» installer_bearshare_sciagnij.exe
Overview
Analysis
File Details
Downloads (16)

installer_bearshare_sciagnij.exe

Hapoc

Delivery Superb (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application installer_bearshare_sciagnij.exe, “Hapoc Setup ” by Delivery Superb (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.

File name:

Publisher:

Delivery Superb (Fried Cookie Ltd.) (signed and verified)

Product:

Hapoc

Description:

Hapoc Setup

Version:

1.1.2.3

MD5:

9e010a9d854263797c2fabe790f421f5

SHA-1:

8c54bf37710f2a7070ed6b4b34f4f24cd29b0bf2

SHA-256:

b7f5f78ff9a1b422945506cf6d14aab457c426d454fee4763ac9ce17f1b89271

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

12/29/2024 5:30:23 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.Installer.Installer (M)

16.2.25.1

File size:

1 MB (1,076,448 bytes)

Product version:

3.1.0

program

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\downloads\installer_bearshare_sciagnij.exe

Digital Signature

Signed by:

Delivery Superb (Fried Cookie Ltd.)

Authority:

GlobalSign nv-sa

Valid from:

12/17/2015 12:59:53 PM

Valid to:

6/22/2016 4:54:14 PM

Subject:

CN=Delivery Superb (Fried Cookie Ltd.), O=Delivery Superb (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

11211DDE033C8F24FD358ED7B6271AD4DE2B

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:UrJ0sYhNlI+B8Q0j3SxuQVyQPGCBU8I3iSsc7tHv3o0bDMX:UNHyI+BKTQPnBUzV7hv3eX

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file installer_bearshare_sciagnij.exe has been seen being distributed by the following 16 URLs.

http://www.signbinariesfarm.com/c?x=xX0LrUukdgRWBQ sG2ruYVaKuj3imVUCglJW7G0/D9E=&c=IGPJFh5wAY4rRLs73jzxkO3efYVL1x6/u9h9gNt7NnZrgdTfQSfWtSPsfspIGazPCXgQusw MlQQrprChfaNgqMT/SKER mIQZnuNT96wb6ELVwcwAw3NRxBX9xz0dfu&fallback_url=http://download.cdn.bearshare.com/cdn/r/.../BearShareSetup.exe&downloadAs=installer_BearShare_sciagnij.exe

http://www.signbinariesfarm.com/c?x=csAzFLVljFgGJcqMtiiBN gCgxsHMWRN3UuAOP6oIoQ=&c=TgpQxSXKJcpwqVKtTZslyLOkHpHdXtZnrV0M6b2200fGSKXy8yJCWh/L7U5v/EU3pFkWUS3tL1JmbHGbUuctAR/zS6siu2GZkC2Nvt4rN3itBcVctpteXd EttTiBUXWwtfMIWaGlG7X5MEeIKCJg==&e=0&fallback_url=http://download.cdn.bearshare.com/cdn/r/.../BearShareSetup.exe&downloadAs=installer_BearShare_sciagnij.exe

http://www.signbinariesfarm.com/c?x=wo/3eE7grVNyl1SeF0kqJloELH2mVPHG4aXUjMXFvgM=&c=0CyFAECIW5clJM5qKUChEAGPwDeWbFHC0E1cOCjLsGfnakem ojFgXFm4/fw6 v0vnAAT22lmoPpoEMeRasv8qPL0BR06/rrc4UOaMnWRyiRFh5mp8doDw8M9yG4PVnM&fallback_url=http://download.cdn.bearshare.com/cdn/r/.../BearShareSetup.exe&downloadAs=installer_BearShare_sciagnij.exe

http://www.signbinariesfarm.com/c?x=vwL7QfjzHJaU tJxcVsx/5syiKzvYuTrbMhCh7xTyOE=&c=aSFxNDTxsTRJUUasXq WhafNrDI5gKqK58hRdrA3A2tJ pYGIPkt3z4OYSIW90zPbQk6nRmuCZhAXIXfERhB2vda hCzuVxv8iqfypPwnC3G7hLaEqyLH6lOZRXzVPH&fallback_url=http://download.cdn.bearshare.com/cdn/r/.../BearShareSetup.exe&downloadAs=installer_BearShare_sciagnij.exe

http://www.signbinariesfarm.com/c?x=MJSnRFC2WkX QLUI5parZrKS2lU16ADkLf7 FwRB6p4=&c=HjsAjghkbfMmWbeDVtscvW86UJxiBk7JPdWRmgg0I ilNDBFPfTZbkLFY HYHDdYs huikLwhqFfs9WKHo6MAJLtf8kxIArBcS vQhaCjJgdIYC84QSnQXski1aV1V m&fallback_url=http://download.cdn.bearshare.com/cdn/r/.../BearShareSetup.exe&downloadAs=installer_BearShare_sciagnij.exe

http://www.signbinariesfarm.com/c?x=Ag9FIkSzYzHX0BwPDvmletN/Dig1eEBLyzVq7 rOw5M=&c=EP7Rr4ftsKSG9utrF3CCnvP6TWv51XshLpbEwT328pDLoK6hLIHm73PRyBNMUsqcnwAuCbvYuIzncy3mtXDKBhfr7 mk6hGB3cKXdtt3UVZqputcTR/krXXl/ltmva2qwwkCBGiW2LHQADkHRvYWjA==&e=0&fallback_url=http://download.cdn.bearshare.com/cdn/r/.../BearShareSetup.exe&downloadAs=installer_BearShare_sciagnij.exe

http://www.signbinariesfarm.com/c?x=Te0llkf0l4 m8V1vQ/f2KvmCQTwQTaF R5BXVehEWQE=&c=JkrOYfqwQB/oYJ5PqXyuowzfLI2Bj3MdOeMBab4breZqMxCoySm4MmEBh1L2PL0k bv1IobnIjQ8wie5T1VvW09G/zBI8VANywct7Nj6oQbJejNG4KmYzaE9uYk6Tc9H&fallback_url=http://download.cdn.bearshare.com/cdn/r/.../BearShareSetup.exe&downloadAs=installer_BearShare_sciagnij.exe

http://www.signbinariesfarm.com/c?x=790lhZmbu4hftetV9zdksPVPQmg3uoWZPPAL1frWVi0=&c=SGpcxZ9kNzS9JR y1hknB6qqmyQvG5GJi4u 04r3clj2sMw /4j Dz5YKWM4on7 Br34x30m/WqX5A5A78SPmRP7Vt744mvgPJ71L9ePcUzxuqMjobQoeJwruaKidpBU&fallback_url=http://download.cdn.bearshare.com/cdn/r/.../BearShareSetup.exe&downloadAs=installer_BearShare_sciagnij.exe

http://www.signbinariesfarm.com/c?x=roOFfheLuiPCVnwlGMQwpMzoA3c43Nnrb3454SDOZFo=&c=Az7F6yVcF6XorU3vqmgbMZti nfAZ HcreGeuEvkGa51VVCZjOrnvGrTJ1S8DbcjgrLB7HnUgRTDZDvpmf2OIrefAxiLmvuQEBNt/grV3HaXXrIdePauSTZQxXhpNXfE&fallback_url=http://download.cdn.bearshare.com/cdn/r/.../BearShareSetup.exe&downloadAs=installer_BearShare_sciagnij.exe

http://www.signbinariesfarm.com/c?x=6uOUdmajdZ4u8OhSEwTz8RULViEoFtY6HAo6OIhDkI0=&c=7xJ7e6i2zH/X6rctgs quXrulyy0hhuZSqTvocfJqtUbEe Te/mX50RRytdowm7DZcCJxWf6JNvnkE9wrR0OdXANIR3GcSrFDya7B6rkdkmpARh1/1x6YwkKy5WDv8Gg&fallback_url=http://download.cdn.bearshare.com/cdn/r/.../BearShareSetup.exe&downloadAs=installer_BearShare_sciagnij.exe

http://www.signbinariesfarm.com/c?x=C7h3/GY/JrCgAvcEATgsLdX 5PzymCOkLic9Id263AA=&c=oxr3VH3n2NW6zWXqJivjtd87sKZMXMQ0lrz4rCGbOTAyh/EnK2coIgkj4nH97r/98u sIRvwHU2cjI9HyBKlQU4uPYurEMnN Cl7Mqz TpdbFLY1cEt6LaleGBG2DGiu&fallback_url=http://download.cdn.bearshare.com/cdn/r/.../BearShareSetup.exe&downloadAs=installer_BearShare_sciagnij.exe

http://www.signbinariesfarm.com/c?x=vRDK5mP3HIzZJmHBLaNXPeBSvZqwCimBEJFeQR/AWyU=&c=pD wfMSWuepRNL94vbPHO2xw4eTHfpm7AIOin0QMY7evokNfWSB9wJsRXgBEUwWHYN223WeMYiVLm/lZofOap iWe0mgVcjNP9XTpvsPc68F LDhmmcKiPEexftSMIer&fallback_url=http://download.cdn.bearshare.com/cdn/r/.../BearShareSetup.exe&downloadAs=installer_BearShare_sciagnij.exe

http://www.signbinariesfarm.com/c?x=wKhCsFkIYT/Urpdu4nZn5eySg/qkIBkKqXafea/PiQU=&c=0 obXHGoF8SAP3aTA977E0GeP0NSactQkAUUZV1pwDE6QCrg0qHUA4uu9AO9b7qQzEI5s1kPR/cjQnLaSVr4avrzsfsYi9zPt39aBy3M0Y36KaUdz0bghtsDwUgWBhkz&fallback_url=http://download.cdn.bearshare.com/cdn/r/.../BearShareSetup.exe&downloadAs=installer_BearShare_sciagnij.exe

http://www.signbinariesfarm.com/c?x=GlLRkpoKIEBYHMXO9XL9WpGbj3csPThMOOPHaBGVNrQ=&c=87U rqK1kTPl3agDtQE 3wLSCWws6d4dbld9ph21GQc7z28WtZDMWRltZbqG0tSEp4YOLFhOfcQZhga0Nnr504wB6QtIcqxmu6BhvQDAyR47r769zvqmnW9z2tXAiSLd&fallback_url=http://download.cdn.bearshare.com/cdn/r/.../BearShareSetup.exe&downloadAs=installer_BearShare_sciagnij.exe

http://www.stockheadapplication.com/c?x=Tnh3loyI3CFSG1vrkGWQ5Nt7IITzJ2JH65taItLjHCA=&c=u2J/kzA38IIkAyOclpEBssIGG1blnIjHbMaWnSAk3O0ELAazwsjEi7yj wXPHfFO3h8ZqgoB9cwTM2dFPQquZo0U4GlQqyfIZNMi7RnOQz7PWFdpfyVbZgJZ 7qJYL5bOgECr z0 yrLUrlzgUxRBuH0gBPxc1oeqsXPBiXLgar/MHO4OMZzTbGE63Q2J9Al&fallback_url=http://download.cdn.bearshare.com/cdn/r/.../BearShareSetup.exe&downloadAs=installer_BearShare_sciagnij.exe

http://www.signbinariesfarm.com/c?x=JUeZtOL3F7FHVFwh1739yycum Pqy6Llxq9wdndemYE=&c=Wn8S/1ixl IlzKUrrJ8oSX8md8VCcDme7/39fjmo0NlnyxLDVQVwa6YwB8zPtC15BAxWqG6dE7NqpYMxzoFUnCxb2Nl4i2ELiCfmLvaoCSP9i9D3VvEkZmlRKzt7MJdyPphDkhlMdaB8cN8Eta6m89NTRltUMMRHP2qIUfj8rN02WBpkATnUVcoExBpCmuQq&fallback_url=http://download.cdn.bearshare.com/cdn/r/.../BearShareSetup.exe&downloadAs=installer_BearShare_sciagnij.exe

Remove installer_bearshare_sciagnij.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.