installer_microsoft_word_sciagnij.exe

Hapoc

Delivery Superb (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application installer_microsoft_word_sciagnij.exe, “Hapoc Setup ” by Delivery Superb (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Delivery Superb (Fried Cookie Ltd.)  (signed and verified)

Product:
Hapoc

Description:
Hapoc Setup

Version:
1.1.2.3

MD5:
07413c0ffa274c515c8ffe163d77b09b

SHA-1:
cd5209e6e176391232df4e4df06351b77e9daae0

SHA-256:
6d3d5fdf6ec3d3698d690cef3e93b2fabe16faa192f70bbd691729c793c7e59c

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/29/2024 5:41:13 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.2.23.14

File size:
1 MB (1,076,448 bytes)

Product version:
3.1.0

Copyright:
program

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\installer_microsoft_word_sciagnij.exe

Digital Signature
Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 12:59:53 PM

Valid to:
6/22/2016 4:54:14 PM

Subject:
CN=Delivery Superb (Fried Cookie Ltd.), O=Delivery Superb (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11211DDE033C8F24FD358ED7B6271AD4DE2B

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:HrJ0sYhNlI+B8Q0j3SxuQVyQPGCBU8I3iSsc7tHv3o0bDMX:HNHyI+BKTQPnBUzV7hv3eX

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file installer_microsoft_word_sciagnij.exe has been seen being distributed by the following 50 URLs.

http://www.signbinariesfarm.com/c?x=RupfPeE7FxHRwSv55d8 aFYg1xboCdtqyMyPUfL8yyA=&c=MbIGcIs/ozMe5k0jKn8TKxzZDmoMN4CUA1T4ZVArilzDUKTJQD3YCVc/pIXnoPgePrmBYeOFAVmwDisEhVeCd6if2gQS3j3NfiSrVh5dV4On8DCJf3RAK2BTihaZE8xQ&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_Word_sciagnij.exe

http://www.signbinariesfarm.com/c?x=Hjc4N7kkTYEsAr1ems5sNv/Q 106 0WYpYJftHnmaa8=&c=mnDRFtYbmKiwEd /48IBpmu/ElMsromW4nJ4mvEy2ADPbDBd/j6rIJn3XnEWZse1Efrq7DLkCZwcYLWvNRLB0KmT54AAgeitTeq3rzC3EjKLGjns34dyAu1Uu5CPqECSIpeCmbylzwBlRfYnLA4S4ADCtj3gbiqXydNSnzxaZZUEemOuKPCmxmDUn5JFVJQr&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_Word_sciagnij.exe

http://www.signbinariesfarm.com/c?x=jTmDH/UH3qg2M/tJpKYn6kT3CETvTZFcEGlVtLFtYq0=&c=DIypPhiP/6THQq831CRqfn9JSCsXyPp4Zkg/nWqe0 I2wbzzpzb2QWih3rTQfe6uWr6haPgFHprWnT8HAODjzAWoZoJiCHZXJEZ5rWCB37XivioBLQ8FSRLLltsSuzsx&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_Word_sciagnij.exe

http://www.signbinariesfarm.com/c?x=p3zHKaOSBZjt4blYC6KGAoCXfo/ m7zm4RjMFTJR15w=&c=x mnVGMc6UD qG9VHmHVCMB1brPMgsX1A5BiwebeU2rbD Inj3dXs5IlJ4C1gRvmqjJheFYU8Nm4C6bP60Q7efxQ4xBZKyRQcML UhKVHcvchXwM5V7bdfUUJZ7VmwOq&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_Word_sciagnij.exe

Latest 30 of 72 download URLs

Remove installer_microsoft_word_sciagnij.exe - Powered by Reason Core Security