home

five-nights-at-freddys.exe

Rubira

Quality Install (Alpha Criteria Ltd.)

The application five-nights-at-freddys.exe, “Rubira Setup ” by Quality Install (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.appsworlddelivery.com and multiple other hosts.
Publisher:
Quality Install (Alpha Criteria Ltd.)  (signed and verified)

Product:
Rubira

Description:
Rubira Setup

Version:
3.6.4.5

MD5:
57f0b4e5e2c8601ed75703c6858cef6a

SHA-1:
e976510c63056900ecbbe5db983e18d1b32c27cf

SHA-256:
886ddf8c947e38e334867150ef3de64a0b68b40a0726fcf1f0ed7a6e42909b9e

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/28/2024 4:42:59 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC.Installer (M)
16.7.12.13

File size:
1011 KB (1,035,280 bytes)

Product version:
1.6

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\five-nights-at-freddys.exe

Digital Signature
Signed by:
Quality Install (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
1/6/2016 2:14:15 PM

Valid to:
8/4/2016 4:59:05 PM

Subject:
CN=Quality Install (Alpha Criteria Ltd.), O=Quality Install (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121BA484E4C31175E4A844ED055428DEC42

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:0ifk0su4mZWcj82/3pYRA0FRfXVOs8OMBTlP0QjcpMXVJo:JpZWcjz/90UWGpf

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file five-nights-at-freddys.exe has been seen being distributed by the following 3 URLs.

http://www.appsworlddelivery.com/IBpFlxbYWhOn13mYfPXI6a_ha9_bjZ9jlMpbe1QVGD QT8N1EtvGSxh95B5MSBMsezbnx7z3zZN3fmyVn6j37vP1Ncspzm8jUFf55l0H0Uk8yqU0QaLuAL5JRzbTasfT22i7437gxGWK03QrQWqPhZpaNbWKBMKmRJW5bERIBPPoPhhVrE Eq pObYYLpAggCPRfVpr1apFndd4uMkr VBXqQqFRqw==-GzsAAERPFtMpj8WGKlzAMQ54QL1eFhvHG9s8kG7MgAwLhSB2et0oYE2IRX2fL6sr

http://www.appsworlddelivery.com/1D9Xd6DSmeyda3Lf9fwFbIWWT15KDZUdnuiNEWF7HBwOBilsyVSkJLwS2f5t_g7dqr0lA4V V_Af54o0cPeSa GhK GjpG99IBZDKZaG1_0rDtkMwBnuNViYVWBud4UI0ZCqb8nWlx1RGwXdjotOTuSKQ2hq9yJHOhTUeJx3QtNejFdFGiOgyoITpF b4BCZb kB1I0YKFocI1Pysgf3FNLvVvlWEw==-GzsAAERPFtMpj8WGKlzAMQ54QL1eFhvHG9s8kG7MgAwLhSB2et0oYE2IRX2fL6sr

http://www.appsworlddelivery.com/Op2yXjQtupi_s9ugoDcGk6D16nc63Anei_ca6do1fjNoO_y4dFDIHYPASlsl8MyBN97uyhW6ZetnXWv2OQOfkPwFGuXmnaMbso8_WuSr kJ9Gs8buYdav63xKJLxVmWDM2yplji696rZss2YYgnLXekrYHBlcgq50NdzVP0BDtVcA3OhtV9lRv5DUNNB6 VKAIMJDsTbw_ZVZ7DkSWsGDPWoszZ3XSE6O0yPjOXNRBJtldqjSVmzFzo3Q7n8mM9ouQVQAYvhD17V27l6nGGvFxIol26GPRuqqZiYTUWGxtiI lq8o7RT48z63InZYw40zbl VwA R30BWUaoZm2x_ggwUxGnED 3eLJFBuWWEU2CPJ8FJySndMb_hfnavRDAPcqq3jPqGMt5qnrQg3luP2c0VGMzj5_QkpNDOIvvyeYrMcXZqHgpMUZyQC4K2JXui07c YCFMZ2KivUBExOzDxZdy83QqqxjioG6Fpj 1V3D XVzBE1bd1x2Ok2knM7oFLK4iCjvGxdJniUmwplqDnvbAEb2T7S0XRvhfRqFcMQAFGX3D875ro9ticQz6GM6I0DUKLiS6C5l_V4EtNcHPcHZyl0ZgfNuppYeHLMZpLHtDjTo2ak=-GzsAAERPFtMpj8WGKlzAMQ54QL1eFhvHG9s8kG7MgAwLhSB2et0oYE2IRX2fL6sr-e

Remove five-nights-at-freddys.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.