home

gimpshop.exe

Lobih

Prompt Setup (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application gimpshop.exe, “Lobih Setup ” by Prompt Setup (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Prompt Setup (Fried Cookie Ltd)  (signed and verified)

Product:
Lobih

Description:
Lobih Setup

MD5:
35090d62302046df414f202d2d6962e9

SHA-1:
155aa561d92399b54488d97ce0890d96e3621d79

SHA-256:
2475ae49d3f52890f741895ad008fe00617467f7dc586bb14019dfd8228c95e3

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/18/2024 6:48:35 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.4.27.17

File size:
1 MB (1,057,488 bytes)

Product version:
1.4.5

Copyright:
File Application

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\gimpshop.exe

Digital Signature
Signed by:
Prompt Setup (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 10:10:36 AM

Valid to:
5/4/2016 7:49:04 AM

Subject:
CN=Prompt Setup (Fried Cookie Ltd), O=Prompt Setup (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121DC42A7CB07A5DBC4E8F275C342E964B9

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:cHFwOxJdmWmk6A6XA9tlsWVDXZTSsprUXs/:clwOxJkdVA3lsUXYspEc

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.8606

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file gimpshop.exe has been seen being distributed by the following 15 URLs.

http://www.todaygiftcapital.com/WVl6OTRQVTlVWVhrMVpHRlRZakJLYjJkNGRGSkdSRmxzWlVFeE5GUjFaSEJFTVVoNlRUVnRVbkp4V1VOMk0yc2xNMFFtWXoxUldUVllNV1JOYTJJM2VGWTRZMnhEVjJkR1VuUlFZV05JYzNRMlRuRnNVVTFaUkRWRmJtOUtOWFJFUjBWRllTVXlSbk5JVjI5d1RFaGhWMjB3YTNwV01IUnJRM1JtTUhOT1UwcEJkRzkwU0ZsbWJWWkxZMFZ2VGxOMGVWQldVVkJoYlUxNk1rRnFabUpxUjA4MGMyOW9NMHBXU2pkcVYwMTNaM1pzVTIwNFRXeENKbVJ2ZDI1c2IyRmtRWE05UjJsdGNITm9iM0F1WlhobEptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTkJKVEpHSlRKR1kyUnVMbWRwYlhCemFHOXdabWxzWlhNdVkyOXQ=

http://www.todaygiftcapital.com/c?x=IiP8yoceq9F5VDzzjEarPBoL41KPcavPhVz3OcH496I=&c=Eedf/v0qirMmZCBg4GjwfqB3z5hNdEJB4nsa3OUCOC3L6tzOLQyHZBP IEfulQI00JyiQRPhDB/Nhv45SxystQP ekh7ffs0PVCX9phrW5oFgepGQd//EFYtQjRRhcKR&downloadAs=Gimpshop.exe&fallback_url=http://.../dl?bc=1195319

http://www.todaygiftcapital.com/c?x=FnXHcNhQ3ONel6INidfgBFrGQXcNAR3NQJKP3cxPoWU=&c=5AgnQL1dCC/bPECDeoqlgcMDNQTCV0SdGZ2sYmvJSOqzcJY0P2HOCcjEy41XV/hOdyYo1dBetBCWx/YXfqcxAc9aG5eB4OIsVdy7GdmCnxadOkSdCX4/kXSuM1T0OT2n&downloadAs=Gimpshop.exe&fallback_url=http://.../dl?bc=1195319

http://www.todaygiftcapital.com/WVl6OTRQWEoyV213eVoybGpZMnR3UkZRMU1ETm1aRXhDUjJGSGEyTkdaVEZ3V1RKNlkxbHNNM04xYm5sb1dFRWxNMFFtWXoxVE9WUTBSSEY1TWlVeVJuSnhTMGRGY1hGa2FpVXlRbUZxU25sTmEwUktKVEpHTjNWdk0wUlJjbGh4YVZSME1HWXpkR042TWxkU04xSkxiVVE0WkROdVpqTkZaVnBWZUhBeGVFMURkMHAwUW00d01FOVZWamRYWlc5S1N6Sk9la2NsTWtaamIzVjRVREVsTWtadFEyeHhkSGRHYVUxSVRHSTViR0pzZW5oeVNqUXhOMHMyYnpkVVFua21aRzkzYm14dllXUkJjejFIYVcxd2MyaHZjQzVsZUdVbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0wRWxNa1lsTWtaalpHNHVaMmx0Y0hOb2IzQm1hV3hsY3k1amIyMD0=

http://www.todaygiftcapital.com/WVl6OTRQV2N6TWt0Q1FsVldkMk5ITlRsMVYydzRNVEUwTnpGcGNqWTJkbk5ZT0hWdmEzVTVjMUpVTkRoSVlVRWxNMFFtWXowMVlVd3dUVXRtTVVWdFZFVjJlR2Q1VkZwMVNIRXdKVEpHY2tWRVNrdzRRMWhQVWpjd01HRm1NRlZMSlRKR1NGTkJiaVV5UW5GbmNUUjBZMWtsTWtaSk1YSlpKVEpDYXpSMU5GbGFWV2wzUWpnNWVYWm5RM2xSVUVoQ1QxbHpjU1V5UmtoTGVsTlNiWFZXTUV4c2JscFNTVGN4TVVsaE1XbHFSRnBDYlU5NFVUUjJVamc0YkhGWE5VRnVUeVprYjNkdWJHOWhaRUZ6UFVkcGJYQnphRzl3TG1WNFpTWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpRU1V5UmlVeVJtTmtiaTVuYVcxd2MyaHZjR1pwYkdWekxtTnZiUT09

http://www.todaygiftcapital.com/c?x=b8Fav6RAG130az8HZAcZ2NfHzpNTRshx QmRyb0urw4=&c=f1ihbyXYA gb7FhI0cCn/Fr57AipZWRSIAizTd3ksn0S whbU11avaAJ7pfruPZGerF/VPMMlyCNyR8afDVn/34eUasEsYqW4hiI 6mxYb8wIDyTWcWv6ETb/yllavwt&downloadAs=Gimpshop.exe&fallback_url=http://.../dl?bc=1195319

http://www.todaygiftcapital.com/c?x=e476wt9dZSLuHQSYQILnBDlXlwkcVHffB6xwjEApjjM=&c=VRRqDdUK6VtdFQFFy HC6LQtdaRH2WpAlArhx0EZbT1n9ovj3xZT5r LRdtJaznsQ3BHEwFa45otmvDHW S3JBiex0H1yKQYgYHDTjZ38 JowJVsEC5h4ABqpNZMM6GV&downloadAs=Gimpshop.exe&fallback_url=http://.../dl?bc=1195319

http://www.todaygiftcapital.com/c?x=M17hOuyw485vItPO07K57FnmhHsruouMk34vu9x1Tf4=&c= QSomeqg sKpZYaP1hu3QgaiUVozVqLzj3QY577CWwXdwUWSTDXUUoucW0c0r6PvMDWhwbR4DFxGRyq99DdSGrEG3 xGJ7vyIUq0u7Om YiU7uO8N8zvfOIax1bLyKwJ&downloadAs=Gimpshop.exe&fallback_url=http://.../dl?bc=1195319

http://www.todaygiftcapital.com/WVl6OTRQV0ZvVERkd1VFeHdORlV3ZVRKM0pUSkNRVVJHVGprM1kxRjJPWGhMZVV4eVNsVndUVXc1VXpnNVRrMVFUU1V6UkNaalBVWTBWbXBITWt4V01tNXhNVmhOZEZjeFJGQmhkbU1sTWtacldHSkpOV3BRUzBOQkpUSkNkVTQzVm5aMkpUSkNTSEpISlRKR2VFRkJVR1p2UVhKSVJuZ3dZVVJMYzBKR1RsWXlNRTVqVld4bGVVc3lkR2xRYmxONlJWWlFla3N6UWpsNU9UZG1kV2MzWkRaQlkzcEVkRXB1UTBOQmFYTjNKVEpHTm1VME56UmhPV1F6WXlVeVJrRkNjbTBsTWtZbVpHOTNibXh2WVdSQmN6MUhhVzF3YzJodmNDNWxlR1VtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTBFbE1rWWxNa1pqWkc0dVoybHRjSE5vYjNCbWFXeGxjeTVqYjIwPQ==

http://www.todaygiftcapital.com/WVl6OTRQVUZqYkcxUE1qRTNZV2R4VjJaSlVHWjBZVWg1WVhKMFMwUkZiamc0UldaSk5rOGxNa1poVFhKNlNrNWtTU1V6UkNaalBVWXpPVEZsYmxCNGJWRm9UM0ZaUTFaaGRGQlpiRWcxUjJGMlNXMU1kMFJJVFc1SVRuVTNPSGQyU214dWFVSklWblJQT0hSTVdYZFdUakUwTWpKdU5XNUZiWGhvY1RCeFVraHRSMkowVWpnMlJVMUhTR2w0VVNVeVFsRlllVzlPWm5WaVdsUkVlVlJRUWtwUkpUSkdSRTR4TjJvM01XZDNSakZCTjNGNFNFOXVZVEZTZFNaa2IzZHViRzloWkVGelBVZHBiWEJ6YUc5d0xtVjRaU1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6UVNVeVJpVXlSbU5rYmk1bmFXMXdjMmh2Y0dacGJHVnpMbU52YlE9PQ==

http://www.todaygiftcapital.com/c?x=c1/ veRnmDpvyy3RouFMIiKTIUTRyXcnoKts4U4szgM=&c=MQgv5QRVVby hIpf6NCpOUWGqvCCDeTA5fIiwwHUWhYE47hBgIQeCz0DW3Q1KXlDsF0olPClyV/L8pgX6 5aCX 89AcrLcpLb HKUQQ/Sk44BpWp87oKNqNCAbACbL86&downloadAs=Gimpshop.exe&fallback_url=http://.../dl?bc=1195319

http://www.todaygiftcapital.com/c?x=usTnOBB75GOqlyYgUPHMDqZG88AUhuXvdicEVyOFP6k=&c=veYjTmGYvSGAzf17RKiLzIfV4mw8bLfTyMnWyw3 sZlGrHXEkflQfze4OVpeeheQ7rcI/Vy7qQubeEY/k6zRhHPmtDibvmoLcb32KnyRznumzLiZlvem2TbRtnoaeXYS&downloadAs=Gimpshop.exe&fallback_url=http://cdn.gimpshopfiles.com

http://www.todaygiftcapital.com/c?x=NPDcj5eIe12t/ER5DfYy1Q70WeGI0YnAcgpJFjvkxyQ=&c=71cdyeWE OfHZZNDStaw5NHkcnCsBRj/UOEIRI6HcCvHGVXcQ4 EqDgsMjH66LoSagxTYYIy 3T9C1IdVyJB/mm9dSXRnP3DsDYIDs6ageS0PV22eqAXp3U6MP Pld/&downloadAs=Gimpshop.exe&fallback_url=http://.../dl?bc=1195319

http://www.todaygiftcapital.com/c?x=mmohLQfztQsABMEo3M3EGVKw8qAI8LAMzIVCT0Y/n8Y=&c=bMbk345S4uqd8PTC3FjQ1c55EgmJYoKHDuOAGE/jQSB/yLce8IJe2R2xZ/5y 2VVsYirdATNuBHfvKJsG8jetOkSaBqKRLh8M7ljJ9VdkekAmT2DBq0FQr5eudcJKy6V&downloadAs=Gimpshop.exe&fallback_url=http://cdn.gimpshopfiles.com

http://www.todaygiftcapital.com/c?x=8ezekngYspqz2 N1o0q1jzHIAPCFC9zNfe8gDA EQQ=&c=AtTvO1tp/A6xwhpPN1ir/1yVM3mIlSaDyyxtjppk3IqFC9ietylgqQPO5XJieX86MCwCWrWGNgZgVYQkeoXuNmq4oaMQYoI8wkcRbfp3U/4AhVk3QvhJpCApShpftRZg&downloadAs=Gimpshop.exe&fallback_url=http://.../dl?bc=1195319

Remove gimpshop.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.