home

installer_counter_strike_1_6_0669101701.exe

Kutikud

FunnelOpti (Alpha Criteria Ltd.)

The application installer_counter_strike_1_6_0669101701.exe, “Kutikud Setup ” by FunnelOpti (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.sendchucklebulk.com.
Publisher:
Beremiled   (signed by FunnelOpti (Alpha Criteria Ltd.))

Product:
Kutikud

Description:
Kutikud Setup

MD5:
7e3f8daae7ec5e79ad40add0fbc529de

SHA-1:
ebc81d78fdf4a60d7b913104a84e4c6fd8edb3b9

SHA-256:
5fd41611eb01620d71d5d96810ef6a79ba8f426f29bd06029631f2a5fc618d7b

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/23/2024 5:30:43 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC (M)
16.8.11.5

File size:
936.2 KB (958,656 bytes)

Product version:
1.8

Copyright:
Wizard Internet

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\installer_counter_strike_1_6_0669101701.exe

Digital Signature
Signed by:
FunnelOpti (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 10:41:21 AM

Valid to:
8/26/2016 12:34:53 PM

Subject:
CN=FunnelOpti (Alpha Criteria Ltd.), O=FunnelOpti (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121C57D0836DF0829F54F07ADA2D08AAFCB

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:lAk0HIDTJOC8Rw8jElWnO9STAqzI8fC2sIt:lDMYL4w8jcWOX4C2sq

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file installer_counter_strike_1_6_0669101701.exe has been seen being distributed by the following URL.

http://www.sendchucklebulk.com/1iussrE1U_qJvUXi0lcvzVWzC_64_W2sjY3JwK8wrgr8_pUiekwvScbSHzlfwdqIi0lQrg5vakThNCi8fmvmzAwQA2UClpQyS GJMzbJkuk6haa21m6j84FGGYCgOxEi5ynpA8MQmtod7BEmTjU bbeMRosS_pNEwm7gpFvSX6se5Qoy9VjkCiqp6JCv9rnvAgdO_EHkq4ucO0IRUY8uX3J347yps57vPm5nvg0h36_NfoqYGvViXZlVz8pf9yl0yDR2uaQTe9xM2 axmHNuwGvp_GQn0AdN0TQFDHpzHAuCwFrzyfKjnjSWQB6c2iLpdpAXVq6s5a3vs08pNqFGOzT akBsETjqmVDUBpRylYmPaw87vAOcQy130JJSkbjYx7KuVoQ005SdWCTG2doY8jnzsrq24bpCEZFUaJhRPZM_f54LHiLpH0uX3chLEdxt1oPTm58eQeqUu8R1HVIh6O85JTy1Tfen6tP1 qJywjnS1xfz4NhyvJ5bGkozYz38h1WfDFKAUDohgJ8Te4fZMnvba8qZJZqFH7MVvBUXsfzrdm4DOY4HNVnhcSWIHncL0tEFPdUOg PZWEiertu4GKcrWVni dYAABdMbZ1RrMuCkGdKF8Y4NI JG1C2pl78f5THiulll0ZCmpP9AIR0SaBq_BCtVN_CSPPDVI28WSLawH7AAIyzs7vx KppV6ofGziNIMrXhIlynx_Jebg4pmCwAl0st1PhAI7cvCVr8Wl xoV4XTOcazk9C1Q__NiRto71JT5Dc7mc_rC3VcfxfS6U8rucWHkWgziKAP8h0Qs3JF7n0Dc34hZwn_5MOzLMKDqi_rddj9ymMs ozLfs308W54zrwTGR6L7bQ3WrDLK1WUHT4CIT_tCf1Ck 7Vi5JMR1IZvcHdWV85DDuQx3QtDoyrzm_8FTcOliPZi1q8RYGilhyKIKMZZUGUT5kV8xQ7NI2rlX0

Remove installer_counter_strike_1_6_0669101701.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.