home

fvd2015setup.exe

Cima

MaxSpeedy (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application fvd2015setup.exe, “Cima Setup ” by MaxSpeedy (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
MaxSpeedy (Fried Cookie Ltd.)  (signed and verified)

Product:
Cima

Description:
Cima Setup

MD5:
8e3b541fea5cc077b85d0fed0b7b1516

SHA-1:
222956f249fc511bc15d829ec630e092c79e7148

SHA-256:
febf0abbd8d0ac9a8fda7f604f4380588d8ab7cf579b1d13512c2e86874d6754

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/15/2024 2:27:03 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.4.7.18

File size:
1 MB (1,094,904 bytes)

Product version:
3.2

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\Pictures\fvd2015setup.exe

Digital Signature
Signed by:
MaxSpeedy (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 1:11:09 PM

Valid to:
6/8/2016 4:06:58 PM

Subject:
CN=MaxSpeedy (Fried Cookie Ltd.), O=MaxSpeedy (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112125C58A41E827F13C76AD2A1D648B8808

File PE Metadata
Compilation timestamp:
6/19/1992 11:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:2p1CHYeefisG65UfjqbPmdk681rpUQ6ZFXjwC0POr3s7Oy:27vzfzh22rMk6xQOTwCLSO

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.8975

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file fvd2015setup.exe has been seen being distributed by the following 6 URLs.

http://www.worldappsfiles.com/c?x=4hIa8whR2oGvxBKmuu60T/K/dChfw54RcdQkFqenObg=&c=H0YLXE8O3Z/h6VY9Am65AifGN0AxjkJP5G3bs/RDzAFtoeUAR3mzAXrTYYxpJlOBeEQboTL/Vzkw9/7QHrpSXLh4NNCP MoaHgrRimOE5u58vZlUur/0XnkpXam1FpmKDXJJKEINU1YsDL0J208YP/cOxsAbee7LF1oYDv/6/dI=&e=0&downloadAs=FVD2015Setup.exe&fallback_url=http://www.finalvideodownloader.com/.../newest.exe

http://www.chucklevaultsdl.com/WVl6OTRQV2xtVXpsMVpGRkRSRWRWVUVoUVV6QkxKVEpHTldablYxaGpTRGxoTUVoaWRYbExiRzlEY1NVeVFqRkpkRVk0SlRORUptTTlTV3BFV21RMFVsaExjREYzVTFCMFpGQlNOWHBVZW5SV05UVlZWVVZMYlUweFVFcHZVV2g1Wld4TFNUbFRhREpVYlc1clluSkpVMlF4UWtKaFVHRndkblZWUWxCTWJsTkJTWFpoVkhsdVZuVnBjVU5rWmtOc0pUSkdTakpyVW01WFNTVXlRbHBoWldWTWFtSnlVWGxOV0V4aloxTnpWV0psV25sRGNWVnZhSEJOUlc1dlRGUkVaSG8wUTI4eEpUSkdSMDVITWpodmVuTXhlVFYzSlRORUpUTkVKbVU5TUNaa2IzZHViRzloWkVGelBVWldSREl3TVRWVFpYUjFjQzVsZUdVbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0wRWxNa1lsTWtaM2QzY3VabWx1WVd4MmFXUmxiMlJ2ZDI1c2IyRmtaWEl1WTI5dEpUSkdaRzkzYm14dllXUnpKVEpHYm1WM1pYTjBMbVY0WlE9PQ==

http://www.safestockconcepts.com/c?x=womycr3goGxjU25SbribVoosRnggW3d1I9ajQcH/4bc=&c=Rhi1kEjcHsbDiXCxZIv0Kpt4/kwnC zKA4uaObbi6HWkYIT7Qg2xe6wNx6tBjhTU3UYCBeTATT7HKEJAvyhZnU4TZkf6CBQNhro0KCxo2MDjxP701PrmpbJF8rD2F1WN7MIyVZLnJtGJpljpE1eQngPbkZsrYWay3big eYA0exm2AKw4jIIwpwBNHPBIv/D&e=0&downloadAs=FVD2015Setup.exe&fallback_url=http://www.finalvideodownloader.com/.../newest.exe

http://www.contenttowersfarm.com/WVl6OTRQVUY1WjFCRldUUmpNSEE1UjAweWVXSkVWbnA1VlROMllWTmtjbXB1UzJwT09TVXlRazF1ZFdsVVVtTk5ZeVV6UkNaalBYWTBVbEZzUVRab1FUY2xNa0p5WkdZeU1HWjNTbXhhYUVoWVprTXpNbGMzTlRsQk1VVmxNVlZ6U25kUmEyZEhUSFpLTTNWTVZIcElhRmxzYjFsalUyNVpKVEpHYUdGNGFGVWxNa1pRTTBNbE1rSTJWa3BTVURVd1JXOW1TR0ZVVjBsTFYyNTNVM1JNT0VkNloyaHdSbmxRVTA4MVpuWkNWbWhsYXlVeVJsSlZkbkJDY0RJNGVqazBVakJRY21WUVZuVTJabUo2UmxwUGNIa3dRV0p2V1djbE0wUWxNMFFtWlQwd0ptUnZkMjVzYjJGa1FYTTlSbFpFTWpBeE5WTmxkSFZ3TG1WNFpTWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpRU1V5UmlVeVJuZDNkeTVtYVc1aGJIWnBaR1Z2Wkc5M2JteHZZV1JsY2k1amIyMGxNa1prYjNkdWJHOWhaSE1sTWtadVpYZGxjM1F1WlhobA==

http://www.funtowersgift.com/WVl6OTRQWHBUV0dreFVWQkllWEIyYjFCR1NFbEljbWxLZVVSNlVUWTJja05OVEROSkpUSkNSVlpOTVhZMVMzVndOQ1V6UkNaalBVTkhUblJHUVdOQ2RXOHlKVEpHTlhsNFJsWXdSbnBoU1ZORFJWbE5WRlkwV0hrNVluSnVkRll3YVVGS1V6aEpWV0ZTTkZab1lsZG5aR2RZWjJSd1l6QkNTWEJ0WW10RFpXbFJTMlZhVVcxbFUzSklTV3hhVVdOYWJqSjRibE5HUldocE5qTXpNMnBUZDNaeFJrOXNTV1kwYVRnM1pGVlpka2g0Wld3M1kybDJkR04xSlRKQ1ZFWmxkbGhITURaTFRDVXlRazVZVUdSaE5EaDFVU1V6UkNVelJDWmxQVEFtWkc5M2JteHZZV1JCY3oxR1ZrUXlNREUxVTJWMGRYQXVaWGhsSm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROQkpUSkdKVEpHZDNkM0xtWnBibUZzZG1sa1pXOWtiM2R1Ykc5aFpHVnlMbU52YlNVeVJtUnZkMjVzYjJGa2N5VXlSbTVsZDJWemRDNWxlR1U9

http://www.worldappsfiles.com/WVl6OTRQV1JIVEhORWEwUlFNRVIxYlhGd2NGZExaalJZWWpWMlRUWnFObE5hYkdJNE56ZGhhM0p3V21VelJGVWxNMFFtWXoxbFFXdEJlalJxV2xFMlZDVXlSbk5EU1ZaRWIyTXdKVEpHU0c1NE0yeFlkamRZVkdFd2JuRkRXRnBHYURSSFRFUkdWR1JPWWpOVVJGQlVla2hZWlZCTGF6a3dkRzh5SlRKQ1VIRk5XVWcwVlROWGVGbHlPSFJzZFhwYVlqQjBWMVV4ZUVwd1RVOTFWbFlsTWtabWNXOW5jelpQTmtoTWRrcG9ZemRsYmtKMWFXMWxXa05CWkVOaVl6WkVibUkwY2pKbFZtcFlZVlJ1U0hneFZsUktaeVV6UkNVelJDWmxQVEFtWkc5M2JteHZZV1JCY3oxR1ZrUXlNREUxVTJWMGRYQXVaWGhsSm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROQkpUSkdKVEpHZDNkM0xtWnBibUZzZG1sa1pXOWtiM2R1Ykc5aFpHVnlMbU52YlNVeVJtUnZkMjVzYjJGa2N5VXlSbTVsZDJWemRDNWxlR1U9

Remove fvd2015setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.