home

google-maps-with-gps-tracker-34.0.exe

Cokonac

Setup Manager LLC

This is the Softpulse installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application google-maps-with-gps-tracker-34.0.exe, “Cokonac Setup ” by Setup Manager has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Softpulse SoftwareBundler installer.
Publisher:
Bef   (signed by Setup Manager LLC)

Product:
Cokonac

Description:
Cokonac Setup

MD5:
612347431668b1f708928b5526c7790d

SHA-1:
7658078b8125ff7efeb085c892609823bf84256b

SHA-256:
cb69e66939f4d2e6cfd4df3b538e95ab639cc6b44251ace9821de55781d3b83d

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/25/2024 4:40:38 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Softpulse (M)
16.8.11.1

File size:
946.3 KB (969,048 bytes)

Product version:
2.6

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Softpulse SoftwareBundler (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\google-maps-with-gps-tracker-34.0.exe

Digital Signature
Signed by:
Setup Manager LLC

Authority:
Symantec Corporation

Valid from:
12/17/2015 1:00:00 AM

Valid to:
1/16/2017 12:59:59 AM

Subject:
CN=Setup Manager LLC, O=Setup Manager LLC, L=Wilmington, S=Delaware, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
5B54F9A49482444F2A26324DAC8E187D

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:87PlaKuc2gFnN2M8ZZyyA4ft3o3yYx6Yh634iy66xfT4HEq:87NXu/gleZ+4ft3rmj/nxfTF

Entry address:
0xAA98

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 2E, 86, FF, FF, E8, 35, 98, FF, FF, E8, 9C, 9B, FF, FF, E8, B7, 9F, FF, FF, E8, 56, BF, FF, FF, E8, ED, E8, FF, FF, E8, 54, EA, FF, FF, 33, C0, 55, 68, 69, B1, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 32, B1, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, D0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, C2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, 24, 93, FF, FF, 8D, 55, F0, 33, C0, E8, 66, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
40.5 KB (41,472 bytes)

The file google-maps-with-gps-tracker-34.0.exe has been seen being distributed by the following URL.

http://www.ranchsignbundle.com/Yau0 mjxSELEV7R2TLXcuxQ7GRtJyV2bo5DWH _d_bGQBJjCBAJaBt0ThKvZ1ffAgEDdEeczFpsJAvJP1MZoSKFpfCF38dAP2T7NmxDeXX lER9AsKB2KPZ05YPSZUsWU704FA6YlgixiJHvZYLncN9CBPd4I2SI88T2ifuIX2e5QVkzvAWEflC3RcYzOFqoFlFpKCL4i3TE2KTNubi1RVDF8TBqQXEE8auf RIXrRjfZk qX_n19CIyonAufaMxAR3UCTsHYMJImHDBpUpTvXEs7KyXUCj ppbN6ckd7xvGmJvNTO zfw5xHv1hEBWXpXOP4QdOyAh2DzcAYn0SAxNlR5Yfdl0DK5Gprw3gGhx8lsSDmgAYJK3bjD I5jFuNfU5w7LvOli9JC dxvfXFP23I5cNyo6qHftfmSaAgWSiIXBu770XdLZQuo2Ifyd7nxscLYT_bMFJuHmKs8qgN3ygXd4WFYpciN9BC0083b0AfDYzd8V8gZUSzpWHltnoSuygaEpMYgR3y_gJWrOZiAYJA_TTERE_wAU44VpAcmd3VwRQC4 YLg7lVI3E4zCFlgYK2t7Oy1DuZTygM90mOJNeCiWtZ4wpgSV YImgBMgM5DvnwmKm 00DTjGgD ac72e38rR58s_32y nvfPdX0PYEg4umw_JqzCiyZ4ZLLykgZqv5vAqZFnL_laROEF 56mQG1ANRPaPlVp4 jor6p3FTc28AMsc4JSp7kWcoUnQMxZ6__0=-CwiAZmlsZXpvb21zLmNvbS80MDQD

Remove google-maps-with-gps-tracker-34.0.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.