home

freefileviewersetup.exe

Internet Lite

Quality Funnel (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application freefileviewersetup.exe, “Internet Lite Setup ” by Quality Funnel (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Quality Funnel (Fried Cookie Ltd.)  (signed and verified)

Product:
Internet Lite

Description:
Internet Lite Setup

MD5:
34ceb92e19066846d2469a954c2b3ee4

SHA-1:
787ec87255517dc74a93e6c1c204cea87a2e7e3c

SHA-256:
0f800ef1440715770ae787e2d8baa1a2eafc36e5b6251b72c1aa05911d7d014c

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/16/2024 5:35:37 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.1.24.22

File size:
1002 KB (1,026,032 bytes)

Product version:
4.2

Copyright:
Prog Installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\freefileviewersetup.exe

Digital Signature
Signed by:
Quality Funnel (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 6:54:27 PM

Valid to:
6/22/2016 10:12:52 PM

Subject:
CN=Quality Funnel (Fried Cookie Ltd.), O=Quality Funnel (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121771FCA92BA51266AB4B001FE1E840DDC

File PE Metadata
Compilation timestamp:
6/20/1992 5:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:OEtjPF8gLTG58I2b3kDQ7DEIGL+xAYqZY3ddA0SmTAbzkv/wf:Oij98gm5+bUDQHEIPzqZYdmLgwf

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file freefileviewersetup.exe has been seen being distributed by the following 9 URLs.

http://www.farmcenterupdate.com/c?x=aObK4GK5UhHG Kv0W9IEujcLHN4uEo2w6itf8yFj8Sw=&c=w8OH8dE/1WsIyStNUsluA3mEvZYKeO3DbTRGg9i2McKnhjRCkFDkIQz1NAGEvUZ50D74/M2 Al7VoUq5mogNtB5JSrztKPEDQnXsiy /BnsuZl6tv93pSDLQWE1yTNaf&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.cycletodayhost.com/c?x=Pzmdm3FZexWzQKdQUK2Q ZkO5mepMXy7KhEL0EDSXfI=&c= RdBUI2hFKnF6gRtOLaN1ofavIN1u4bRzm5CczpekawjbeSHJYjvMyuiIZbPP9fTnX1rqjf4NO9q4qf/7cgrVzKZqDo4KV1pocPHOm4uupT5s4fz2K4CIwozCtEcFDVZ&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.contentcitycapital.com/c?x=wVwUa7ULSXpb9s3IPIzuGmwFHj3RWXUT9OW1ASgW/yI=&c=HHI6liotFAlOJp7TwCUhm6PPOVoTOpMv00l2gVKn4qqZCJFPgxfCmGmu1eFcxne0Y 90EJ6jik9C9kJh7YZEPn0/9VtHD69PXCuIp58Y7MIY95Il0GkGAJynp9ULfFRD&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.dlsafecontent.com/c?x=OExANKYBgF8kk TyWYPx68PsJV8SxRH//IpjfVMfbqo=&c=Qy2XGD74WoYsGDIQfrV109ix/VAFLZwvtR0o/jfHGi DD2j JFj0GKicc5SjKb5dm3xbDU6GWT8hodt IK3dY ys7YpFvNcPeULpfWjX8p9hjq0pebylnqF3OdYwnTSH&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.cityvaultapplication.com/c?x=DuERX3RyikJEF/4OZwjkcEENKCTOjrDpUebj8H7SSEk=&c=v808QpAsg392GBiEoc3Otp3jY7KPPgwYz8odOBsxAfWYw54/aMmrutNfPLx8BoN8pnN/fWKm3XLStZn9aUJvHRFDv9B7TsEh1AbrvqV6E5DaLWKXtA1i7q6i6Sam5kKa&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.hostingcurrentfactory.com/c?x=NXKx4KXRpAvVIIejJ/TaStznV2yAb2esCtwYmGMTuoY=&c=CfUBy24Xw7XRScJ6O/NpGbf8mpxe9NGRqaxZ YfOwlIxcAfN2lw7qtEd8ssRTuhugGCP8DJ zJWAv8VY/SElh6bXVxHI76XqB TWt/p6w MqxTHXfHPaw3jegPDtdUa &downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.appssignsdelivery.com/c?x=ptHO/d3oHWXcpwLW06Kd3y/S8a7aS5HUbeSz8mGEHFM=&c=x5/ODTubVIEoNYUGHkH/f8F b5WrIbF1WLD4ItYLyozGs1gGb4RH58QpH7jxP5u8QJ6ohE90eh3OE SgEjCFjSRuK2D5P8UBFyT6mgBefFPWDpKULrkXW SrAxAEIkfc&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.cycleclearcontent.com/c?x=tW9XmshsgfqwoiTA1lZ8TfDDoUu6iSVVy5wV50F7HHo=&c=lr8eYuuroDu5iL MmMDmWZ0MdsaGbmmyY5zu101xfuCSQp c6cAvse9p71XqspTuKj3IofMH7JIMiugmtf43gth7IQa86T TEley5OGWJwZDCm7PuP5XY6Y0mc2VE2ay&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.toursfactorysign.com/c?x= BsgPg m5a/WxHmyzXKHlusIC z hsn Kqu9TYrK9Jo=&c=yoqQtUsXcwdEtFuAJDhuqQhq0anSeTu uAPwjFeKDhyhF7JcseSU6KF2mmwmoEn80de6ha6c2ASrwbVhPXI1N1pjye24flknu8SuM4RMx6GhZ5AQIRd iC7fJKBPZDQU&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

Remove freefileviewersetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.