home

installer_microsoft_excel_sciagnij.exe

Funusikem

AGORA S.A.

The application installer_microsoft_excel_sciagnij.exe, “Funusikem Setup ” by AGORA S.A has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.chucklecurrentconecpt.com and multiple other hosts.
Publisher:
AGORA S.A.  (signed and verified)

Product:
Funusikem

Description:
Funusikem Setup

Version:
2.8.2.3

MD5:
da5ed95ac0b29e9af69ba0728209c2ea

SHA-1:
481a9c15c7f888582f34b393713c2688ec4a4580

SHA-256:
80a673875c71498157f12ddafa4da3b1e05419580525e43bb1d9b2aa75a87d1b

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
9/29/2024 12:21:18 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AGORASA.Installer (M)
16.5.4.21

File size:
934.7 KB (957,176 bytes)

Product version:
1.4.6

Copyright:
Fast

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\downloads\installer_microsoft_excel_sciagnij.exe

Digital Signature
Signed by:
AGORA S.A.

Authority:
Symantec Corporation

Valid from:
9/9/2015 2:00:00 AM

Valid to:
9/9/2016 1:59:59 AM

Subject:
CN=AGORA S.A., O=AGORA S.A., L=WARSZAWA, S=MAZOWIECKIE, C=PL

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
615B57E3504C929E3B64ED936D1CE68B

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:X3mdjVK18l5wmIr/dcFOEw6NUyZOYBwBCoHH0elc:XWZV7Ir1ei66aUBVvc

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file installer_microsoft_excel_sciagnij.exe has been seen being distributed by the following 15 URLs.

http://www.chucklecurrentconecpt.com/c?x=iNHUFY0TohwOypZ/tIa7NQFgpYVmhn6tuqjXv9dO3k4=&c=5RFxKSWm9VdBHmrzlTKEdAJcf8c8P07LDm582 0pG77hJq qSfrV3q7YtJMm LC9ccJzI7O7 SQmquBX57Iy2FqQpnSrDFuzK/NY4sLYb2fFVU53MBq/L2gVVzJKZDpY8Mi5aVkOGKybh0hE2phi9w==&e=0&fallback_url=https://products.office.com/.../try&downloadAs=installer_Microsoft_Excel_sciagnij.exe

http://www.chucklecurrentconecpt.com/c?x=zdXOv4UfUPM10jaF/rc VoZORjjjq4ZWZnxpEQ8NoxY=&c=roo038NS0AVT7K3WPgeVOuWD2jDCddKv1e7FbrPZ0QcU8eu2ey7H08TqHQ3Od2IKux4IovLxVJuMZ/4RCUt7NG/L2w74wA7dvABtzAgHwh/HnclQuvLrEoSgHc 8ipS9gBkQtZGF2FfCoKkbJb ffg==&e=0&fallback_url=https://products.office.com/.../try&downloadAs=installer_Microsoft_Excel_sciagnij.exe

http://www.tourstockheart.com/c?x=dX75Ilslti2sc/LSs0Q8de8kX kKhPNh9n1ALkifC5o=&c=TdPsjnYa6eeFN3nFUCdMogFM07QC0czrbdObsldhAGUVMbH4z9eiqC9m kPLIMARdKc2NeSyqSp5O9NtA9rP0/0XLA3H5CGWQGaQScKFaP7NrrienD08i2gK2YbSX2yr&fallback_url=https://products.office.com/.../try&downloadAs=installer_Microsoft_Excel_sciagnij.exe

http://www.tourstockheart.com/c?x=nVWdmVpUQWEpdpZY8JJ7h7fi7T11b0V0XOwUN4J9ZEI=&c=L9DNhTdkGX/IzuVTVz5QRDrXOhAheg5n4Ekxjhxdv0Pkj1xstJTDCli5lc2TsLQpUUi/6Cu/60hYvjgfkhmVIxjW2W6IGxXl9vK/9JPtSCBJP5a3EO tiB3Wwgqh8oW &fallback_url=https://products.office.com/.../try&downloadAs=installer_Microsoft_Excel_sciagnij.exe

http://www.downloadstoursquick.com/c?x=1lW5u9n7lQOlbn5F6bU33aIqL1CfoWKbpln2X4ABa18=&c=8SL4RV2ohEGBrV1 qxXEN4yxmAyLQ7WoYYMRFUtoo4L8Sqr4z/Hx/Z8 YBNdMZYjLmk/QkHdMjnbhnt98gCsUBl3JNcLG5VtQGcY/gl4tvoslVkMVYkV8kZh0frkjKEJueTEsmoiu1UUeQn7yw/Yjg==&e=0&fallback_url=https://products.office.com/.../try&downloadAs=installer_Microsoft_Excel_sciagnij.exe

http://www.downloadstoursquick.com/c?x=21/ISVbRR j4rUvxZWr7fxX dPFy UWQTk1QegR hf0=&c=U3Xo3htjaDr/QASwlCwp9JSYh4boL0kARJEg8 m6DjErTFaRKXzigQuco6/5H1Ahiz8 6vV1/2b4tcwWVH3IjAorSiIftkH3lUCrLllinRtwIJSdyGFA4SgLk1yh/R2Cl TRxghsEg2rIfdyL/R5Kg==&e=0&fallback_url=https://products.office.com/.../try&downloadAs=installer_Microsoft_Excel_sciagnij.exe

http://www.contentdltour.com/c?x=apostALjjSQsrGE2fh4mW9mlK3I6FiYo2kM v1ERrqE=&c=D/oUNcGvWVqgeo5VunkNjMMtepuH4Xzw/rq6D41xm5xwk3RrNai1FohZG CBp5HKDnux3RN8t4CAM777PhXTJmHJVQfh0mSSXu1jMobvXYWZGc Kebk96tYkAaUcMtfN7YNFDlsKkWlGB0kCDpikxQ==&e=0&fallback_url=https://products.office.com/.../try&downloadAs=installer_Microsoft_Excel_sciagnij.exe

http://www.todaysharecontent.com/c?x=hKdIGoXmnNj/uuijPhy9rHI9fM JMjT8J6wiW1N3a5w=&c=3Uh5YyYyXg887WxSGPsqxs3sXYwRBQaOnVL7FD6wu2W7ICW34Xt5cQklKVsh1zI/25hKfurdFICK3HVpJ3UbVfK53LwYGYTaNv2q18bB7odYp5zf8yE0VpMChweH63Vs&fallback_url=https://products.office.com/.../try&downloadAs=installer_Microsoft_Excel_sciagnij.exe

http://www.townuniversepresent.com/c?x=TMb3RNHHvbHGqBgm5Xi98QAu/15INnkorHcpWYuVpoI=&c=uSGY0Kc5ObhDhzy4PMoCOSuISiUUoES0pP0jTEaAaiB85n/bFjHPuD11DbfdWxybrAbPA1miuqZ8gtgS7zlSGBild 8yfMfKKu7xjXbVvyQwAqAjovTfCevu5fzsMONs MKIF3cPlPaAEM wYQBu5Q==&e=0&fallback_url=https://products.office.com/.../try&downloadAs=installer_Microsoft_Excel_sciagnij.exe

http://www.hostingranchbundle.com/c?x=XZ WAA3y0eJqKk22YRFci6GjCogvPlow/aeFId52B0U=&c=rDsBhO9spo6fZ/Vlf3jWjvXZSmJqpBip5buXno3cjLYSQKR3zzr96kh4BajzvQ2lU2aSaVSdUXi9mXSgTEZNeUif5gyMk6D4mDSWCmILYNsiExj73gCwD3EIEJV/KHAruF/C8k7M3ciMnz19Dxq1gQ==&e=0&fallback_url=https://products.office.com/.../try&downloadAs=installer_Microsoft_Excel_sciagnij.exe

http://www.bestbodybulk.com/c?x=AUZg2nPmdFHxaJqnd0EkLC3ULcTf3EBnhHDy EInOOI=&c=AT/dMqMIR25/BmJC4m2aGZu6ZlDpOPzPI3s4VcQGtzcG44xy GUBxt7YYSWn9I/8zTboKYAUCvmqB/nmghjEa4x5KfSu9Wg2i727zy6JVSuNNiZngKNvAQxRYae61GeYCFY3n1IKcjByyf3kWXVzCA==&e=0&fallback_url=https://products.office.com/.../try&downloadAs=installer_Microsoft_Excel_sciagnij.exe

http://www.tourstockheart.com/c?x=qBPhnMdL9m7PxzqvszQIKMoI5I7XN7N59zC5D9GdNDU=&c=kC8b3q6fljEPEOP0uj7Ez6ncSA96vBAXmIDQMz cJFO35UUPgRiaOYMPdeFH6YB4aHcQV1nONwC8sAIEZSA5M31yQcupIl9m41P1Wyqr9nqBKnJjalNkkcG0cCCG dVh&fallback_url=https://products.office.com/.../try&downloadAs=installer_Microsoft_Excel_sciagnij.exe

http://www.tourstockheart.com/c?x=B1w/7O1WHaEELeFn5Xyw0nM Scy0 LWy3exnxGCXx20=&c=NXsEBymC17niI60gADjJ3OYUXKr4ijF6FVng8rz2Q9EJ6ggNxpa60t4YK4h3ynuYIKPfCJr3Q9d5Y3RHqPcKy/z145BShg9KE GozRvOSioZ8qDdT7Q/6W/cMnlw/CbY&fallback_url=https://products.office.com/.../try&downloadAs=installer_Microsoft_Excel_sciagnij.exe

http://www.downloadstoursquick.com/c?x=en7OAI9Cjq27X/Q2qQvqinac8p2OgMcC5 FOd2NCchg=&c=kbrNDtwyK8KNqEuHci6CigCuNdBnyHnRl9i1epIKnlEKT9w91Dt65wgDVWQc1JHcc3b NYAfHSj5NIoF4s sh29jq6R/TJ7wSTq6uJcpSjchxw72nvLcJF WC8aZiLZknrOKjSov2n0N/qUSTw67Ug==&e=0&fallback_url=https://products.office.com/.../try&downloadAs=installer_Microsoft_Excel_sciagnij.exe

http://www.hostingcontentconcepts.com/c?x=XVw2T/bZ VcGitSUre1LFUiNjsYue9gUr KLNUAVzJM=&c=4TDYcU5g6yQ06X96SU LY3G5RzbABOPVLesKTHv7vV7hNyInoXj4L6ug4voWV0XvpMetle3/5Rt66rDlXRn7w0W/7tiHrw9Jmpvo27WpJrRLY9zsT7MBq9crDow1KouwdOuQD980B1oub7D6yeeA4Q==&e=0&fallback_url=https://products.office.com/.../try&downloadAs=installer_Microsoft_Excel_sciagnij.exe

Remove installer_microsoft_excel_sciagnij.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.