home

freedvdripperplatinum.exe

Refa

Lufeceper

The application freedvdripperplatinum.exe, “Refa Setup ” has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Lufeceper

Product:
Refa

Description:
Refa Setup

MD5:
e475d9a10266b4c1abb2d25950f8f5b4

SHA-1:
99f257bf43c3666e83138dd01d20065fb5085d91

SHA-256:
12dec2ed2fcaab67dffe7b822903fc5c823116ba4ebbb040b15a11a0d3a75b75

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/6/2024 10:15:57 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.RE11 (M)
16.4.16.20

File size:
918.1 KB (940,129 bytes)

Product version:
4.7.4

Copyright:
Soft

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\freedvdripperplatinum.exe

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:+0LMHFjlzdniCJIhNeOH67MrjK1whaFzJPhwm4YG:+/lBQCOpMyeTFz7wR

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file freedvdripperplatinum.exe has been seen being distributed by the following 4 URLs.

http://www.universeconecpttour.com/WVl6OTRQV1U1U1dkcmRHVk1aRGxaVFhkd2NYTnlTeVV5UmxZMmNtZFNhSFUxVUhsdmExWXpUa1kwZUU0NFNrTmFNQ1V6UkNaalBXOVJOU1V5UWtSVmMzb2xNa1k1U1ZsbmFVUktVRkl4ZW5kaVF6VXpKVEpDWjFrd1QwMXFaM1V6U1NVeVFsSlJORGxTTjFWVlNGcGplVTlFTVVSa1RIQlZPVGhUVGpKa1NrSnBTREZtVnpkc1NtWlBZWEZSUkd4VmVsbE1jU1V5UmtOaVpqZzVRWFl3T1VjMGNYZ3pWa05oU210RFFXMXNaVXRCYTBwSlVUQk1ibTR5VDNaWFRTVXlSbE4ySm1SdmQyNXNiMkZrUVhNOVJuSmxaVVJXUkZKcGNIQmxjbEJzWVhScGJuVnRMbVY0WlNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVelFTVXlSaVV5Um5kM2R5NWtiM2R1Ykc5aFpHOXVhV011WTI5dEpUSkdabkpsWldGMVpHbHZkbWxrWlc5emIyWjBMbU52YlNVeVJtWnBiR1Z6Wkc5M2JteHZZV1FsTWtaR2NtVmxSRlpFVW1sd2NHVnlVR3hoZEdsdWRXMWZTVk11WlhobA==

http://www.universeconecpttour.com/WVl6OTRQVWhsSlRKQ1RtMURWVVZQZVVaRVNIRkhNRXBOY0U5VlJqRlpNV1pESlRKR09WSm9lalV6ZUdwNFduVTNWM1pqSlRORUptTTllVWRqZEZWYVRIcDZNMlpuTURkcFZXZEhlbmxaUVdOR05XOVRVRVJaT0ZKb1ZWbFlRbTlLWWtKNmFqVjJhR1o0UWxwWVJXbFllR3RhZHpKRVZYUnJOMUJEUjNaaWNEa3lXRTVUVTBwSWNVcHVOM0p1ZUZkWFkyMHdaMGt5VWtkMGNHVnVhRmhJY1hJbE1rSkxiMmhQWldNNE1GcFhaekF6UkU4bE1rSTBiVk4wZDFGSUptUnZkMjVzYjJGa1FYTTlSbkpsWlVSV1JGSnBjSEJsY2xCc1lYUnBiblZ0TG1WNFpTWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpRU1V5UmlVeVJuZDNkeTVrYjNkdWJHOWhaRzl1YVdNdVkyOXRKVEpHWm5KbFpXRjFaR2x2ZG1sa1pXOXpiMlowTG1OdmJTVXlSbVpwYkdWelpHOTNibXh2WVdRbE1rWkdjbVZsUkZaRVVtbHdjR1Z5VUd4aGRHbHVkVzFmU1ZNdVpYaGw=

http://www.appstodayfactory.com/WVl6OTRQVWwzUjFwQlZrVjBhVTltV2xGSGJEZE9KVEpDWjJkS1lqRkRVVEJuZUc1bk1pVXlRa0ZWV0c1Wk5FVkxUMU5CSlRORUptTTlPRkl4WWlVeVFrMVJTWFoxYzNkdFdrNU5KVEpDY3pJbE1rSmtSMVFsTWtKblZGWlFaVGN5U1dFMUpUSkdjSEpGVEhoNlRHTjJRbWxvVGs4bE1rWk5kbTlFY0VKNUpUSkNNbE5yTTBaaVlVWnRka1F4VGxKTEpUSkNkemhPY21sSVYwVldlSEl4YldVMk4ybElXV3hpVFdaR2RVcFpRMDhsTWtaWmNGSnFibU4xWlVkak5IZEpUa1YyYTNOamVHeHRibWNtWkc5M2JteHZZV1JCY3oxR2NtVmxSRlpFVW1sd2NHVnlVR3hoZEdsdWRXMHVaWGhsSm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROQkpUSkdKVEpHZDNkM0xtUnZkMjVzYjJGa2IyNXBZeTVqYjIwbE1rWm1jbVZsWVhWa2FXOTJhV1JsYjNOdlpuUXVZMjl0SlRKR1ptbHNaWE5rYjNkdWJHOWhaQ1V5UmtaeVpXVkVWa1JTYVhCd1pYSlFiR0YwYVc1MWJWOUpVeTVsZUdVPQ==

http://www.appstodayfactory.com/WVl6OTRQV1JKVms1eE1EbHZTVTV1VkhsSFYyMVJVVUkyZDFkQlEyazBjblF6YnpkbGVYVm1aVFpzVkdWWFZtY2xNMFFtWXoxSFowbFFaak5RU1hjNWVuRmxVelp2WlRsNFl6RTRjazlYVVhoclVXcExSa041WkV0VkpUSkdibXBLY0RSclZYVjZNR2xyVnlVeVJtbE5aRk5YVEZkaWFHdFpOa05tSlRKQ0pUSkdVREpTT1dkSmVrZG1jMkp3U1ZsalMyUjRaVU4xTVdFd1RrdzFiMHhPWlcwNFZHMU5VSFZNVVd0cWFraHlKVEpDT1hKSVpFWTJha05KZW1oYVlVVW1aRzkzYm14dllXUkJjejFHY21WbFJGWkVVbWx3Y0dWeVVHeGhkR2x1ZFcwdVpYaGxKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5CSlRKR0pUSkdkM2QzTG1SdmQyNXNiMkZrYjI1cFl5NWpiMjBsTWtabWNtVmxZWFZrYVc5MmFXUmxiM052Wm5RdVkyOXRKVEpHWm1sc1pYTmtiM2R1Ykc5aFpDVXlSa1p5WldWRVZrUlNhWEJ3WlhKUWJHRjBhVzUxYlY5SlV5NWxlR1U9

Remove freedvdripperplatinum.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.