» excel-viewer-12201-dp.exe
Overview
Analysis
File Details
Downloads (10)

excel-viewer-12201-dp.exe

Rukimakin

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application excel-viewer-12201-dp.exe, “Rukimakin Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.

File name:

Publisher:

Mode Beta (Fried Cookie Ltd) (signed and verified)

Product:

Rukimakin

Description:

Rukimakin Setup

Version:

3.7.4.5

MD5:

7959f94b85ec57b006ccd087d3eef5e5

SHA-1:

125366e89d808014f04a685b1edf2ccacb7aaa39

SHA-256:

78f80b2b7a54edf73fdd7cecdedd834854436c3f91614ccf8ee64697151cbad8

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:

12/26/2024 7:39:04 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.FC.Installer (M)

16.6.10.8

File size:

960.6 KB (983,624 bytes)

Product version:

1.2.5

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\downloads\excel-viewer-12201-dp.exe

Digital Signature

Signed by:

Mode Beta (Fried Cookie Ltd)

Authority:

GlobalSign nv-sa

Valid from:

12/16/2015 2:37:06 PM

Valid to:

7/7/2016 6:06:18 PM

Subject:

CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:QCi46vIpWeGEvHstSIgFnM2MXLk03/hNcQQicg6pxiEW8:QrrwwXEvHstlgJM7k8DNcggxC8

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file excel-viewer-12201-dp.exe has been seen being distributed by the following 10 URLs.

http://www.grabappsdownloads.com/WVl6OTRQVTF1T0U5WWVVZHlRa2MxV0daclUwSTBUM2h2WWxjbE1rWXhlbVlsTWtaaFZGVk1ZMHd4UzNWQlRqbEdaVmRqSlRORUptTTlSa2RGVlRaVWRFNVRaMFJMVGtSRlNsZEhWbXBGVWtOVmRFaFpaRFpIYldSa1NFZHRVbXhKYUhWek9HeE5OR2tsTWtKR1VUQjRjMUJJT0dWcVRHZ3dhbk14YzIxd1pWTTJPVVpYWjBwM1ZGa3dia1Y0U25oa1JrSXdWVmxuUWlVeVFuVjNiRFEyVVZZeE0zbFlibGRrYlRaRVVVc3hkVE0xVW1GRVExRXhNMkpoTm13bE1rSmtWVk5uYUcxRmJrUmpjRWx2U0VkdWVWQmpXU1V5UW5jbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbVpHOTNibXh2WVdRdWJXbGpjbTl6YjJaMExtTnZiU1V5Wm1SdmQyNXNiMkZrSlRKbVpTVXlabUVsTW1ZNUpUSm1aV0U1TVROak9HSXROVEZoTnkwME1XSTNMVGcyT1RjdE9XWXdaREJoTnpJM05HRmhKVEptUlhoalpXeFdhV1YzWlhJdVpYaGxKbVJ2ZDI1c2IyRmtRWE05UlhoalpXd3RWbWxsZDJWeUxURXlNakF4TFdSd0xtVjRaUT09

http://www.bundleflashapps.com/WVl6OTRQWFZqSlRKR2JVMWtZV3g1VG1vNVFrNTZaRk55SlRKQ1RDVXlRalJ3WVNVeVJscG1lalJSTjJ4R2FUSlVSM2QwU1c1eFdTVXpSQ1pqUFhOaE1tOHdkVUpEYmt0dGNFdHRhbXQzUm1sbFVXTldhalpvTlRGR1ZtTTVaMGx6ZEV0SlltVndUR0UwVjBwMlZEWkdkRlJUZW1kS2MwWWxNa0kzZWt4VlJYTm9OalJ6Vm5GdFFXUkRKVEpDVEd3d2VsRnpUSEJ1Y0NVeVJtbzBUMHBqVEVFM0pUSkNaVEpQZGxKS1NtcHFRMjgxTlVoT05IQlJXRzFrSlRKQ1VFbFNXR2hUWmtsc2VVTnRUeVV5UW0xRWRWcFdNU1V5Um5oalJGRkVUM3BWVm5CQkpUTkVKVE5FSm1VOU1DWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpZU1V5WmlVeVptUnZkMjVzYjJGa0xtMXBZM0p2YzI5bWRDNWpiMjBsTW1aa2IzZHViRzloWkNVeVptVWxNbVpoSlRKbU9TVXlabVZoT1RFell6aGlMVFV4WVRjdE5ERmlOeTA0TmprM0xUbG1NR1F3WVRjeU56UmhZU1V5WmtWNFkyVnNWbWxsZDJWeUxtVjRaU1prYjNkdWJHOWhaRUZ6UFVWNFkyVnNMVlpwWlhkbGNpMHhNakl3TVMxa2NDNWxlR1U9

http://www.grabappsdownloads.com/WVl6OTRQWGM0WkdkTWRDVXlSbVZXZGpoc1FsaEtWbEF4UVU1TmNHc3hNRVJ3VVZOWE0zWnZPRGhSV25Ka2QxbG1TU1V6UkNaalBVUTJSekkyVDNwaFZVWlRRV0VsTWtKVmNIWmFiMEo2VTJaMVRVRndXVXhxWlRrM2JHaEZTV05CV0RoV1pscFZXRXhZU2xRbE1rWktOV0p6Tld0bEpUSkdkR1JGYVhNbE1rSnBkbVZpYjJkUU1HZzJSRFJJTWs5RlpXTjRSblYxVFZSUGVuWTRkMGhuUzFObWRFUktXVXBOZFdKR1RXSlhSa1J1U2lVeVFtcHVWVXBQT1dnbE1rSjJaM2xwU0ZoS2NVWkVNR3c0U0hCSFoyYzVhRlJvSlRKQ2NtOUJKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabVJ2ZDI1c2IyRmtMbTFwWTNKdmMyOW1kQzVqYjIwbE1tWmtiM2R1Ykc5aFpDVXlabVVsTW1aaEpUSm1PU1V5Wm1WaE9URXpZemhpTFRVeFlUY3ROREZpTnkwNE5qazNMVGxtTUdRd1lUY3lOelJoWVNVeVprVjRZMlZzVm1sbGQyVnlMbVY0WlNaa2IzZHViRzloWkVGelBVVjRZMlZzTFZacFpYZGxjaTB4TWpJd01TMWtjQzVsZUdVPQ==

http://www.worlddlstock.com/WVl6OTRQVVJVUjAxcU5ERmFkV05CYm1kb2NWUlpVMjFGTkRSQlZVTnZUV3B2YmpSamJWWTJabWh5ZGs5cloxRWxNMFFtWXoxTlZXdDRVbG93ZDNsMmQxbGFOMkZNVEd0TVVteGxZWEZtUVhnMlZDVXlRbE5KUlVKM2JFTkRRamd4VUU5RlV6Z2xNa1o1WWpGdmQwTkZiR3hHWVc1NlpqbFhjM2hRZVd4eFluSjBjVFZaYlhObVNFSXlPRWRSY0VOU09EVjNTVzlCZVdsR1VrZEhhRmh5U2pOUVYxcDBTWEUyY2xJMFVXeDRiSHBNUkRrbE1rSllOWE5NYVV0c01uQk9XakJJWm1jd1JGQjBTMk54V0RsQ1YzY2xNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5oSlRKbUpUSm1aRzkzYm14dllXUXViV2xqY205emIyWjBMbU52YlNVeVptUnZkMjVzYjJGa0pUSm1aU1V5Wm1FbE1tWTVKVEptWldFNU1UTmpPR0l0TlRGaE55MDBNV0kzTFRnMk9UY3RPV1l3WkRCaE56STNOR0ZoSlRKbVJYaGpaV3hXYVdWM1pYSXVaWGhsSm1SdmQyNXNiMkZrUVhNOVJYaGpaV3d0Vm1sbGQyVnlMVEV5TWpBeExXUndMbVY0WlE9PQ==

http://www.clearuniversecapital.com/WVl6OTRQVE51UVhkSUpUSkNVMnBuVTFaalFUbHdVV1UyT1dOMmFEbHFhRlZ3ZUU5NGVXUmhXaVV5Um14MlJFaEJNRlJGSlRORUptTTlkRzVLTVROeVIyNGxNa0kyVTJKWFVUQlhSMVpWVlRGVk5qRWxNa0pJYzFOUWVFeFNVVTlHY2s1TVZFeDJKVEpDYmxsM2FEVjFVakptZUdWdE1WUlFjRVpwZGxWMmNtZEVaVW94UkRFeFYxVTNkMWRDU3pNbE1rWlNNekZtVVVoSk1tVjBOVUZaVlNVeVJrWlVSbXczUjB0aVpsZGxiR05OT1RaclpFbERVWFZsY2pWeFMxVTVVVkpUSlRKQ1JIcFNlazVXYzFKa1ExbEJRbmxZYTJOeFptVjNKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabVJ2ZDI1c2IyRmtMbTFwWTNKdmMyOW1kQzVqYjIwbE1tWmtiM2R1Ykc5aFpDVXlabVVsTW1aaEpUSm1PU1V5Wm1WaE9URXpZemhpTFRVeFlUY3ROREZpTnkwNE5qazNMVGxtTUdRd1lUY3lOelJoWVNVeVprVjRZMlZzVm1sbGQyVnlMbVY0WlNaa2IzZHViRzloWkVGelBVVjRZMlZzTFZacFpYZGxjaTB4TWpJd01TMWtjQzVsZUdVPQ==

http://www.grabappsdownloads.com/WVl6OTRQVGxIU2s5T1VUWlZNSGc1VVhoc2QyZGhObEE1VUcxbE5IQlBkbEJDZUdsd2FsQllkamR4V200d2FqUWxNMFFtWXoxTlEweDZkMEpJVFhodE9WUTNRbmcxYTNOSVpraE5Rak5hVDJwdE4xTmpia1pISlRKQ1puTnFSbXRsVDFSdFpDVXlRbWwzWTFwT1JFMW9URlp6YlZGTmIwSkVSMVpuVEVkUGMxZEtTRkJxVjFnNWNWcFFVMnBqYjNKclJXczBNVE4zY2tGUmExcHlUblZ5ZWtGVWRqaFZWeVV5Um14aGRtaFhhRFZxVlNVeVJsZHRObmx6VTJWU01tVm1kR3hLYzFOV1YwOU5UR0kzVjNOMWFFMDFaeVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVprYjNkdWJHOWhaQzV0YVdOeWIzTnZablF1WTI5dEpUSm1aRzkzYm14dllXUWxNbVpsSlRKbVlTVXlaamtsTW1abFlUa3hNMk00WWkwMU1XRTNMVFF4WWpjdE9EWTVOeTA1WmpCa01HRTNNamMwWVdFbE1tWkZlR05sYkZacFpYZGxjaTVsZUdVbVpHOTNibXh2WVdSQmN6MUZlR05sYkMxV2FXVjNaWEl0TVRJeU1ERXRaSEF1WlhobA==

http://www.stockbundlecentral.com/WVl6OTRQVnBHTW1RbE1rWXlSVnBDYTBOd2NHZEJSVTlFUzNsdGJHODFKVEpHU2tOa2FGbGhVRGdsTWtKRGFsTnRSa3hFUmxVbE0wUW1ZejF2VVZNMFUyRnVWbk5DTW5ZM1pDVXlSbU5IVUZkdk0yUjBiRWhHTmxodFpHRkxNVFY1VVVRbE1rWklkbkpKZVdKNmF6VnpSMHg0WnpWWU5GRkVXa1YwV2sxRU9DVXlSa2RFT1RGMlZrcE9WM05vV0U1RFkzUnZlbG8zVFdaUE1GUm9Nemh4VFdJbE1rSnVkSFpIUzIxYU1rbEhWMmxQWnlVeVFtdEZZM05tYWtWR1NuVk5iMHhqTUNVeVFtVTRaemt4VEdwbWFDVXlRbEl6V0daQk1sWnJhVWc0WnlVelJDVXpSQ1psUFRBbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0yRWxNbVlsTW1aa2IzZHViRzloWkM1dGFXTnliM052Wm5RdVkyOXRKVEptWkc5M2JteHZZV1FsTW1abEpUSm1ZU1V5WmprbE1tWmxZVGt4TTJNNFlpMDFNV0UzTFRReFlqY3RPRFk1TnkwNVpqQmtNR0UzTWpjMFlXRWxNbVpGZUdObGJGWnBaWGRsY2k1bGVHVW1aRzkzYm14dllXUkJjejFGZUdObGJDMVdhV1YzWlhJdE1USXlNREV0WkhBdVpYaGw=

http://www.worlddlstock.com/WVl6OTRQVWRGWTJWQ00wZDZaa00yVEdGVVpFeDFXbk5tYjBaUE5uZzViWFUxTUd4SUpUSkNlbXBYVlVkRGJXRjBieVV6UkNaalBVd3dOa05zTms0d2MwOHpjRFF5Ym5wRFJHRlphakZNWW5kdGNHOVllVE00V1VKNlJUWkpUekZaVG1VeFdHVkdTbU5zYldwTVVUSm5SemhQVkdoT05ESm1UekpKVkNVeVFsUXpOMUpFTVUxbVFXeDFjRlpLZFVoVWRYZzJTMHBKWVdwTmJXeHlORlZuTjBSR2RVdEhiSFV4U0VSaWNraEZNRzVoVFdoc1ltbFRWR1JqVDFkcVFqTkdNbWhGTlcxYU0yWjFiM2xSV0VkbkpUTkVKVE5FSm1VOU1DWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpZU1V5WmlVeVptUnZkMjVzYjJGa0xtMXBZM0p2YzI5bWRDNWpiMjBsTW1aa2IzZHViRzloWkNVeVptVWxNbVpoSlRKbU9TVXlabVZoT1RFell6aGlMVFV4WVRjdE5ERmlOeTA0TmprM0xUbG1NR1F3WVRjeU56UmhZU1V5WmtWNFkyVnNWbWxsZDJWeUxtVjRaU1prYjNkdWJHOWhaRUZ6UFVWNFkyVnNMVlpwWlhkbGNpMHhNakl3TVMxa2NDNWxlR1U9

http://www.tagtowerscapital.com/WVl6OTRQVTVhV1VobGExRjBNV1ZsWTFWWU1YcENkR0pKVjNWeGIxTlFNbVZRVlNVeVJsZzBKVEpHUVhoRlRETjVZVEZqSlRORUptTTllRVpSUVVvM2RYUm5UMmw2VVhSWFJrRjVObUlsTWtKNFVHSjZaMFJ3V0cwMVdVRTRkbnBPVkhSUE5XVmFVVFJaVVZWSEpUSkdjalF5Y21reVZHRXpiMlJLVDJsUGRHOW1SM2dsTWtaTU1tdGxVVkpGVHlVeVJrOUtNSE5sWXpSRlUzaGtiR05EU1RaVE5GbHFVWEV5UTFWWWVGTkVjbXRSVG14eU9YUlJOV2x0TURWM2IzbzJkWGx5Y2swNFZVTXdPVFZXTkd4cFNFWjJUMkZ5U0djbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbVpHOTNibXh2WVdRdWJXbGpjbTl6YjJaMExtTnZiU1V5Wm1SdmQyNXNiMkZrSlRKbVpTVXlabUVsTW1ZNUpUSm1aV0U1TVROak9HSXROVEZoTnkwME1XSTNMVGcyT1RjdE9XWXdaREJoTnpJM05HRmhKVEptUlhoalpXeFdhV1YzWlhJdVpYaGxKbVJ2ZDI1c2IyRmtRWE05UlhoalpXd3RWbWxsZDJWeUxURXlNakF4TFdSd0xtVjRaUT09

http://www.tagtowerscapital.com/WVl6OTRQWEZFTkVoTFpTVXlSbXh0U0VsaVVXZFBZamRtZUhreWJEaFhTSFV6UmtsNlpFdHhNMVUxWWprM2JraEVVU1V6UkNaalBXeGtNbVExWkZwSmFEaHFXVVozT0RCRVZYTnRPVlJLWjJWRFVuUnljMGd4VlZORFUyczVXRXQ1YVZwNU9VaFdPR3RqUW1VNFNHNDFVV1ppSlRKQ1JuWmhSRmh3Y0ZZNVlrcHJTU1V5UmpkMmNIbExUV0U1UzFFMVMyRndZMWxaYW1wQk0yUk5UR2xPVEZJMVVHNXZialZqWWxOQ1MzbFhZMmR4U0ROMFdWaGFXWGhFZFdwSE9FTnRiVTF4Y2lVeVJsVlhSMFF6V1ZRbE1rSk9lbTVuSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm1SdmQyNXNiMkZrTG0xcFkzSnZjMjltZEM1amIyMGxNbVprYjNkdWJHOWhaQ1V5Wm1VbE1tWmhKVEptT1NVeVptVmhPVEV6WXpoaUxUVXhZVGN0TkRGaU55MDROamszTFRsbU1HUXdZVGN5TnpSaFlTVXlaa1Y0WTJWc1ZtbGxkMlZ5TG1WNFpTWmtiM2R1Ykc5aFpFRnpQVVY0WTJWc0xWWnBaWGRsY2kweE1qSXdNUzFrY0M1bGVHVT0=

Remove excel-viewer-12201-dp.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.