home

galaga.exe

Nufa

Prompt Funnel (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application galaga.exe, “Nufa Setup ” by Prompt Funnel (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Prompt Funnel (Fried Cookie Ltd)  (signed and verified)

Product:
Nufa

Description:
Nufa Setup

Version:
2.5.2.0

MD5:
ee7c2f605c1d0ef2d4dfe7fc2ad8e614

SHA-1:
71237ac3a242cd275c29b752fa2653e41d4faf5e

SHA-256:
cec6299de0bd443d24f4ab30f76bd939d400d6e775164131417faec960c8791b

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
12/26/2024 12:56:34 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.4.25.20

File size:
936.2 KB (958,696 bytes)

Product version:
1.2

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\galaga.exe

Digital Signature
Signed by:
Prompt Funnel (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 1:07:46 PM

Valid to:
5/4/2016 9:27:49 AM

Subject:
CN=Prompt Funnel (Fried Cookie Ltd), O=Prompt Funnel (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11219770E5FF2BA80CECD3514AF9CE966758

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:f1kJ/WiyIKXO2IzURgYS/S/4Pltt6z+5M8Yje5n:fmBTIeB5FK/6z6N8qIn

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file galaga.exe has been seen being distributed by the following 10 URLs.

http://cdn.games4windownloads.com/c?x=U9NmKHmCTxDI8gxBRVawPqWMhAPmWt2pl1U7GS7CcNQ=&c=9vkchBPCjBj7Uo0DdePThX2qfZnHSV2lCWTC1dWwllhCxekI57s4jbsBiaOb7F7sBXN2/x8hROeNRPPfvZRacN96C71EN/n7rx2I5PEVNAMefP4b8rA3D7nN7d6Tr/wPG cpDacxGfRZdPrGAKWsf7BPxq NSKZ74sVQLpPU3jmPUn5dk li6UyiWGb1C/U/&e=0&downloadAs=galaga.exe&fallback_url=http://gamefabrique.com/dl/.../galaga.exe

http://www.bestbundlesbulk.com/c?x=LrMh1RlthRA/uAxeEVClTIcUMgA9x/rZcAvl7gmhplM=&c=QHWgzHDo34mi1BfLm8gdPDW 464qZyfOXHyhdwxmdjDB/ MmkL 9A/wbGUYqJNKENevhYOkbS09GgJujSSZ1rURYyLT9Aoe fNx6U80FFzaS2a6pETJofIqittg4pStwcGytD8OBMze 1 pRBkfSM2KqcL5aTpoKnTbfwdJjlXd04alBJgQI0cwUfsL2Tj3t&e=0&downloadAs=galaga.exe&fallback_url=http://gamefabrique.com/dl/.../galaga.exe

http://cdn.games4windownloads.com/c?x=YUZuAvJFguuc/Vq1cFz/NM6QxxA06csy7aD91WU5jSg=&c=PDzPh/h4GtvECMyRDANhmOwJ4RZpSwgXoV3zCOttelBngTrfAlbxOJwq0luBzUSAUl7pZfGMLN22KnuIeheMv/Dy/M9xOp1vSr2SWYALBh0yoG0l3UccHzzjpaZUF0mtmKpZ2lE8NsQsYKTCihrTMJ3hHEEn6E4qN6psC6JAob1wGLkk MFRx5xv5gN41vNN&e=0&downloadAs=galaga.exe&fallback_url=http://gamefabrique.com/dl/.../galaga.exe

http://www.bestbundlesbulk.com/c?x=sobEfPrS93RhVrIZVNxsBJv8YtwrX 4VXd7suHQolJI=&c=wpdXg1thI37563iRKfoKJs1vg/KbinJznh2OizFi0uWrQvN169/afax44wabZdAo0S9J8M5fK6Ao3F4ZdqNWubM0vCaUn6UsBa4GeblVpX9rEtAj/EnPPSKdL6xlQbL/uSkRfQUUIWXfBiY gwr4iTdaIdGugcjZ7Z/msR329XeBMnLsHwp24VeylsrkUW/B&e=0&downloadAs=galaga.exe&fallback_url=http://gamefabrique.com/dl/.../galaga.exe

http://www.bestbundlesbulk.com/c?x=fHdz3nPBrwoPyr//tLaleaoZag 0 rFqPDoFWQmeDi4=&c=s6d87S/k2UbfuRgs53tzRgHcYlZXXVjivcUiqrLO4RIKS5bMQAN0yaNu7jmqNXXz55sSgJhMusAjsQFBZCniL/QsWiOmXmEP4gYeGo07i1oRsd3Y1/sAznt 2folBi7K5UreS4pdIhpuv5FL7IQwT/4TIPKOqzQK5tUB5RpzOME=&e=0&downloadAs=galaga.exe&fallback_url=http://gamefabrique.com/dl/.../galaga.exe

http://www.bestbundlesbulk.com/c?x=pAtONjjR9EZG y026M1fHNa1EbiJY3pNCZDsH0h6y90=&c=GBR1j/DWEidAq8TBi4mAWxzqcf7o nR/BCnGx9NhKPCUlboFuPEoa/2OgSK5AwJ8dCA9Ns7tGpZskc4nJj7uLCQ O97GMHYV0pNMlDPeL0m70jaJ/uI/k46o2Gq8vapoBBhmFG0thk AcmXOGRQv3zixQKGWU9FnPWAPKP8v9gk=&e=0&downloadAs=galaga.exe&fallback_url=http://gamefabrique.com/dl/.../galaga.exe

http://www.bestbundlesbulk.com/c?x=R8UkOtRTEjuajOZ4PpifxKUyrU7b49k5kuWvCuxPZYI=&c=2PbE7ADx vCK6lJWqo2xkidOKK9eH r2n/o5oELMQK1gzMx9lvsgzgNsUwQFv8KUAqx8RCk2Dlj4u3VUbmg1xrFnK/JAxT1Y4aRgqm/PfQJwJDZ5imBcy7Bi0Omdy9YknksvvQ6y9pGwtVpBvtk 2SOqe238hQroFp3VMPII9Uo=&e=0&downloadAs=galaga.exe&fallback_url=http://gamefabrique.com/dl/.../galaga.exe

http://www.bestbundlesbulk.com/c?x=tg8F5rXQsgUQe6rygc4t7jsaUWX3eJ3j0JiXw1R3NGk=&c=2lfpKjT2i4TdGeZV3sk1ztAzQYtUA00UVcDdIxcpKNNXL29 28PxXXwNcWD6XenfoVIrtgRNt60DcVy1/dVpev2bGY9cfP/xvbNW/QrREtBfC ojFxJEpJhQtJvURxGzzvTGQiSEZYV3seWAX/6RzU7Kc5vj6L7DAJiL6VE8ois=&e=0&downloadAs=galaga.exe&fallback_url=http://gamefabrique.com/dl/.../galaga.exe

http://www.bestbundlesbulk.com/c?x=RINk4WAp3gw9sHABeGujUyXZ/OMIpSxEJvUSFAO3DuE=&c=zUrj7h/TAC0RqYPsYBd 3Ch FNynKODmFYhoFWpRzb00rKspy8M6LYUKS6BLCwstIruFTRgW3ixo6ntbbFbdv0ZoxLT5MKAIxdrjA/JgbDA6y7TW291cqlh9MWtPTDHWYslstC HHD1YxvCRkfpc9b1xeC6NV9KnZjmAI2Be3B4=&e=0&downloadAs=galaga.exe&fallback_url=http://gamefabrique.com/dl/.../galaga.exe

http://www.bestbundlesbulk.com/c?x=/pM5NcQdNnvFuIJxBmIOJ5iHFyfa9TdYlOCCm9DXVjc=&c=deMZrXMGupVoLibfCf8AupftbZBJxnJOsR5HnfloAdfnAJy7x8x5QvWBkPuCGB9YA JQvgnArUdhSt8FQeauGVZYnaFbZAT1bHUgsYnF0IE0E39rGjfKDTJm157SSfTfipMZNhqcO540JEqRNQeghP 45tGDTiurbDIMPjjSpH/rLqN9fGA5lTuZnugZiObU&e=0&downloadAs=galaga.exe&fallback_url=http://gamefabrique.com/dl/.../galaga.exe

Remove galaga.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.