home

hayday_game_downloader.exe

Fapebepin

Mode Quality (Alpha Criteria Ltd.)

The application hayday_game_downloader.exe, “Fapebepin Setup ” by Mode Quality (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.vaultsconceptsapps.com.
Publisher:
Tobu   (signed by Mode Quality (Alpha Criteria Ltd.))

Product:
Fapebepin

Description:
Fapebepin Setup

MD5:
66820f02a134615432ba0abfe5ae5195

SHA-1:
c429870725d9e6950baa6daeed8b31cf2c99e6dc

SHA-256:
06de5b453c190ba1c735eaa62f68f9634565f63054e78f035d5f45c922a65ecd

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/27/2024 6:13:44 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC (M)
16.11.28.11

File size:
933.6 KB (955,968 bytes)

Product version:
2.8.6

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\hayday_game_downloader.exe

Digital Signature
Signed by:
Mode Quality (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
1/7/2016 3:37:46 AM

Valid to:
8/3/2016 9:20:26 AM

Subject:
CN=Mode Quality (Alpha Criteria Ltd.), O=Mode Quality (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121F7B537910FF19F9FCEA90DA601703349

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:NiGYBIrSqmgQxYjnCddRIFtjtLN7AXUvBszXChyEr+Fk6xcJ4oBWYH:k76r2nxYLCddOF1UXUvBSysQ+FnxJw

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9365

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file hayday_game_downloader.exe has been seen being distributed by the following URL.

http://www.vaultsconceptsapps.com/f03NSD_PRdnLII_FFG ZE piv2nzpu0I_yg0cKY_99qo69HEP20LgrBrJv3i649P7kCxUtJbUlE lFqn8XPg MXbEz 9GsZswz_DutIrs siWRfNY6ebXsag7wWN U7b4OSZNP1 UYgkpZrHFhhzwSe7vOKdUYCQw8Q KQbdGba2 Y031NABOFf3eXvCVx2yKnVr7uIIc8ch6m6SoiKDzKWD9zL1J5aNQ5wDQgH2MnrKpdNUYqMtCiY0XpnrYRlEhi7kE51qULPkxbUFPOWBd05ivMwZQPGlY5teluMV ZWi_Rnd_pg6cFQgaIBRz1mP_ MnD9g_OGc R9w9K_RKYvaG1dhHcz3TaUbWbd75fi gFK46LSpYmmMp7h0p2cH_qmLnaFB9huG73YYE55Fzb7_3giv94Tq8QBhuk6lxb1ityk48frDGOwOw39DJRaVt6UJOL1iMYNlaOE1Sbh5JMSx5 PZGaf3epPszD7BNZJqA5VmwHqIwxytaKzMw2ggjankiukqsn63zoKiCsykcVW6U7sk12XRRAZC0l7UJPXQdMz iSyc2J7ipFTe1ivCd9rWdC9TiOu6QoJX8SiAxlpdT7BOD9w==-GyoAAMQuF5svWSAJxQko5rZ1IZLMopDGNg_Ejbt9TzoBxFoOet4HC6tFUQ8=

Remove hayday_game_downloader.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.