home

freefileviewersetup.exe

Hego

MaxSpeedy (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application freefileviewersetup.exe, “Hego Setup ” by MaxSpeedy (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
MaxSpeedy (Fried Cookie Ltd.)  (signed and verified)

Product:
Hego

Description:
Hego Setup

Version:
4.8.4.8

MD5:
4d84f9c59bb15bbf3584512c61ceb536

SHA-1:
eb95519488ceed535948a8efa017b9a7a4ab0c3b

SHA-256:
f9d6b94ac8b3871d5a74070dc3ec9f13ad6bd37a1d667c8990da6d43dd4cf71b

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/15/2024 7:27:35 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.5.11.16

File size:
1023.6 KB (1,048,168 bytes)

Product version:
3.3

Copyright:
Wizard

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\freefileviewersetup.exe

Digital Signature
Signed by:
MaxSpeedy (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 5:11:09 AM

Valid to:
6/8/2016 8:06:58 AM

Subject:
CN=MaxSpeedy (Fried Cookie Ltd.), O=MaxSpeedy (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112125C58A41E827F13C76AD2A1D648B8808

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:jrMkm71ZVBFD8jFFZdJG41wiBAgHJ645iIkLOXmUGAoshfb:joDFw3EmnWgHJoLOXFGAospb

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9195

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file freefileviewersetup.exe has been seen being distributed by the following 11 URLs.

http://www.presentheadbody.com/c?x=RKMf9KX/tSzObnhAeuLygTBSc7O 2D7tfkvi76iFwRo=&c=a913QXKxUB3xtTYW4oNIkK5B0MP4gafe28SDHpFObNplc3H9HvFLseCLbD8qcHIIHCPVlrW0j3eraPGpMroZt49ep9NZ5fATz01dR9EaE8T93ss QEWOgzJa7aO1wssIkUGfhfTzRrBepSUxq81uDqNr9ViZnduCB/ajD9l8uyM=&e=0&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.conceptsguardbinaries.com/c?x=/ElulI2LZY0cyOnIOoJsuIG5UMurA0C6kFHMHgYtGPs=&c=9pddAR6doz GRG8ivzSA/MORdpLblP 4UJyKU5DuAR3iGDAGVDMUNVjLgMkIgI6Uh7qfeTmmYIot6LNZ8MUisfKVMY30gc4QwPxOz h1DlWf4OvvBwvPdcTRYjjbzWDxEqsg/R8G899w kGbNX dhkoGa3Fsu70Llo0By7iVVz8=&e=0&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.conceptsguardbinaries.com/WVl6OTRQVzk2TVdneFZqbHdaMnRyTlRReFozUk9aRXQ1VkROSE5HNVBjMjQzZFhsWk5FZFNPRkZ1UmxWaGFqQWxNMFFtWXowbE1rSkZVV2xQTTFkM055VXlRalpwV0V0UFFrNXlkeVV5UW0wbE1rWkpOSGRzWW5kTllXMDFXV1Z6VlU5RVFrTnVTM0E1VTFNd2NHNXhSSFJ4YkRacVNEVllWbnBET1ZnelZXMXVWV28xVVZkS2VubGxUR0pLVkROMlFuSm5hVWRQUkhSd09GUmlTM041TTNWbE15VXlSbm8wVWxkNGFFNDNZVkZ6TW1KRE1VYzBUMWxyYUZad1RHbHVZMWR5UlRCQmRITnZjVTFNUTFwMlR5VXlSbVpGVWtFbE0wUWxNMFFtWlQwd0ptUnZkMjVzYjJGa1FYTTlSbkpsWlVacGJHVldhV1YzWlhKVFpYUjFjQzVsZUdVbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0wRWxNa1lsTWtaM2QzY3VabkpsWldacGJHVjJhV1YzWlhJdVkyOXRKVEpHWkc5M2JteHZZV1J6SlRKR2JtVjNaWE4wTG1WNFpRPT0=

http://www.bundlesheadsign.com/WVl6OTRQVlZCWkZwa1pGTlBkeVV5UW5NbE1rWnhabEZtYjBFMGNYRkxRalo2TmpCS1RVRXdVa041VEZKaFNscGhkRVk0SlRORUptTTlVWGxUWVVKSVJFeHRZbkl3TTBsTk9XdG9KVEpDU0dWeFNuVkRSMEpvV1hGVWFEQkdjbVFsTWtKUmJEaFpibWxMU1ZwUGRFOXFRVnBoZEVONGRUZzNkWEJuWVd4bGFrSmxVSHBZZUU0eGVYbE9ORTlyYWxWcFFsRlNVRWhvZUhaV2NIQllUbGdsTWtaTlduaFhSelZJV2tnbE1rSnBRVk5yYm1oWVZqQXhSM3BsZVdGUFFXNDNUR0U0WVROMVpqRnFkakZMTVdFM1NuTldXRGx5Um5jbE0wUWxNMFFtWlQwd0ptUnZkMjVzYjJGa1FYTTlSbkpsWlVacGJHVldhV1YzWlhKVFpYUjFjQzVsZUdVbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0wRWxNa1lsTWtaM2QzY3VabkpsWldacGJHVjJhV1YzWlhJdVkyOXRKVEpHWkc5M2JteHZZV1J6SlRKR2JtVjNaWE4wTG1WNFpRPT0=

http://www.flashhostingapp.com/c?x=sQIw8/V18E4Dg XPTrtHIXVfFZKDvlJlhMrjN/XdeOg=&c=d6AZAeo1FH7tWQwHrgbRhjEm0ZWmOMqtPsflRUxmyKhRLTlqWHsW/vfy24EGr6qyGMmOdnG49q2Lqh/IUL/3i7/Bgzux4QbED0rSzLwpk7K1RdQ7NMDuVA4XwT HvAg Pk83UUzsQW7Lzo3ZHlJ/da3FZupQUW3Mj6UPvZfhwH8=&e=0&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.flashhostingapp.com/c?x=dfDDSsyivXCCrZTuw4V41ekujSfXKZAOtA15/bQ XN8=&c=HMEh4jKb5qumLX7Of9pU2mVh7o3HWQSc3od5xX4K5rqtUz48i6JurhQd5VcuBqXheVlesjwq0QoOD0D29sBHE OEyZG7CrvW/9Ve1nDCQrlKWCrzS6agzcxAL4ztCWB9BLoNSa1 k8CMYzqv2jJTGegThw3dVOoU9BdVRHMhu8g=&e=0&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.conceptsguardbinaries.com/WVl6OTRQV014VG1KNFJGcEZXbVkyYm5aQ0pUSkdiMnBXZWxwTVpXMXdjekZ4U1dGV2VEUnlTVTR6TTA1c1pEWmFPQ1V6UkNaalBWbFJXU1V5UmsxWkpUSkdWV055YUhoMmRIaDZSMHRUWTJOc2RrbEpaSEJJU0RrME4yaG5OMWxJZWpGRWR6UXhNVVl4U1hjMGRqVndTVTFWYm5CcGMwVkdaMVpGY0RWWWRGZDJkRE5vVFhOcVZHTk5WbUZrWjBGS2VteE1WRm8yWVhVbE1rSkZSWHBQWTNwR1RXdDJUbE5NYkNVeVFreHJaRGwzVnpOdFNuTTJNRlpFUzIxbVlsSmpNSGhJUlVFemJtbFZabkpNUlZwUmNYUnRTbHAzSlRORUpUTkVKbVU5TUNaa2IzZHViRzloWkVGelBVWnlaV1ZHYVd4bFZtbGxkMlZ5VTJWMGRYQXVaWGhsSm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROQkpUSkdKVEpHZDNkM0xtWnlaV1ZtYVd4bGRtbGxkMlZ5TG1OdmJTVXlSbVJ2ZDI1c2IyRmtjeVV5Um01bGQyVnpkQzVsZUdVPQ==

http://www.conceptsguardbinaries.com/c?x=pjQpHguctFPnnesVB2llt2qXb06eGjbHeyqWc/LhpmE=&c=4zlDD5LL63hVuOfsuo8SLglLzrywKNrjzekMh1MeaM0utw7fEe Qq/PBVt7E2OeD/uLz440WI7xKuwGKUDBfRC9W7jpEzqL5o 4xoKTcctlBiTtDaWTQiBvlX5nyljKMYbL9JmaBSrr7zBkRmRt8ILBptqQGitycySsAw8w928Y=&e=0&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.presentheadbody.com/c?x=cV3wsMsxX4wTzHkW71lrdVQoST1AO/I7MWLoJafNF4g=&c=9A4x7POov7Ba0jjnaU1DmQpuJFNX0zSQCQTnH2Au0HpOSnu0ANaETTwCD3ZavogAPcPilodCML4dCT13EZL0QvkY6CH3 0cxuqBQT0MtBPy1EljjyMEcKfzL238wc TTrTy7EJ4dDufUcWdogepa6XjRLE WuC89qeqktqBueTo=&e=0&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.townhostbyte.com/c?x=9F8IvkEhyxWPGxJmvdBzXLzywMs4OJFqB578QzUeL34=&c=9NJcM4Md2UHnz8PG3r1Qyi0KcsonL17vwGad8 EF5HRJ2kr4O8Qm9m6WSWAHhSPshfn0Xrbg5NTSW4Sok/zaKW1dx3PGuhXuH34bik3bNUPJyYkWMa1R5s1mJiHukyfKWEbbiZBCLED9hKGmIEy7GGwlTxpD21EjdMx dGKRGXQ=&e=0&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

http://www.bundlesheadsign.com/c?x=LkCXhIrFDJ3O28cl0ZMYOlupOyQughz3VOTv0KI8S4A=&c=fWWT0N2miCi28QUaT5LiTL/LMaPapdWF1S3EPB0QgLzJ sg9 9si2Xz75JHnyt467m/mNdBR6mLIXjqK6gm9kU4nQYpHNjyLM1Gzxe6J vNuysxxSmQ1B02fuZAK4og3CrtYTB9D7Dm/xcKKx6ORkPpgKBBvGPPknGg7KHO5rb0=&e=0&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe

Remove freefileviewersetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.