home

foxit-pdf-reader-7-0-3-916-32-bits.exe

Swift Funnel (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application foxit-pdf-reader-7-0-3-916-32-bits.exe by Swift Funnel (Fried Cookie) has been detected as adware by 3 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from d.baixakifiles2.com and multiple other hosts.
Publisher:
Swift Funnel (Fried Cookie Ltd.)  (signed and verified)

MD5:
98d2388ee8bbb661d6aab98d243d5153

SHA-1:
0fbc6660ed268ce0b6346e51875ef1e217c4b9f6

SHA-256:
26cf3b1ddabb7320cea93069359fe196a1a03cdb6e4ba069d12aedfa1cfdd25a

Scanner detections:
3 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
12/27/2024 2:44:06 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
ADWARE/InstallCore.Gen7
7.11.184.126

ESET NOD32
Win32/InstallCore.RO (variant)
8.10708

VIPRE Antivirus
InstallCore
34712

File size:
698.9 KB (715,672 bytes)

Product version:
1.5

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\foxit-pdf-reader-7-0-3-916-32-bits.exe

Digital Signature
Signed by:
Swift Funnel (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
11/4/2014 3:05:02 PM

Valid to:
11/5/2015 3:05:02 PM

Subject:
CN=Swift Funnel (Fried Cookie Ltd.), O=Swift Funnel (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11219222B1C3CFE5BB71BCB5117BC2A44FC6

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:PT2aBIZBhDJLKc7NlZ2llDPkRZ1PZZrspGqNUHUBxvrQkgEm/XFjwHXwAbd2yZR0:PT2YIlw2yDMRdZrxqNyUB5rQkklwHvbK

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file foxit-pdf-reader-7-0-3-916-32-bits.exe has been seen being distributed by the following 2 URLs.

http://d.baixakifiles2.com/?ic_user_id=254&data=4PF1dz2rvHQvZCGD3cVpFfbNqVvckJCZl8kg7e66T348PRyVPur1LycongD0bMDYYflfHQZOCIaFFqF4vrECXUmLg4AkFmH2FJ5CMD7KKGrnDH34p5wjdmTml1jC6Jn6HzIkFjwWFNfOw8Vg6KC04 lUi/hkZG1DC74j6S2wKKS1qUDyWEGK1w/jYwvOcBnO8fBqSdwLWQ9JJ4MXUolV6JNq48fqXqr/x1qZe2pI 7i0Db5t/eXLICmHrvaZVxF1vV/6SNDREiuhIXLn9WkFey0JPenuEisZXDyFMr9/WtkWjJd2tAdpmEghvZxABZWrxaLRmNj29SBHpXZMyaJTVsBBFnn7D/1fUC2ozH/AUDDQHIgJcL1HxQGI/OrZPb5YS2yUCzAUaaEqt310rEBdKgDyqXG6fbdUCwGpb06u8NkbEdUelHhlcFN9sHhcF9T9EZq0czRfGKDfjMaJAVsvUbJiZHcDudtkiHP wJw2mdGI5gQEKRJQcSTMs6nyyxyxvjLRkcLn8QmGdcW3MjMqyTGQvor1IVPSY4KBYTKUDWgGLZqzpucF9Ug1By MR43C p9EEqRy6g6udQJqawAlxPKo8SDZ/wyik0hqVAjJQvaHlWvar5wc9AEG5AuqPLIcMcznEyu3RF0BYJIJYIneumJKjIFkmsU23rifH76QUu/1sm3WTqvBGXuGn0Pw5t4IjuzzlDKTWjPvdnjLDv/YzQIJRB0pUw8H41Z0gTj4JBEX/TlaaF5khgZEbOrZZLkMH AtuwZml5rSeay2haZptvpGJPigwURgEQXqPzEotgMbculvn1/.../SAAKBLsEbi4Tk=&key=eDGfB8GAEPgyKAJgvS5LiKJAlD3vb6IgTLYUSr7FfcP93bjFcK7hDfscxsly6CaQGmtKAd23ybmS4PIBpbocKlYfHFtuP7Fy7m6WrJR

http://d.baixakifiles41.com/?ic_user_id=254&data=bouSiZ 9ZuZDCCW00feACYZwIN/xfD55/8i5/VJfwIhi7qRyPHmKMNP42YRttVlIwW0Hp0KaaoFz6rpFK1dIQzJIYVL4GZ9Y0AZwhOGKs8UhbpnYg9d0i1y7hmk5QF3scNTu/rwuMzw2wAR1Ub0/3CvH2e5WG5yZynLKH597KnNKDiXLkPmQXW2xWY3ni/0iF/8n/pLLrJDZ53Z4xREhzavjO/a1CY18EPGimqadvNI32pe5PJ8fIxWnUG1oIZrXO/Q96Uef71rxF3c Co4LS4esUu26GHkEhziFadAc/buv6inasYsN/dr5BXByDxUx3qs1UVtm6Z6G5qji3mSeKTSykjva5n1AQyZUJezl7QGBwB7DWj/04Kb0o4c CL9396VHBFeYnu6Hy6Br3lujbTwKUlUw5grDvhZNtqoAhp3wulaBiVCx 2pzvsF1QoGotYgkICBGyB y8LvrtMDg1M0QlXU2o nqBGabTHPp1YHklMcM3qRxICFPJnuQF0BjbAbWqmpmp3U0XMFcgo8Td1LrWX116vAPJ7DNIilgaiTXy3eK2I9O6CFalCllcfsBI EZwqaVyFF7YyEroW3x/YE28AogA2t0YL0mYQJs0Fgv2SzQ9KpzRei55oKqNqooRJylWXWfhkoaTao4Lvm/.../NDsarxXczT8wvSEivPC7x7ml0w97MALqLYs1BV9zu6Z2xZxJFkE64IJzfDMk77DL65oNp0cNM VkFYDFjogsBIPgKh68p690GkpPw2SIO6etYyAqNSzxH56Qr0nv07udTpvGyAEay4lAB8i2xonp4kh6pkuyNcxVPYmEFSwvUrEE=&key=APeBJ19jIdCCWMTREKyfkCYUxbtW0nJ4zj8zrII2vmcMkx4Rw JvfFCrEkmt0AH9rNQ7YR48nV5Q0ox7BqbP0Vpz6bpG99tzPaHMXb

Remove foxit-pdf-reader-7-0-3-916-32-bits.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.