home

installer_whatsapp_+_bluestacks_spanish.exe

Naradoge

Source Beta (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application installer_whatsapp_+_bluestacks_spanish.exe, “Naradoge Setup ” by Source Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Man   (signed by Source Beta (Fried Cookie Ltd.))

Product:
Naradoge

Description:
Naradoge Setup

Version:
5.5.4.2

MD5:
c88ee7fcdc93b31b129100cae4416147

SHA-1:
7263d0a39d6c947d8c44fc44ee3ee54d7b7a7ef4

SHA-256:
f1522209f38d9101550e59e3e4aa6ed02f4a4f1deea68a836711bf27cb751443

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/28/2024 1:43:59 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.3.15.7

File size:
1 MB (1,070,352 bytes)

Product version:
3.3.0

Copyright:
Program Web

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\installer_whatsapp_+_bluestacks_spanish.exe

Digital Signature
Signed by:
Source Beta (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 10:35:36 AM

Valid to:
7/7/2016 1:10:22 PM

Subject:
CN=Source Beta (Fried Cookie Ltd.), O=Source Beta (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121F87C06A1FA58E25ACBC0D796540139D0

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:GqVAEOKIpQv0Q8PbLlAPxg7UeNGbSfYzcHlgAjLFvwBZOhvcVyn:GqtOjQ81APxPe5fY0lgAvVwXO1Dn

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file installer_whatsapp_+_bluestacks_spanish.exe has been seen being distributed by the following 2 URLs.

http://www.stockconecptsoftware.com/c?x= JBFU98ligxqj9sd3B9c2k/SWD6Wg7VoYIIBdFk6gUI=&c=LUJ4Dtb8x7IRYof8LRvpgni hOFfDSLX1zDs7nv HSU/27tuBlzxvsNb6c8bNQL5y84hddEdgsQjUfWDIj5H/eTlakCGGCLcShdgqrc5dbrMsWYFOvx5wz7ZNEt3Yk6q&downloadAs=installer_whatsapp_ _bluestacks_Spanish.exe&fallback_url=http://xmlinstcp-fpm.portal-factory.com/cmd/error_ic.php?xrip=190.151.127.115&countrya2=CL&partner=DESCARGARES&origen=SEO&program=WhatsApp BlueStacks&3dparty_channel=DESCAR00Z88c2d9d067c0a408c59fdd965b757f9f&ou=http://whatsapp.descargar.es&du=http://download.descargar.es/.../down.php?country=CL&hostname=whatsapp.descargar.es&lang=es&langutf8=Spanish&logourl=-&logoex=-&ua=chrome&software=WhatsApp + BlueStacks&origen=0&key=27900&url_download=http://pf.vitplatform.com/crawled_soft/2/3/233327-677797-whatsapp-bluestacks.exe&ud=ax&partner_keyword=DESCARGARES&pmd5=&trckid=0&affid=0&k

http://www.funsafeshare.com/WVl6OTRQV1V6SlRKR01HTlZKVEpHZGxJNFFqQXpWV1YwTW5CRFEyeDBaMnRsTUdkNGVHeGtUbU5MVG1zbE1rSnhibUV5VG1jbE0wUW1ZejFWZDFSMGQweG1SMjFoYkVWUmQyRnplaVV5Um01bFN6ZGhiVFZwT1hORVZEZHVhbmR2Y21Kck0wOWFSMWRoZFRSTlMybHdPVkV4VmxodFFXUklTazFJTkUxdFMyTnJjRTVsWTJkWU5uQjFTa1kzVFd4T1NVVXpaWEF6YUVkNlpYVkNhSE51ZVU1VFMydzRSVFZSTUZCU2JFTk9RbTlVY0cweVJqUmFhazFFZFVRM0ptUnZkMjVzYjJGa1FYTTlhVzV6ZEdGc2JHVnlYM2RvWVhSellYQndYeVV5UWw5aWJIVmxjM1JoWTJ0elgxTndZVzVwYzJndVpYaGxKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5CSlRKR0pUSkdlRzFzYVc1emRHTndMV1p3YlM1d2IzSjBZV3d0Wm1GamRHOXllUzVqYjIwbE1rWmpiV1FsTWtabGNuSnZjbDlwWXk1d2FIQWxNMFo0Y21sd0pUTkVNVGt3TGpVdU5EZ3VNaklsTWpaamIzVnVkSEo1WVRJbE0wUkRUQ1V5Tm5CaGNuUnVaWElsTTBSRVJWTkRRVkpIUVZKRlV5VXlObTl5YVdkbGJpVXpSRk5GVHlVeU5uQnliMmR5WVcwbE0wUlhhR0YwYzBGd2NDVXlOVEl3SlRJMU1rSWxNalV5TUVKc2RXVlRkR0ZqYTNNbE1qWXpaSEJoY25SNVgyTm9ZVzV1Wld3bE0wUkVSVk5EUVZJd01GbzRPR015WkRsa01EWTNZekJoTkRBNFl6VTVabVJrT1RZMVlqYzFOMlk1WmlVeU5tOTFKVE5FYUhSMGNDVXlOVE5CSlRJMU1rWWxNalV5Um5kb1lYUnpZWEJ3

Remove installer_whatsapp_+_bluestacks_spanish.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.