home

freefileviewersetup.exe

Hego

MaxSpeedy (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application freefileviewersetup.exe, “Hego Setup ” by MaxSpeedy (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
MaxSpeedy (Fried Cookie Ltd.)  (signed and verified)

Product:
Hego

Description:
Hego Setup

Version:
4.8.4.8

MD5:
f07257aadf300b22b3341c533669c1f5

SHA-1:
156a13ffafddd31f23a1abd5e859fdf3cf0a311f

SHA-256:
ce18ddadc77f682f23a5c6ccff9e9222c4f6d942faf2f7aa00bb0d37c794c36e

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/15/2024 7:46:00 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.5.11.12

File size:
1023.6 KB (1,048,168 bytes)

Product version:
3.3

Copyright:
Wizard

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\freefileviewersetup.exe

Digital Signature
Signed by:
MaxSpeedy (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 3:11:09 PM

Valid to:
6/8/2016 6:06:58 PM

Subject:
CN=MaxSpeedy (Fried Cookie Ltd.), O=MaxSpeedy (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112125C58A41E827F13C76AD2A1D648B8808

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:FrMkm71ZVBFD8jFFZdJG41wiBAgHJ645iIkLOXmUGAoshfb:FoDFw3EmnWgHJoLOXFGAospb

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9195

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file freefileviewersetup.exe has been seen being distributed by the following 19 URLs.

http://www.flashhostingapp.com/c?x=IdrTW1OmrRt/gazt4hGlHKNyyK7SwgabeRrBlUH5y2k=&c=zfGU8Y81Qt7wlDecz8bVSvDw5R5QCTkPiVcjPZg8otP8XYR5L19zaBOWISTfxyuYXOZDCZkg3W98FQMOogfApoloisyGAnL555OH7CGk0TbK8PowezijZUDTfSKb3N8n&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.flashhostingapp.com/c?x=QbVH6KCsZ7bJ8PHrIXfCoGVNSu9YCpBV0VdhxksitbQ=&c=/tUn8WJeyp9GRcIIXEk82vk5iwcuiwLhzTiEZoYIIhGIIhIlkI3YNmR985ahINXH3v/ngwbgm3WLtxePP2AO8CDwV8PD9QyaDqvfDX9r3qfA5zZh8c/UI03Rre1e2hsU&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.bundlesheadsign.com/c?x=giKgZQFTooKTpmiNbXFEjZfnYw5uogIpCnpDp98yZ1o=&c=20Lz21as3KkFWA98MhFTlkFYIY0L16XVKCU1eA M8p5Usz3cvqT4wjfUEtigXnS6zhKuwDKcYrIFRqU E7gbQZlxqHoQCb0AbAag9NPsTF5gtzAqj5uomNrgFqdYZvFg&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.bundlesheadsign.com/c?x=5ci26cOvkV6nPYDAgOBVxatFdTKZlc1QK93Rrn9bONM=&c=DbGzYBwW78H0SdpSeWKJ5E5Cal22lwzYszB6ovKDYfQItSVaEzGA DYPjEnpoJHb2nsyWJlqVDfwDy67li6qjTZJg3RguuU8tbxEt4b9LG9vxzxmBmAgrCpY1XjHCqD1&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.conceptsguardbinaries.com/c?x=msik7DM2ejL8Zf7lm6YP1gDhV7f7fjwdNz3teY0SHGo=&c=D0o f28BrZ6DQyJbM5kPdXmxQrySfLN8fkJtaNHHFOKuiKeKn8VtnbvNirlgOWJOnofOq7mmBC yi5aF/yaCy8n8c0mmLpwk5pCLtMLnuamWp6YFFUX2DwdH sO dPV8&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.presentheadbody.com/c?x=F07CyJiPsVLT95oa90D98FiE hXFFnCswRRhIKifwTk=&c=n6TLy0Ys7QXwbfstEShXxNuQYyVsEImPhsMFrR8E/7jpsKZO4HdxR7Xbd4tY0JGGUjzfYVFDmxa4A6p5oogpIH3U7xvQeT 1de4F2VL41I0aBaa3u4X7wF8eFa2mosAQ&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.presentheadbody.com/c?x=57uO8oDh 4GeCwURWRdcIkWOO6te19SiW4NpnmSECbs=&c=/z2h0OYJZbsMuKkQvW2 8xRhEW39VI1JtVns3sqtkaqz 82ipG6ayOyT1k qsbIp3Kr6MLtmKKbA6AvM6KAztCsCxD6oQtkjbA9lNSMMLwhwvtabvliKXbY6BIP87f2i&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.bundlecentralsign.com/c?x=Z9/Z5JunoceNLpciTtEJh9nqNZLO 7QXUNdCkDGXEt4=&c=IHLV namr6Cn2NWdqiisFDYSDQnsbckVobVsrrxweOSxwZ2miZjvjjuR8iJ2W1v4/3kPQ33raTu SMkpjhWqNOQuKrzibwUTNfXMKQ23h K/awVEe vW6nxMX6urXPob&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.flashhostingapp.com/c?x=re9DBeBnapVOVYlFtYnilJbjkX S1nqJmkjDTKRS1l4=&c=aX4IiBpMoleHwZDYd/DiSDgw5kyiRPS30ODRtAZmrsxnN7gjffu7Hg7ch NjPmK415zfpjcbh6gXShZoK/xf09UVGtD8oosa15JDOE ut82jJDfc8clGjqxKTP ZlUM&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.bundlesheadsign.com/c?x=F61A2sKFZ4re2dRA7243MldZgXWvcNrRK9TQyrAh9MI=&c=SV8blKpXOEry0tAXJLhsZNDEFxwzUQ3B/jflv3qzbraIgXQId1gLqltwMLNEnMgMo3ICalgTrHAdfgr5fXJyV6oyUOnh6lsh4AI82Gy5rKDFxTmOhqgq9pW/g5JViVKp&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.flashhostingapp.com/c?x=d5h2 pKo52PLJoqWQs1g52YhQuADBuU8Xtzt7n9lPU=&c=/pV3RKJaCUdKGHlR/2Mu9 2neOj/q hZR72Dj0thklgKQ1oh vE2icfNE0qFkizlZXUTnoMn4Ws9avg9daMuQPyfk02voiL 6pjr40AkPlPesis430PlZLXj dUm8LDE&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.presentheadbody.com/c?x=vjKAmIPONeWZthyjrLPeDvH34AQRpENVodjgjb4r6es=&c=Ag9PfMlsNq8nttJ/Z S72rkYYqrrBX/fr/u3D2R2VJa7vP/gmF8Cgno7lAuFWYQZFUKEZgXWW6 MVuVHZs9zaOo6KKzJq3hzndF9YQH F wtGwb5SduLRcU2bsSlsDa&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.flashhostingapp.com/c?x=V6TeUcsb 8ZtcM15yVPJmnwZkSlIL3bt3oyfPoZLWjs=&c= GZfXfbFFh2RFNLW4oPTN9Co5eqJgiNZ3ILMlUajn/ 5IOJRUob63TcWZ0fQaSDk9Q9gaPox3EBTmGUybfVp6pzRDGNf4 k2lzEzDVhWIpTPbdvwUx3Z1fuTLDPF0A8I&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.presentheadbody.com/c?x=8wr0oTSwWidqdOyvWWBvO 7AQieUGchDrmFU6BjZGkU=&c=MZPHLRbH0KKWU63t8aE2iYhHEV4Pu4tfLAzfbCuVNbbylgKSS5uw2lfpsOgTAQ8yciCxH2/4UDq85LFFcTZY7XXutUdEt5LCExfWrGCiPecMqzXVEHs2zjt/Aw3Iqtrw&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.conceptsguardbinaries.com/c?x=VXbdWfrXff1qM9tVVx00hMK0d1579yQ1rfaPFmrdq5k=&c=7zdxJ3D5ra9BnbQEPXuVDQer6lTJq SVzviiucyTGFUn138gQGJM6G70LegarifzE1Dt/qDmgiv Tuas4EsTKlKGCwwNyKAn50CAv2mcc atdEDDs3wjrvxfYOMmiweD&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.flashhostingapp.com/c?x=4X5IA6tMHZb A1PZoGnXT2/EzkLw3bJBtd8PVQWWDCM=&c=DRzpzeL73KXWUmdH5jOTHmcngqUqlRu6pZfwTL0W6wb5T5LwHWFCgAgt9PfaiquiHHzJdiFrgyrzbwUqBc8qUYCiE/FIfOate0c2wtbcMx6I4VV8fkAJFdsgnAbnfPgc&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.flashhostingapp.com/c?x=i5GspHTc7CIOGwBsEFeRSFJ9HfJKxkzILCiPan RMnA=&c=w9okSH1ugshD6y7G76IaQpXdTU1GWyZpjGY0muYRZsX3B7etA3xvn3LAPzBWVEC9P3y8w2HlGvTPAJo/VmXcIj89etN1lGfb0piZ nrpqeotKqRbKPabMmfemipTKWpX&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.presentheadbody.com/c?x= RPevha LWhGNh8v2SarbRJMn5lon/d MbkItvJrJSg=&c=A QwVpCDM2bxpp/OBOuMlQp1bBKEslafpR6BwHkgmW6Pk5Kv4HayYWg1sxq/nOd v3yOZjwwYLLldTQ0I1Xu15KQeC0EUy4bvKrVZZ2WYcH94xmk6VKxAt79wh3UJ6sk&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.townhostbyte.com/c?x=g9c8Y6Lkx7m4MV 73dTw8qVVU7SA9yJaxFH9IqHtrE8=&c=YuYUnsacdvhXgfsp5U3fX1ru59X5S5ry YNd6H l0L1Su8yIU/ae 5W/i4i dpP6nJv7cO3dVs0PQ6CwNDzSylQyzi1P9/2jdCOQQJBZEwOLvPF1IislhPu hunxOzXu&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

Remove freefileviewersetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.