home

facerig.exe

Des

PlatformPrompt (Alpha Criteria Ltd.)

The application facerig.exe, “Des Setup ” by PlatformPrompt (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.giftchuckleflash.com and multiple other hosts.
Publisher:
Dogosifuso   (signed by PlatformPrompt (Alpha Criteria Ltd.))

Product:
Des

Description:
Des Setup

Version:
2.6.5.0

MD5:
9c0e3e4e1e8d94815e95d80973b611cf

SHA-1:
e98b1845dea3df68f0df0bffdfe9d8990affeb1c

SHA-256:
b1531cd42210c5b7cdb33ede7174c32a620b4e671f736f487f5e2d2cdc244d1e

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/25/2024 1:34:36 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC (M)
16.8.11.1

File size:
952 KB (974,848 bytes)

Product version:
3.4.8

Copyright:
Stub Web

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\facerig.exe

Digital Signature
Signed by:
PlatformPrompt (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 8:17:26 AM

Valid to:
9/2/2016 7:02:46 AM

Subject:
CN=PlatformPrompt (Alpha Criteria Ltd.), O=PlatformPrompt (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112111817CD313A533F2A76178D4452F81A6

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Q7vDPwUFhDqNzcU16jVXw4VXNLnMXugux2TrhbIC:QjzwUFJqpKpVxnMXvq2TdbIC

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file facerig.exe has been seen being distributed by the following 4 URLs.

http://www.giftchuckleflash.com/sLsb2tQX3QaGfiT8CR2OfSl_J6JkaWP2jXoHJmu9kSQT8aFzpHBChPhAsbGStE6JdSdYiIKfirsK4d1HcD8R2VS0yDdoUOYKUMvcN hTqYqdYCxd5tP6HFDRfBmKljsC1C5mWfk4YnD3TJyPkq1NuoiaX1AfkUOZAssJpKWkk6I4Q1nWkKeg3fsVi_uam5zn84U2oYI_-G04AAGRina19lHDd2GADDlwSCgMd0O5M2z4Nz3MsAX7Bcdv2ZinSTCHx8zX2YPtvpfsRcAyJzDpFg1a_0N0k3OxYmQRoBQSnYJLGYIIB

http://www.giftchuckleflash.com/bwbSrjYkl5I5CHtHcAM3Cg5K0IK4rimcsCVFk7bxdcTaelWBxI9GHZu99R8evw8qws506xn7VGiFG vv8PHSRLY96J wfb1d6n59LnhYApLRhBvA_v5fwIWCRBrSa3121_HRJh zdqgfnQPw1xHsZB2w6aYngKGTqzORwDyb6LjHoLPebFacF_1VILyTV zxLdNpJ1NC-G04AAGRgnq0t0slM1m_YgAOXKMBx0AFp2IADTWu44_N5XgL9gtO H 26KEoAhR_vaQC7byc9nkLRrfhAUM7vQrZcl8f_ED_oAegEBKcQGIck

http://www.giftchuckleflash.com/nq7GcpwlEPJPvcGJckqqHT5TxZay_UPVgpcBEKw1RiAxiMeOmLgo7hJsCwGosZ8q2kYkAkCygny5LMgFBmAhK UwfRMBAqSFn0t0CMXyN05QYtwc_KxqegPMTvLWboOOwmIWBk1xkySw1hmHVrI87jm5PZ3VR03hCNGx2K4zk qb_4uRTnwOzudey1TQewK4g66anEDF-G04AAGRwXmuLO8AKR0CwAQcuCYWBDmh3pm2fuuvalgC_sF WtZqKtH1E_Hz0Lay_WjkvqTKClyvQP86716hRDfUZd_FALWEkg EohaI0

http://www.giftchuckleflash.com/6SJz23O6kqfHn1elIRnjF7eEYELarPfoGLWV0t3FpJ5Q_Zs opGgiN1uxW2D4La7vvWCZKd4br7zFb9HLNzVsi1h7LNQw3f75aBqPm5AU8luKuNFEH08YeBMJW0VCP7gKh86O7zHrRccBpe8y8ZH1Kzaa9KXFlieRO1U80Q2LqH6qrrgAwq4aIf8elEwRf RjA4ajGDs JxGVGMJFrBo70vi WRU8HH35qEtjf29xuxzPRU0wah2G53IvcNhPkvYdkMxzgPnv MIFbgZzAW rL3tOYVUF3dTHjcT jDfmPwwyLTDAkC07wg8oGlI5Io5t5eGK8z93zQn03X5HJ8jF96IxCaRb gr_35pHKrP g4g GVAzy9t7fTnc60vgxDi3GJ3r 61D Ow7ufnB6efU0UlOrj1fpDIOhJk42NWwiYLv92tywMtNDTIp6WQbjNles5qqBaWfGy7WiVRMSVrGMzCaHtPhhDOeX7RW1PIpep1xAPTSwl d59Tkqfbdq ISL8aybM qKwzqfyli29t2EohSjtdnFEIfc4hceHf0QbE7ac0Mbs=-G04AAGRgnq0tAkxytA_YgAOXhMJAB7Q707ZP_X3vS4BfcFjXrZ6LNANI_HwOHdh8G m6hXxJ_lmx_ KvdbqoE2WT9o8VoBEQnIJpmkYpCg==-e

Remove facerig.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.