home

elisoft-faktury-33564-dp.exe

Bab

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application elisoft-faktury-33564-dp.exe, “Bab Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Mode Beta (Fried Cookie Ltd)  (signed and verified)

Product:
Bab

Description:
Bab Setup

Version:
1.6.2.1

MD5:
a614ff5ce93e42e3f8f8c7fd3aee7b45

SHA-1:
aabd10a99a5933dcce5c4d5546225d18c9fd0c46

SHA-256:
868693c126bbe92dac35d715dd37c9a79b3db5594a90ce474d742ea1c6e8913d

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/26/2024 3:01:16 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.5.8.2

File size:
951.2 KB (974,072 bytes)

Product version:
1.5.2

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\elisoft-faktury-33564-dp.exe

Digital Signature
Signed by:
Mode Beta (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 2:37:06 PM

Valid to:
7/7/2016 6:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Nvp7y5I5PpEla6JVWwIar2hfWz21GkqfQT7L7/bpoQOGZ/u:xx8culbVzIaKhc2gkqfQTz99Z/u

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file elisoft-faktury-33564-dp.exe has been seen being distributed by the following 11 URLs.

http://www.dlchuckledl.com/WVl6OTRQWE5sU0ZJbE1rWTFZVE1sTWtaTVkzRjRaM2MwZW1KVmFISnZaR2d4VkV4NFdFaG5ZbFU0WkVsSVJsTjJka0pWSlRORUptTTlSSEJSWlRWdFNVRmtOVFJRTjBWSFdqZG9XSEpXVWs1NGJWZ3hkRGhQTkVGcU9HSTVUakF4WWt4RU5sQkNhakZNYlVaYU4yeElaMWxQZUhWRWRrUXpaa2xRYUdwS00xUkxRU1V5UWswelJYbE1TVzVHZVdWRlMwbE5TRnA1TUdsVldHMDRWbTVvUmpGR1N6SmFjRUpZSlRKR2QxbFFkRXB4VFVKVVYyRm5ZMkpCTWlVeVFtWjNSMlVsTWtKRlEyNXdRelpXWWt4NFZFOVNabkpoWjJjbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbVpXeHBjMjltZEM1d2JDVXlabVJ2ZDI1c2IyRmtKVEptUm1GcmRIVnllVVoxYkd3dVpYaGxKbVJ2ZDI1c2IyRmtRWE05UlV4SlUwOUdWQzFHWVd0MGRYSjVMVE16TlRZMExXUndMbVY0WlE9PQ==

http://www.tourcontentdownloads.com/WVl6OTRQVmxOSlRKQ2JHSmFTRTV2ZDJ0YVlXNWphbTVQUTI5WVVYUnhSM1V3Tm10UE1XdHRZeVV5UWxSTFduVkpSa3h2SlRORUptTTlOa3RaVTFsNFdFUldTV3htYlVOd1YwdDVhemRFWkhoM1ZXUTVUMG9sTWtaM1pVNXdTSGxVTUcxRU5tNW1hRFUwUjFsa2NIWjBValZrUTBrbE1rWlRhM0kwVDJNM1dFTm1VbHBaY2pOT2FFSmhibFZ1TmtFbE1rWXhORkJ6Vkc1VGRVTmxVM1p0WjBab2FHVjNaa3B1VDBWalluTWxNa1k1YzFRbE1rSndWVFFsTWtaek5IcHJTekFsTWtKbk5XMDNiSEF6VERGVFRYUXlOMnA2VWtvek0zZEJRWGNsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptWld4cGMyOW1kQzV3YkNVeVptUnZkMjVzYjJGa0pUSm1SbUZyZEhWeWVVWjFiR3d1WlhobEptUnZkMjVzYjJGa1FYTTlSVXhKVTA5R1ZDMUdZV3QwZFhKNUxUTXpOVFkwTFdSd0xtVjRaUT09

http://www.sendnowtown.com/WVl6OTRQVEpJV2psb1FUQkhkaVV5Ums1UWJGSm5PV05tUldvNGIxcGtkRk5MTlZOcFowcGxaVlF6WXpWd1kwRWxNa0pGSlRORUptTTlhMjVrYm1OaVF5VXlRbTl4Y1hCUWFGUllNbTFGZVRnbE1rSmtNVUkyYlU5blpDVXlSamQzZFZNM01FOTJlV2hVVWtOVVRWcDNaa28yV0dab1ZFZHRhMHc0YjIxUmIySkhlVTkwV0RKc04xZEtNVzlqWW0xelozTlNRMFIyYjFwSFptWTNUVmdsTWtKSGVHWkNSMFlsTWtaQmNISTJNM1p5V0hKa1JESnJNMjFPTlZaVlVUWk5lVWhVVGxSa2NqSlNTR2wwV2lVeVJqZzJUQ1V5UmtnMFVUaFFNbWNsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptWld4cGMyOW1kQzV3YkNVeVptUnZkMjVzYjJGa0pUSm1SbUZyZEhWeWVVWjFiR3d1WlhobEptUnZkMjVzYjJGa1FYTTlSVXhKVTA5R1ZDMUdZV3QwZFhKNUxUTXpOVFkwTFdSd0xtVjRaUT09

http://www.packagesoftwaretowers.com/WVl6OTRQVXg0YURSUlVTVXlSbEU0TlZkcmNXSnRjVWxFYms4MGFWTm1RWEpuUVd3elowOVdjM1EwV1NVeVFqUmlRMFZCSlRORUptTTllU1V5UmpVbE1rWmxjakZQWkZSNU5reEhhWE52WnpkeWFFOXJaa2R5WmtjbE1rSnhTRWRpVGlVeVFtUkhVVkZ6YTJKSlZpVXlRblUxWVhrbE1rWTRXVk0wTVZZMVIzUk9WVUZsWXpKdFYxVXlSVmsyTjJ4dllWSkNlWEJEZUcxb1prSk5ZMFpoY2xKTk9HNUZOU1V5UWtodE5WQkdRbEJaZUV4UU1WcEZOVE5uVFdkMFNrUmhSRVZ2VkdZelVtdFFlRU5PZVV4RVVqRlBTV04xT1ZWSlVsbFdiM2NsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptWld4cGMyOW1kQzV3YkNVeVptUnZkMjVzYjJGa0pUSm1SbUZyZEhWeWVVWjFiR3d1WlhobEptUnZkMjVzYjJGa1FYTTlSVXhKVTA5R1ZDMUdZV3QwZFhKNUxUTXpOVFkwTFdSd0xtVjRaUT09

http://www.headheartvault.com/WVl6OTRQVXhOTUNVeVJraHdjakpyV0dVemNIZzFRakZ3ZW1FNVdFOXZNek0wVEZwVVFUaFZaRFJQVFRKTmRXVnlZeVV6UkNaalBVNW9USFI2VEZCNVNWbEtZVlpSYldONFFrTmFlR2hwYURWVGRrNTFZbTlLTnpaMlprVkVVRmRzSlRKQ1RVbzNZbVpZZEVOM1NWWjVWVzU2ZFd3NGMwdFNOamhrVjBOaFJHNTNhVWhqYW5NMVZWUXpaVVZoVUdSNWJHeGFVa1Z0UkhWUGJYWnFiVlVsTWtJMldHVjBiV2xwWVVkb1ExSldSRlpMWmtwR1dsTkRNWGRaZWtFd2JUTmtNbGg2VG5weFp6RkJha3AzVTJwclVGRWxNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5oSlRKbUpUSm1aV3hwYzI5bWRDNXdiQ1V5Wm1SdmQyNXNiMkZrSlRKbVJtRnJkSFZ5ZVVaMWJHd3VaWGhsSm1SdmQyNXNiMkZrUVhNOVJVeEpVMDlHVkMxR1lXdDBkWEo1TFRNek5UWTBMV1J3TG1WNFpRPT0=

http://www.headheartvault.com/WVl6OTRQVEJMZWxsck5FZEdWQ1V5Umt4NWQyTTRSRlZzWldWUkpUSkdUaVV5UW1JMmVTVXlSbGwxWmxBMmFsUlVNQ1V5UW1KeEpUSkNkWGNsTTBRbVl6MXVWMWd6UW1Od1RsTmFVU1V5Um5OYUpUSkdOWEpWTVRoM2FHZHRWRzkxYm1GRmFHSlpNVEZQU2xkSFExVnhORlpDVkRKYWJXMUJNREJUVHpCS1ZubDFSakpMZG5aME1VTlRKVEpDWm5oRVNFTk9aREkzTldkR09TVXlRbkpMWmsxRlVtNTBiVWRFYlUxbWFWbzBiVzFVZDFObk9VaDVXSE52TUhJelptRTFkbnA2VTA5RWJVMDJSRzh6UXpoM1FtZFNXbVJTWTFoRk9FRkdSSEJEZHlVelJDVXpSQ1psUFRBbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0yRWxNbVlsTW1abGJHbHpiMlowTG5Cc0pUSm1aRzkzYm14dllXUWxNbVpHWVd0MGRYSjVSblZzYkM1bGVHVW1aRzkzYm14dllXUkJjejFGVEVsVFQwWlVMVVpoYTNSMWNua3RNek0xTmpRdFpIQXVaWGhs

http://www.townbitsquick.com/WVl6OTRQVmRZYjFKWVVWZG5SRkpVYkdZNVFtSjVXSE56WW5NM2JuRmhVbWRNU2pkV1FWVmphRTR6UkRNbE1rSjZPQ1V6UkNaalBYQnRZVlJoU1RVMlIyZENPVmhCWnpKNWRHZEhNVFZ0YkZJelVWWnNWR0pWTW1sNEpUSkdTRVYwUW5Jd1UzbG1aM1pzV2tKVk5HbHNTRzhsTWtaQlZtZG1aV0pPV1hwUVpFWlBNbTgxUldGbmVsVmpTbTl2TlRKQlVEazRSVTFPYzJGa01uUnJSSGRQUTFSWU5sbERNRkV4UzFGWmVtMVZaSGxaU21remRURjZka05GUXpkaldsRnJkVWRpVDNWQ1pVOVhhbWhMU0VsSU0wRWxNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5oSlRKbUpUSm1aV3hwYzI5bWRDNXdiQ1V5Wm1SdmQyNXNiMkZrSlRKbVJtRnJkSFZ5ZVVaMWJHd3VaWGhsSm1SdmQyNXNiMkZrUVhNOVJVeEpVMDlHVkMxR1lXdDBkWEo1TFRNek5UWTBMV1J3TG1WNFpRPT0=

http://www.headheartvault.com/WVl6OTRQWGc0TXpSdVRIRmpNV0owYldveU1uRktUMWw0VldWTmIycDJka3c0TmtSek1UTkNUVzQyUkVrNGFuY2xNMFFtWXoxb2JXRjNXbGxFV2xoSWIxQjZNa1JDTVVkTVRUSk1TMEpaVEU5NWMxTnlVSHBNVUU1aWVHTlRjbWRWZEVWTFRYcDVOVU5xVjBZNFNFVlVhWEJCVkZSdGRVNUZXVlpZZFhGdlZ6QXpWMU51TVV4WVNIaGpPWEpIV2xaMFdIRlNNRzg1WWlVeVFqWk9RV1IzYUVseFlqWjVXbk5TVWxselJFZGpWbk5ZSlRKQ2VFVXljemxEU0c5akpUSkdiRmNsTWtKWWJUUTVNV1JOY0ZNbE1rWjFZWEYzSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm1Wc2FYTnZablF1Y0d3bE1tWmtiM2R1Ykc5aFpDVXlaa1poYTNSMWNubEdkV3hzTG1WNFpTWmtiM2R1Ykc5aFpFRnpQVVZNU1ZOUFJsUXRSbUZyZEhWeWVTMHpNelUyTkMxa2NDNWxlR1U9

http://www.sendnowtown.com/c?x=DW9WMz4mXrQvo93/L s o1dvRD5f431lVhK2KQ8x4mU=&c=/BC6z/FiO9EFLji5ft8qCYdWAlA6lp8wHIXQhZuDZGLqbdOyG4rXhVQjqlXPwqp5JHY/YbqNtO4JLLqFVgaS08xTIsZOU1bPTRPDKSy0zbcb3CaNvRx4YrVyj /mNGA1FrhVT1h9 V QLXH/LvVgUMssSwhPmJHOzeEz7VBrVmFDZKozc/7CssRdeK8K7Qdb&e=0&fallback_url=http://elisoft.pl/.../FakturyFull.exe&downloadAs=ELISOFT-Faktury-33564-dp.exe

http://www.dlchuckledl.com/WVl6OTRQVWh0UVVoQ1lYRkNVamhwUnpsc1pHSTBVM0JOYUU5RE1GUm1KVEpDTVNVeVFrSklTRUpRUjA5V2FsQTRVMGhGSlRORUptTTlSbTU1ZFhWWU4yRTBUMVZrVFVOTlNsUWxNa0kwTW01amRFNXdUVlZIVVhkR2RYSlJUbU5tVFZGSE5qbFFaMWdsTWtKU1IxSlRkRWh0SlRKR1dYUk1hbGRzV1RBNVQyRlNPSGd4WVZacE1pVXlRa1p3TWpJMFIxWkxZVk5KWkhkT2JXNHdlV2xKTkRKWVZVVllVMkpJSlRKQ1ZEQklWVTlJWkhGc2RXaDJSekZRYTNweFVtMUdPWEYzYzBoMVNreFVTMDVhVkZOWmJUQjVSRk5UVW1KVVFTVXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWmxiR2x6YjJaMExuQnNKVEptWkc5M2JteHZZV1FsTW1aR1lXdDBkWEo1Um5Wc2JDNWxlR1VtWkc5M2JteHZZV1JCY3oxRlRFbFRUMFpVTFVaaGEzUjFjbmt0TXpNMU5qUXRaSEF1WlhobA==

http://www.tourcontentdownloads.com/WVl6OTRQVFEzY2pWR2IyNURTVTF2ZWtOUlp6RlBSMDVRYW5SSVR6bDFSa3d6ZDFVM1dtcDFhM0ZQWVZrNFlra2xNMFFtWXoxaU16Z3lXblZ3ZEhSWFdFcHFla2hZTWtsbVFtVk5jbVJGYzNaMlNrdDROeVV5UWpkUFdsWTBTM1Y1YVhka04zcHdibTFNTXpaT00yVlhkMHRMTUU5dE5tVXdTek4zT1UxcmVubzVVMmxuV0RCT1MySk5WM3BoZGpGRmRsSm9TWEp0ZG5kNlZFTmtKVEpDZVhKTGVHNXZVMmMzVDJ4S2F6WnJSR3RaWTAxdFFWVnFUbHBzYUdneVkyaHVlV3N4WkRseGRVWndaRUZoUmpKUkpUTkVKVE5FSm1VOU1DWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpZU1V5WmlVeVptVnNhWE52Wm5RdWNHd2xNbVprYjNkdWJHOWhaQ1V5WmtaaGEzUjFjbmxHZFd4c0xtVjRaU1prYjNkdWJHOWhaRUZ6UFVWTVNWTlBSbFF0Um1GcmRIVnllUzB6TXpVMk5DMWtjQzVsZUdVPQ==

Remove elisoft-faktury-33564-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.