcGFVMmMxY2pKM1drZFdkakV5VlUxdGFFUkJkVmg1UldJMlZuUTFVbThsTWtKcE5HRkZTV1pSVkV4dmFIWkJjblpWUmtoTVNUVkVjbGd6UTFSS2VtcHlPRzFxVUZRMmEwbEhOamcxTUhsNFpXVjJaU1V5UWpaNFoxVXlaRFF6VURKQmQzSnJhRkJXTWs5cFZsQTFhR3hVYzFJMk16SXlia1ZyTURJMmEwRllTbE5MU25ad1RsRm5KVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabk4wYjNKaFoyVXVaRzlpY21Wd2NtOW5jbUZ0ZVM1d2JDVXlabTExYkhScGJXVmthV0VsTW1aRVZFeHBkR1ZKYm5OMFlXeHNaWEl1WlhobEptUnZkMjVzYjJGa1FYTTlSRUZGVFU5T0xWUnZiMnh6TFV4cGRHVXRNVEkzTURndFpIQXVaWGhs

http://www.todaysafetoday.com/WVl6OTRQVU5JUlhKVU9VbERPRzRsTWtKa1lWcFRNbWxMTWpKUlNYWklVemxIYkhKTFdGQk1ZVmhvZGtGQ1ZHVjJaeVV6UkNaalBXUkJlbkpqY3pkNE4wUjZOSGxqYWpKcGJFdDNUVVpKVnlVeVJrUlhSa0pMZW14SVYweEJWeVV5UWtOc2VuaFlNbEJHYzFKNmRIUmljVFZEVmxaWE9IQm9OMFF5WjFkclQyZGhSVWRZVUZNeldVeElNQ1V5UmpCalIwRm5XazRsTWtKTGRtOWlTeVV5UWxWQlZsWkpWbVJyU2xGM1pWWnBiRXREVHpBNFUxTXlRV2hLSlRKR1QwNHpXVXBKWjI4ek9EQkZZbkk1SlRKQ1prMVRObTVrZG5CVU0zWm5KVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabk4wYjNKaFoyVXVaRzlpY21Wd2NtOW5jbUZ0ZVM1d2JDVXlabTExYkhScGJXVmthV0VsTW1aRVZFeHBkR1ZKYm5OMFlXeHNaWEl1WlhobEptUnZkMjVzYjJGa1FYTTlSRUZGVFU5T0xWUnZiMnh6TFV4cGRHVXRNVEkzTURndFpIQXVaWGhs

http://www.cleantowerspackage.com/WVl6OTRQWFJoYlVSTFRFZzBiR1k1T0ZvM1RYSndiSEI1VDNwYU9YWkZiMUJtWVRkTWVHOVpWVnA0T1dZeGVuY2xNMFFtWXoxS1MxaEtRVkpLYlU1Qk5VSkdZbTAyY2tSMGJtODVlRUZDV25wVGRXdFFjbnBNTjNKUlMxazBOVXBqWjJkcVQwSmFXWFo1VkRSU1lpVXlSblJST1VrMk5qSTVhRlZwV1daQk9EQkZXVzA1Wlc5bU1HdEtUVkJ4ZVVZbE1rSkxSV2R3VTI1d1dEZHVkMDFTY0c1clIwVkRNR3RWV1U5UWQwMVpRVzE0SlRKQ1l6Sm9UR1paYkVSUk1rRTFKVEpHZEUxTmJWQjFSU1V5UW05WU1EUkhaR2gzSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm5OMGIzSmhaMlV1Wkc5aWNtVndjbTluY21GdGVTNXdiQ1V5Wm0xMWJIUnBiV1ZrYVdFbE1tWkVWRXhwZEdWSmJuTjBZV3hzWlhJdVpYaGxKbVJ2ZDI1c2IyRmtRWE05UkVGRlRVOU9MVlJ2YjJ4ekxVeHBkR1V0TVRJM01EZ3RaSEF1WlhobA==

http://www.vaultsgrabstock.com/WVl6OTRQU1V5Um5KT1NIQndjRzlZZVRCMVMxRnJTRzVOV0Uxb1lWTWxNa1o0WVhSUlQxUXlNV1ZIUzNwemNXc2xNa1pUWWtVbE0wUW1ZejFFTURKVVkwbHRVRmRTYWxvelVraFllRWxYV1hoeE1VeDZaVEJRSlRKQ1JFWklkMVpPVjIxNFRWaFFNRk54VEVGeGJWZHRTaVV5UWlVeVFrcDFlVU5RVld0dVYyOWtNVXQyVDNSNU1Va2xNa0kzTURoU0pUSkNVVGxSTjNOd1FVaDRiVWxGYzFjNE5WTnFhMnQxYTJaTmNEWlhhbmNsTWtZM1ZITTVNRklsTWtKNlRuQlNNRk5MZDBSYWFHZE1TRXBpU0RGc2NXaEdhRTlRU2xocFpXWXhNbGdsTWtKUkpUTkVKVE5FSm1VOU1DWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpZU1V5WmlVeVpuTjBiM0poWjJVdVpHOWljbVZ3Y205bmNtRnRlUzV3YkNVeVptMTFiSFJwYldWa2FXRWxNbVpFVkV4cGRHVkpibk4wWVd4c1pYSXVaWGhsSm1SdmQyNXNiMkZrUVhNOVJFRkZUVTlPTFZSdmIyeHpMVXhwZEdVdE1USTNNRGd0WkhBdVpYaGw=

http://www.vaultsgrabstock.com/WVl6OTRQVTEyVVZCRlZWcEZXVTAwWVVKTGRVUXlaRXN4V2tSbVUxcGhVRVpEUTFVMVEweHZNVU51ZVc1VU1HTWxNMFFtWXowemVrSlZRVkJpYm1wWE5tc2xNa1l6VjBsR01FZE5lbGxzUkdSNFVHbFNVbkZvYzFkRFZVdHlaRVJDVVUxWU4waDNKVEpDZVROUU1TVXlSakpRUmxCMWRIWmlkRFZwUkdwVFNrRm5jV05rU0hSSWVHcGhibW94UW1zbE1rWndTV3BRU0hnME9HVm9XRzlrUmpkMVZFbHpUMG8yTjJ0M2RHMDFPVGRSVUdWTVpsbE1NVmxGUTNBbE1rSlZNR2xNYXpSNEpUSkNUMUpwYkd0TE5WWmlSWEJtVldjbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbWMzUnZjbUZuWlM1a2IySnlaWEJ5YjJkeVlXMTVMbkJzSlRKbWJYVnNkR2x0WldScFlTVXlaa1JVVEdsMFpVbHVjM1JoYkd4bGNpNWxlR1VtWkc5M2JteHZZV1JCY3oxRVFVVk5UMDR0Vkc5dmJITXRUR2wwWlMweE1qY3dPQzFrY0M1bGVHVT0=

Remove daemon-tools-lite-12708-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.