home

installer_autocad_2014_2014.exe

Kakog

FunnelOpti (Alpha Criteria Ltd.)

The application installer_autocad_2014_2014.exe, “Kakog Setup ” by FunnelOpti (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.sendchucklebulk.com.
Publisher:
Cap   (signed by FunnelOpti (Alpha Criteria Ltd.))

Product:
Kakog

Description:
Kakog Setup

Version:
1.5.3.4

MD5:
e8139f0a1a43b4f85e7ca1013ebb374d

SHA-1:
77ab6a370bdc7c32914dc97b0dc8cd918856274f

SHA-256:
04f3e139adc7ffed16e240b2492f11dd934e6964a3329f9ff1a2af5b5bac67cc

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/25/2024 4:19:30 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC (M)
17.3.16.2

File size:
931.3 KB (953,616 bytes)

Product version:
2.1.6

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\installer_autocad_2014_2014.exe

Digital Signature
Signed by:
FunnelOpti (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 7:41:21 AM

Valid to:
8/26/2016 10:34:53 AM

Subject:
CN=FunnelOpti (Alpha Criteria Ltd.), O=FunnelOpti (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121C57D0836DF0829F54F07ADA2D08AAFCB

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file installer_autocad_2014_2014.exe has been seen being distributed by the following URL.

http://www.sendchucklebulk.com/mH_7WJymv1 N1ZmkoU5P3VRdotMcNg1ty9YtCdzWw8bEsDxL7Fy4Th6Rn0w3QPgd_TgIH Raf xlWg3rKtg8l00 t4rp Pkb5Lr5WcGq_OKJI31 6MWi4zhKh2stnXmqhVcahlDB21k2aji3q07zgvyV1fcjrhBtSl3BdiSQqrS5lk a82GYTpgxWDaZqhH5cH8CwEqoFmoa4iVMZWF5AQVsPdhb8EHEnwojKT8Hb4EQ2Hyh1fWV7VkZXijemmqTBdCVMO7UIUS3Hd2VvnuyPNtUgPRcqFucc9qlw_u49QiHDRYclSi0MgrUPojfHgO7o_3IVPRQgD4h9otYJ06J iI2kP0XiLIWrLJ bAH6ItZngN3zNnV_n4SycCGYn7aK4sqQ2c9kBPOWSNWAAiu4wybOVdSZfeiomg9btEIOvP7Q0Re8Mg0yc7VXKpLXsWBJA 23 B3ILk7H5z8OWEQYqGzeYCMVXHidYZTqo2bjVprACsqNWuEDko08irJrTFw6trizjPMSH0 HIR5earsOD9nq9meeFMYviwsLCbffZOpNNLmy5HOHfbARDPFk AemLKwsIAPVx7SiZfiyQc0nA_Tjcp07YOEGk4xmEFaNG3kLT0rs_ WHz iEpOjedHGJIogaVF7bNIC4T6TLG1aCRtjlQw_t6UjoWxPx7p7uv6V8TTVXqy ekW5bRMzy7QMeAL_uCBiyQiSCYLzo1k0ofohllKnOhiTYJDEwc_NTZ6TMS6apcgoge A69Nner_JolCKkBIze2Y8BdQ1dWWcTPxVNY3Gszpzs80 6dllUO7IECSuzu kv7sE4vS4ww7jPnFEt1QkYroRAaKZ5HV96xcdRApOnyxeugQHITeEJ9tIXd8Lc6fZ1Rws9qpa1U1WlocIAE4LiP7VCHTI4KWNegijRzq7oktpG 76hBMSCE04P5lK6fwFy38Ix_tC4xP YQ_4H88mfd

Remove installer_autocad_2014_2014.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.