» jpeg-to-pdf-22953-dp.exe
Overview
Analysis
File Details
Downloads (10)

jpeg-to-pdf-22953-dp.exe

Hof

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application jpeg-to-pdf-22953-dp.exe, “Hof Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.

File name:

Publisher:

Mode Beta (Fried Cookie Ltd) (signed and verified)

Product:

Hof

Description:

Hof Setup

MD5:

abdcd59d67ebae5b28912b50f7e19147

SHA-1:

46e2ac33e9660a29b8418dc29a2aa661822287f6

SHA-256:

1f399be21f59ff5a06de1227d861d0a9cadadb911c6da0248b28a0db3458c0ba

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

11/2/2024 12:33:09 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.FC.Installer (M)

16.6.20.18

File size:

965.6 KB (988,752 bytes)

Product version:

2.7

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\downloads\jpeg-to-pdf-22953-dp.exe

Digital Signature

Signed by:

Mode Beta (Fried Cookie Ltd)

Authority:

GlobalSign nv-sa

Valid from:

12/16/2015 2:37:06 PM

Valid to:

7/7/2016 6:06:18 PM

Subject:

CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:mJi+t786bZa4IfLxWBrPIaPoOghcuplRS:moM786boTqrHoj2urRS

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file jpeg-to-pdf-22953-dp.exe has been seen being distributed by the following 10 URLs.

http://www.cycleapplicationshosting.com/WVl6OTRQV3BMYW5SdlVqUnpXR3h3VmtKVE9WSjZNVVJOTWxOS05qUmxVblpJVTNvd05VeHFWV0paSlRKR1JubHhOQ1V6UkNaalBXMTBkV2szUm14Q2VWYzNSV3hEWkhWUFZuWlBaV3REZVZocWQyRkZWM05VVW5kclVEaEVWVTVNV1VoWU1XbE1URzRsTWtaSE0zcHRlRGRNVTBkdFltWklObEF3UzBSUFJTVXlRaVV5UW14eGFVUWxNa1pKY2pWM05uWlFiRzFoUnpsM2VEbENNVWh3WnpKV2JYTmFKVEpHUVRWRVZFTmFjVGxpUjJoTUpUSkNXazFIU3pCbk1FaHdOVTk2VFdSSVIzbHlNelZDTW5oMmNVcDVSalU0U1VSYVFTVXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWjNkM2N1WTI5dGNIVnNjMmwyWldOdlpHVXVZMjl0SlRKbWFXMWhaMlZ6SlRKbVNsQkZSM1J2VUVSR0xucHBjQ1prYjNkdWJHOWhaRUZ6UFVwUVJVY3RkRzh0VUVSR0xUSXlPVFV6TFdSd0xtVjRaUT09

http://www.dlsendcentral.com/WVl6OTRQVXRaVEV0V1ZHWkJkaVV5UmxNbE1rWkZhV1F6Y1hwU1FYRmhhRWgyY2s0MFZWQWxNa1pQZGpKUFdGWjZOMHBrYmtVbE0wUW1ZejExZGxSbFJGRTRRMnByYlhoUFlsVnZkRmdsTWtKRE9EZFBXWGsyT1ZGNlVUVmxPVXB2VEZZd2QzbFJhWEo0VEdGWVlYbGtNMmgyYkUwd2RFNTJaV2xoYjNKaWRHSlBjMHQ2UVdkcWNrdDRjVWxyYW5ZbE1rSlBSV3RYVVdRd2FuSmpjWE5RSlRKQ2RWTTBSbUo1WVdoWlp6Rk1jbHBQVldGTFpIUmFSeVV5UmxSMU4yUnhSMlZtTkVseWJrTTBaMWRKVm5SS2JXNWFUVXRaYlRoU2R5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWjNkM2N1WTI5dGNIVnNjMmwyWldOdlpHVXVZMjl0SlRKbWFXMWhaMlZ6SlRKbVNsQkZSM1J2VUVSR0xucHBjQ1prYjNkdWJHOWhaRUZ6UFVwUVJVY3RkRzh0VUVSR0xUSXlPVFV6TFdSd0xtVjRaUT09

http://www.dlsendcentral.com/WVl6OTRQV0ppUmxJMVVFVjFOMmRUU1RoaFZFdGxZVzlHY2xvMmVHRnBWVVJJTWtWUmNISkpKVEpDV1RCT1FVSk1heVV6UkNaalBWcHJRVWx3VURsUk9Xc3pXV1l6ZEdOVk1tVmFOV1Z1WTBGSlFsbDZaMHRzY1dsaU5XRklTV3RJTWsxWVVFTXlZbFo1UzFGSldFWndja2RFVW05VU1rNTRaVVFsTWtKQ1dUaFVSM0F4YWtSa01uTXpTVGgzVGt0MmFFbE1WSGxqUm01TlpYYzVOVnBhYlVOM1JXY3dhRmRLYm1sRlpGQTNKVEpDYUhGRGRscDBVMDVXU0VaS1UzZGxXRkkxVkRnMmNrZ2xNa1l3U0dkMk9IVmlaeVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVozZDNjdVkyOXRjSFZzYzJsMlpXTnZaR1V1WTI5dEpUSm1hVzFoWjJWekpUSm1TbEJGUjNSdlVFUkdMbnBwY0Naa2IzZHViRzloWkVGelBVcFFSVWN0ZEc4dFVFUkdMVEl5T1RVekxXUndMbVY0WlE9PQ==

http://www.vaultschuckleapplication.com/WVl6OTRQWEZzWjFsbGVVOWlZbEpMWkZoNlVUbERSVlZLWmxBeE9UZERTMWx5T0dsM01VaEVWMjlHU25oVWJ6QWxNMFFtWXoxb1puUnllRGxuZDNweWJFaFZTMjFXTTFKdGNtWjNSMjE0UjA4M2RXZFRRMHd6T0dsRU5FcHdNa0pCYzNCSGJYYzRaakJNTlhwV1VqQnhUR1Z1YzA1MmJVNVhiV2RPUWsxcEpUSkNlVmhvTVU5c2RrNDJUamRWYzNOeGQycENaREpaTmpZd05XTlNXbHBTVjNJMVlXeE1ibGN5ZWpGdE5tZHRZU1V5UW1OamNqQlJlRTlaZG1OMk1EbE1ORmxuVkVsRWFqSkZVVzFPYkNVeVFsRWxNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5oSlRKbUpUSm1kM2QzTG1OdmJYQjFiSE5wZG1WamIyUmxMbU52YlNVeVptbHRZV2RsY3lVeVprcFFSVWQwYjFCRVJpNTZhWEFtWkc5M2JteHZZV1JCY3oxS1VFVkhMWFJ2TFZCRVJpMHlNamsxTXkxa2NDNWxlR1U9

http://www.currentdlhosting.com/WVl6OTRQV1oxV1VkcE56WjJkbUpQVmpoV2FEZFdZVEo1YTIxVWRrUkJlRzlaUjNJNFVYWk9KVEpDUWxBM1FsRk9TU1V6UkNaalBXMXJXVmxtZHpGNlJWb3lOVFkxYVNVeVFteE5ZM2RhZVZaQ0pUSkdaMDUzWkRBM1RIQk1UM2t6UVd4RWFESklTa3N3YVNVeVFrUk5SREo2TjBWUk1qaFpNMjVOY1dkWFJXNXZlRGx3WWxCd1QyZEliVlV6VFdsUlNIb3dhbmhpVEdKS00zcFVlV2cyTURkTWVXaFlUalZyWkRWTmRtUmtVMHRPTlZKcFUySm1kVFF5ZW1aeFZtTnpORFY2Wm1obldVZHVjalFsTWtaYWMzWlFSbmgzSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm5kM2R5NWpiMjF3ZFd4emFYWmxZMjlrWlM1amIyMGxNbVpwYldGblpYTWxNbVpLVUVWSGRHOVFSRVl1ZW1sd0ptUnZkMjVzYjJGa1FYTTlTbEJGUnkxMGJ5MVFSRVl0TWpJNU5UTXRaSEF1WlhobA==

http://www.dlsendcentral.com/WVl6OTRQV05HWVV3eE56SXdWR1pFTXpnNFpIVkdZMFpDSlRKR056UTFXbmxCTUVscFRVaEdRWGxNYldKa2VFOUZkeVV6UkNaalBWWlZSMkZDWm1WVWFraDFSMlZuUW05UlptRk1lVWx1TVZKMmVETm5NbFU0YTFoSFdEYzBZWGNsTWtaSU9WcFhPWEpPZERsU1VsbEJZbEJWVkV4dVkwSkRiSE5vVmpKUk4wZFdjRGRJUTAxUlpsbHVRbEJsVVhKYWFURk5lRWgzZUdGcVYzbEpaRkI1ZVhsNllrVlFWa3ByUVRjMWMwOXdibkp5TlRsblIwdHhlbWRMUkV4aFVVTTRNV1l5TWxwVFRtd2xNa0kzWkZGc2RFRWxNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5oSlRKbUpUSm1kM2QzTG1OdmJYQjFiSE5wZG1WamIyUmxMbU52YlNVeVptbHRZV2RsY3lVeVprcFFSVWQwYjFCRVJpNTZhWEFtWkc5M2JteHZZV1JCY3oxS1VFVkhMWFJ2TFZCRVJpMHlNamsxTXkxa2NDNWxlR1U9

http://www.currentdlhosting.com/WVl6OTRQU1V5UWtkV2IzWm9SMnRWWldaS2NXNDBja2RSTjJNNGFGaDJhbXA1SlRKR2IwMUdOMHBaWlVONlVFeHVPWEpCSlRORUptTTlPSGRZVDFoMmVtZHZSRk5RVW5GNlVteHhibGx4Y1ZoalZrcERlR0pUVjNab2J6YzRKVEpDYmt0YWQwbE5jbGhIUkdWb1dXc3hXRTl2TW05dVduVjNKVEpDWjJrNWMzVmhRbkJQT0VKclFXTlhVMGszYjNNeVRGWmxkVXhMYTFsT2REZFpaRUY2VjFkRlNtVkpOMlZ0TVZKeGVuQjZXRnBEVGxsaU1HbGFaRGRqTlRaaVIwcHBWSFZsY0U5MWN6YzJkbWhEYjFNMVUwa3hRU1V6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVozZDNjdVkyOXRjSFZzYzJsMlpXTnZaR1V1WTI5dEpUSm1hVzFoWjJWekpUSm1TbEJGUjNSdlVFUkdMbnBwY0Naa2IzZHViRzloWkVGelBVcFFSVWN0ZEc4dFVFUkdMVEl5T1RVekxXUndMbVY0WlE9PQ==

http://www.signbodycycle.com/WVl6OTRQV3h2V1dwNk1IWlVOVGsxU0ZNMmVYaEVhRkp5UlZKb2FqTjNaR3gyWkhoMFdVWlFSV054U201bVNITWxNMFFtWXoxbmNVZG5SVEoxT1dWUU5VTXpkblkwU1hRbE1rSllXbWxqWTBFeGVXcFFaemhSYzNsNlNGZHRlRGQ0VVhkVVNrcHhSMXBFSlRKR0pUSkNZM0l6V0dkcmRHTXpkMDVaWkdSeFkzTm9PVE42UWtGU1dFY3lZWFpNUTJOc2RXcGhXVlp2V1VkMFVGbDFVRkU1TjBGNFMyRkljbVJXVEdsMlZXOUhaMlp3UlhGNFJrZDBZelZwUjNZelJEUTFjVlE1WVhoTlZXWnVXSEJ6UVhKRE1VRWxNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5oSlRKbUpUSm1kM2QzTG1OdmJYQjFiSE5wZG1WamIyUmxMbU52YlNVeVptbHRZV2RsY3lVeVprcFFSVWQwYjFCRVJpNTZhWEFtWkc5M2JteHZZV1JCY3oxS1VFVkhMWFJ2TFZCRVJpMHlNamsxTXkxa2NDNWxlR1U9

http://www.dlsendcentral.com/WVl6OTRQV0l3TVhwNE0zRnNla2wxZGpreGFYSlROaVV5UWpSRGEzWkhVbnBEZUVWamNXNVhOMUZVVEhkcWVuWmpheVV6UkNaalBVSnlWWEZvWlRWRE1XZFpXVUpvV1VWUVdraHlaazR4UTJGSldWZzNKVEpDYWt0dVlXbzFlRlJ1ZFRSclNrRjFjRkpuV21oUWNYUTVaM3B6YkZONlFXbGtKVEpHT1VVeGRsY3dlbVkzVFZGTldYRnhhbTQzWTJodVUweExNMDE2TVVWaGNXSnNNMDF1VmxaUGJXdHpZV2xVVTBKa1VFeFdZWFZXVUZoemJHRnlPRUZ2Y1haRGJEZHVNMmg1ZG5CQ1JEZHNTbk5SYkZSdlEwRWxNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5oSlRKbUpUSm1kM2QzTG1OdmJYQjFiSE5wZG1WamIyUmxMbU52YlNVeVptbHRZV2RsY3lVeVprcFFSVWQwYjFCRVJpNTZhWEFtWkc5M2JteHZZV1JCY3oxS1VFVkhMWFJ2TFZCRVJpMHlNamsxTXkxa2NDNWxlR1U9

http://www.vaultschuckleapplication.com/WVl6OTRQVGx5TVZaVGFGbEZabkJEYVRGdE5FTkRTbXRGYjNaRGRqbG1lWGRKWWtwUFVWRnJkblY0TldsaVYxRWxNMFFtWXoxR2IwdDRaV3hrVm1OQmVFbEdhRzl3VVRZbE1rSkliRk4xUjJ4R1NFcDZUVmhuWVdSTVRFSm9iMmMyV0dsTlZGZGtOMms1Y2tKYU1uWkpjWE15VG14S2NGVmFOMHBIYVdGNlNVOVdZMHB4U0dRbE1rSlJkMHRWVlhaSGNXUjNOVWRVZVZnd2JYVTNZekp2VkdkWmVWQkdRazlFUkRkRFFrY3pSVVlsTWtKc2JYcEJiMlpoWjI1ek9EWnZURWQyV0hoMFZrRnpTbXRUYjAwbE1rWnpaeVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVozZDNjdVkyOXRjSFZzYzJsMlpXTnZaR1V1WTI5dEpUSm1hVzFoWjJWekpUSm1TbEJGUjNSdlVFUkdMbnBwY0Naa2IzZHViRzloWkVGelBVcFFSVWN0ZEc4dFVFUkdMVEl5T1RVekxXUndMbVY0WlE9PQ==

Remove jpeg-to-pdf-22953-dp.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.