home

installer_the_sims_4_crea_tu_sim_demo.exe

Nodud

FunnelOpti (Alpha Criteria Ltd.)

The application installer_the_sims_4_crea_tu_sim_demo.exe, “Nodud Setup ” by FunnelOpti (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.sendchucklebulk.com.
Publisher:
Dic   (signed by FunnelOpti (Alpha Criteria Ltd.))

Product:
Nodud

Description:
Nodud Setup

Version:
1.8.2.1

MD5:
be676173a007c31fc3dc1c79a41ec759

SHA-1:
783127460862907cdad54bbf60640c35301ec33c

SHA-256:
55ad2e506c34a76b384233683cf9a31f555eddcfa2554f883d975c0acd6b816f

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
12/25/2024 3:34:57 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC (M)
16.8.11.2

File size:
932.3 KB (954,664 bytes)

Product version:
2.7

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\installer_the_sims_4_crea_tu_sim_demo.exe

Digital Signature
Signed by:
FunnelOpti (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 1:41:21 PM

Valid to:
8/26/2016 5:34:53 PM

Subject:
CN=FunnelOpti (Alpha Criteria Ltd.), O=FunnelOpti (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121C57D0836DF0829F54F07ADA2D08AAFCB

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:xi8VBEBNURb4j+epBTdYWQYMKkY6SIMTsItJ:g8Vibm4fTdYzKklSrTsq

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file installer_the_sims_4_crea_tu_sim_demo.exe has been seen being distributed by the following URL.

http://www.sendchucklebulk.com/ b9s0OMQ28I3zSRx0aK Xgz5e9okPlhr 4qiC7_PeIwgiP2cLX5UOC_OqNFNtzVqvC0ZQW4yVjJtCkXcsnMiXvs_E8XuMdx7 i0OtSnnYcuKBOUK8hjNbQogIz3PvfusGv_3AH_IXX__dTBxg86nZgCzPJP8PIZRiNLs7P_Y1F_71I3dVLTgDeuAIkYsbfvrcRhu 6nQmfdBxLdd0USH1SUyU1VAjm8nfzbukQcNZCmBvGICzY8Z64rtPKaHSHpzDX EmhvLBS0h27qEZhp6mmdQM0qoMsI DKrz0DRgGenebXOKiN_DiQXKPo7A7G8S_ AsD6ZNODKgyBb75w3w2x9K7vIsvODSPtUjrKoS19ibWTizlq9As Uy19CtJrxfywbD3OPPjIu JTs3HWOrYf3GTR2dKFjXVrpDjw1wEKJS5hdlrVTsITyjQdp4Xt s6uTJcgevWxGYAZgANI74MnlxxWEmsWQfyyFnlTF02RlfXCjj22chHot kvErrPbb1VVfeYfUwb9zhqZzsZVwjUDOeJZkuo6TiAg9UCIXQj7Di00sAhOWD7MeQ0F_5qiC_Vcbn7jCAy6B0e5fsC5KvARJvRSzQoxa5DcN3mWtD4SELKz0xRB5 Qm6 DQG4_rfEcPxvTs_X pHVAl l1UhWsLPXt7VqujLQ2WNnz9fHU6E8fa713IbdETYU0He2vPLzGWrgryd_LahLQiRzV4esy nW0kbI9nPfHowNsjJE2AF9kf3QDnP ppqji0_dMBCTAGaOfLvPwYuW0BZoM2ovE0JNAMexw04xYQ3EgjtJBR08drNqnbmj9Gj4JTB4kfQ2pr7GvCR5cQvzbBkS WRjku5ReX1OCE7fBMIbkVeGWlBnppGz oG6cazP bBqzAD7mlCA7FPyUWAVpC9huCDR3I9AMHKvDaNqUh1KT63ubXPkSx9rbNxlAv2CKHbYYiVaN0HM3xu

Remove installer_the_sims_4_crea_tu_sim_demo.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.