home

ipadian.exe

Tecimob

Platform Superb (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application ipadian.exe, “Tecimob Setup ” by Platform Superb (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Platform Superb (Fried Cookie Ltd.)  (signed and verified)

Product:
Tecimob

Description:
Tecimob Setup

Version:
5.5.1.6

MD5:
673bdd290295a00649f759a6ba8542e8

SHA-1:
d93cbad40aaeec6835b7fd9e23efeb47677b72c0

SHA-256:
1cf291ba1ea219d51343ae072aabe90334b202776144776f9530b76c0c1c5201

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/27/2024 5:47:37 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.6.22.18

File size:
938.2 KB (960,712 bytes)

Product version:
3.6

Copyright:
Program File

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Swedish (Sweden)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\ipadian.exe

Digital Signature
Signed by:
Platform Superb (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 6:58:38 AM

Valid to:
6/22/2016 10:58:37 AM

Subject:
CN=Platform Superb (Fried Cookie Ltd.), O=Platform Superb (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121836DFCF88AA55E4C6CD26641184F4759

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:30Ficg3shLTJhR6Xb11viubOIURUaVzf67ojf6N1QsFh5I/HeJEwMOrm6ls7ZapP:32iRshvIXh1K5hRX4H66LCHUBuIvFf

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file ipadian.exe has been seen being distributed by the following 6 URLs.

http://www.perkydownloadcentres.com/c?x=sJIGg4u8UO 2dIe65pkrOP4yTahw4YX7AqEYqiruYGk=&c=XvGTa6syQGYfI1paYpEBPrSd9EM0OxkbbbMzisN73jRIpGaNXtM 2q2Sf5mFgLO1am2ZZq12CQqzStK7UnpBBkM7tjirJ2CNeHYnEcaPMLG/XN69callBB5S8DwZKkG/&downloadAs=ipadian.exe&fallback_url=http://theaymane.weebly.com/uploads/5/9/6/6/.../ipadian9.exe

http://www.perkydownloadcentres.com/_d8ExM4EVsWNepmnhdOsdOBlYUWTUWWIv3aioK714 UO9Dcl0nlrsDB_baUMK7hTi2WpbvkFMRjnzfZa7fti2UEo7qvGHjcqOHpp4WLi4OkDIUJfRoJFlUZid7ogfpLmB21m4iXZohL4zbcUizI80_0p0ggpXQbxJs2cLnoEJlPr0gLDke4rqVAhHIADWj1bVOdnqi0JkecObBhFzX7XCJ_LEpHRzi6DBzzEHans9WyHy oT6y3oYVeIssyu92nczgOFpUYQLLbRqu iFfT8o9l XfW2MC8TDzw0pPnBSZq58aTm 6DWnwNL6 5OBWpIZ_lG66IFUzgn283VdANURhFCsIoORNHznVe51tqpKziGkWdKa68=-Gz8AAES3eX56hILfaTRIKAkKKtiAA5dCCIS3G8o2kDeep8P_9ARdoI7fhK6bhY2Vl5iqFOVY3sLTCA8=

http://www.perkydownloadcentres.com/c?x=4YuCZ0 E/9JlYnGGTBXVquVNrBEbaQwjmF7O3gO Ub8=&c=IFovLRbWge7QwXLPdHN4GbOazncSF9MOw2Ii0v10sjTTjHuQ0y5qPk4igIqSHZN6NnvseYDDrH0aCe5WJqo4603j/ejYcSTiNpboy4F5nRTBhut2cWGh2YRYgeyGiUAV&downloadAs=ipadian.exe&fallback_url=http://theaymane.weebly.com/uploads/5/9/6/6/.../ipadian9.exe

http://www.perkydownloadcentres.com/xFQPG4g fx1q _1wO29UXa1pwYi5mYyXkJEXBduHKLKlyn5nTrTj986WT_ekaEIihvFKjw5wooVQZntfIfahvv7bSdkwy7O 03vYVAS9otcNhz4H6zQwJdXDY5Fdn_kQjQDEoSzz5F8C24tAPt6m2v5PYUDAxHNEUK4olonSt45y9fT7EIx _C_lZACQci5 x_GlZeW6DmWg9 ae2_gJRvSxoJdNxXjKEXg33Fx503fB5oFIB0c1W8Mip9Zv9wChBYG1zsjEd4vGIYt6iaQLYqDXzKPeX1dskXz pxIPaslz6Y1vSc3_NsmhOamkgiHxeTbOwNvrlBafm3c 5vYmiqPGmJ067ggY8c37hu_YhlGWrE9wULw=-Gz8AAES3eX56hILfaTRIKAkKKtiAA5dCCIS3G8o2kDeep8P_9ARdoI7fhK6bhY2Vl5iqFOVY3sLTCA8=

http://www.perkydownloadcentres.com/c?x=X0fMWvkHTqkzZ0LIePxwSDRKn40XhiBSijhz7rK1q0w=&c=GdDfMHpTAFr90m5togNmNxDJ/fZGyS9Vb8WeoIoc6JfSrQYdxSBn9krN7g9w9rJSk4H9oJrjICzKFArdKSZdqgTUnTyOpJ9BYOg5SwuPC7UsJLR/sQpI5brdms6iy5qU&downloadAs=ipadian.exe&fallback_url=http://theaymane.weebly.com/uploads/5/9/6/6/.../ipadian9.exe

http://www.perkydownloadcentres.com/c?x=APKZ91xZQnbGyKo0L1PXZgNOxrqSEOyzTOr4sMEGhSo=&c=UJjG/J54hlpEF3IVTsgnxeQTwaF8wC5sMPKu2IlwaFtTztlGPXLJjtqusnzOX/fgCR/QbN3GgBwxl9qY97t6W2VCrvHfcdCBXtbXi rPBH9wua/dmHw8hPyaODfDP m7&downloadAs=ipadian.exe&fallback_url=http://theaymane.weebly.com/uploads/5/9/6/6/.../ipadian9.exe

Remove ipadian.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.