home

libreoffice-21562-dp.exe

Bab

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application libreoffice-21562-dp.exe, “Bab Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Mode Beta (Fried Cookie Ltd)  (signed and verified)

Product:
Bab

Description:
Bab Setup

Version:
1.6.2.1

MD5:
29be241bf9c2ab000baf7332301ebe51

SHA-1:
524bbd690ab2f2607efb5512798e5808b9247fa0

SHA-256:
0b28bbe8955b52497b21584fb19e56ed7b38c987a801098fd94ce527407d6c93

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/15/2024 9:26:32 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.5.5.18

File size:
951.2 KB (974,072 bytes)

Product version:
1.5.2

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\libreoffice-21562-dp.exe

Digital Signature
Signed by:
Mode Beta (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 2:37:06 PM

Valid to:
7/7/2016 6:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:lvp7y5I5PpEla6JVWwIar2hfWz21GkqfQT7L7/bpoQOGZ/u:5x8culbVzIaKhc2gkqfQTz99Z/u

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file libreoffice-21562-dp.exe has been seen being distributed by the following 11 URLs.

http://www.nowapplicationsranch.com/WVl6OTRQVmxsSlRKR01tdEZhamtsTWtZbE1rSXhUbWhTWW5WRlJqQlBXWGxxZUVSQmVtaDFkbGRXUTJWUU5VSlhOVVExYlVrbE0wUW1ZejAyUzA1a1J6VjNha0ZTVG1WUGIyTTVaRVpxYVZkbVVqQlhObWhyVURJNFkwOU1RVzE0VlRWTGVtWkNTMmQzV2pCM1J6QkdKVEpHWlhSU1VqVm9UWFJ6T0ZkMlJsTnFKVEpDWm1Sd1pUSjNkblk0UzFwSFYwWnFNMlV4ZVVoSk4yUkVjSFpDVFdGdGMyZHBUakpIVUVaWE1tUmpTRzFxWTJaeldVNW9kRFJYZVhSeVdFVnZVelV5U0RWbFJEVk9WelJKTjFFMWFIQWxNa0poWTJjbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbVpuUndOUzVuZDJSbkxtUmxKVEptY0hWaUpUSm1kR1JtSlRKbWJHbGljbVZ2Wm1acFkyVWxNbVp6ZEdGaWJHVWxNbVkxTGpFdU1pVXlabmRwYmlVeVpuZzRObDgyTkNVeVpreHBZbkpsVDJabWFXTmxYelV1TVM0eVgxZHBibDk0TmpRdWJYTnBKbVJ2ZDI1c2IyRmtRWE05VEdsaWNtVlBabVpwWTJVdE1qRTFOakl0WkhBdVpYaGw=

http://www.sendtodaychuckle.com/WVl6OTRQVTFRWmsxQ1prNGxNa0lsTWtKUlMwVmFNRVpJUlVScFdIVktWVk5WTlRWNk9IbGpTR3RzVkNVeVFtZzBVMnhCVkRRbE0wUW1ZejA0VXpKaFVtZFNlbHBxY0dkWmR6bHJiVlZVY3pSWlZ6Z3lOSHB0Y1hsYVNucHBXV0ZxVTNkd1ozSlRZVlpEVVc0d1RHa2xNa0pyVmlVeVFuaFBNVEpyUTAxVFMxZ3hjV3hLUkROVU5qUmhaMU5aY1ZwdGMzTnpZek5hVWlVeVJrMDVNbHAxWldsTFpWcEtlRmRUVlhkNFdWbDFXazVzVW5oSlRDVXlSbTlZYVhWdFp6UkRNMXBuSlRKQ1kxSjZVMWh1YVdoSFprbzJkWEpYZDA4d2JUbEJKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabVowY0RVdVozZGtaeTVrWlNVeVpuQjFZaVV5Wm5Sa1ppVXlabXhwWW5KbGIyWm1hV05sSlRKbWMzUmhZbXhsSlRKbU5TNHhMaklsTW1aM2FXNGxNbVo0T0RaZk5qUWxNbVpNYVdKeVpVOW1abWxqWlY4MUxqRXVNbDlYYVc1ZmVEWTBMbTF6YVNaa2IzZHViRzloWkVGelBVeHBZbkpsVDJabWFXTmxMVEl4TlRZeUxXUndMbVY0WlE9PQ==

http://www.tourcontentdownloads.com/WVl6OTRQVVpIUXpoWmRVUnNTVUZKV2paeGRFZzNNSFpIVEhwVlIzazRjRU5aYm01S2JYQjVhRWR6V1dRNWJXOGxNMFFtWXoxdlYwZGtUVU4yU0dsUlZXOVVSbUZCVTNWNlkwWmpXVkJ4Tm5WQlJETlRKVEpDV0VoSlRIbE1XRzFHU3prMU1VWjNaV2d4ZG1SSGMyTnhTbXRUUkdSQlNHMXZVMDFWVTJGblpVeFJPV2MyZGxKTGFXZG9SSFZwTlZRNGNtSkhOblYzWm1wU09VRk9halpQSlRKQ2FFTkNTMFZGWmpOc1IydzVVa3R3UzNrMGNGUklObE42VUZwT2VuQmFVakUyY2taWVlYcEhjRXBZWVdGQkpUTkVKVE5FSm1VOU1DWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpZU1V5WmlVeVptWjBjRFV1WjNka1p5NWtaU1V5Wm5CMVlpVXlablJrWmlVeVpteHBZbkpsYjJabWFXTmxKVEptYzNSaFlteGxKVEptTlM0eExqSWxNbVozYVc0bE1tWjRPRFpmTmpRbE1tWk1hV0p5WlU5bVptbGpaVjgxTGpFdU1sOVhhVzVmZURZMExtMXphU1prYjNkdWJHOWhaRUZ6UFV4cFluSmxUMlptYVdObExUSXhOVFl5TFdSd0xtVjRaUT09

http://www.nowapplicationsranch.com/WVl6OTRQV3BxVDFoYVNVaFFVbUZUY0hCMWJUVkJkWE5ZTTFkUFVub3pUVUZrUVhaTWEzTjVPR0pZUjNGUFVITWxNMFFtWXoxd1JFTldabWxLUm5seUpUSkdlVU5zWlRSdlp6RTNjMWhrYlZST1prMTBjbkJ1Y1VkR2NsSkdUbmhoVFZrM1RVZHJTbGhJV0hsV1REWnRNRzQ0UlhKeE0wUlVXRmhYZWpKVFVrSTJNMGxSVFRVNVJUbEhVbGN4T0hZMWNVVkRlREpaTjFaVE9GWnpNR2RtY2pWR1l6YzRZMEVsTWtKc2NEUk1NM3AyZFV4UEpUSkNNblFsTWtZMVRUVnJiRVpVT0haVFpqRklUVVJsSlRKR1VtaE1TWEpSSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm1aMGNEVXVaM2RrWnk1a1pTVXlabkIxWWlVeVpuUmtaaVV5Wm14cFluSmxiMlptYVdObEpUSm1jM1JoWW14bEpUSm1OUzR4TGpJbE1tWjNhVzRsTW1aNE9EWmZOalFsTW1aTWFXSnlaVTltWm1salpWODFMakV1TWw5WGFXNWZlRFkwTG0xemFTWmtiM2R1Ykc5aFpFRnpQVXhwWW5KbFQyWm1hV05sTFRJeE5UWXlMV1J3TG1WNFpRPT0=

http://www.bundlebesthost.com/WVl6OTRQWE51VW5aa1NTVXlRbWwzYlNVeVFuRk9WVVZ5VUNVeVFtVmtiR3BWU1daTlpVeHBheVV5UWxOTmRYbFBkbUV4SlRKQ09VdG5KVE5FSm1NOU9YY2xNa0prWTBGcmF6WlNTWFZrTlhRbE1rWnlNM3BhWTFkTk0zaGlhalphVDJ4blpscEVOMG8zZUV4UVZVUnVRWGhrTWt3emJWTjFXak51ZW1SbVRrcEVWRGR1UnpRd2NIaHlTMVpYVVU5dlRVVXdRMmR2WTFONFozZE1WV3h0TldSWmFHNTJaM2ROTWpRMlJXZFBNV0ZCYjNJME5HZDJKVEpDTlhkQldtNUVNa0Z6WW1GdlZUWk9hVUptUm1wM01pVXlSbFI2VGpoSmFtNVJiMmNsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptWm5Sd05TNW5kMlJuTG1SbEpUSm1jSFZpSlRKbWRHUm1KVEptYkdsaWNtVnZabVpwWTJVbE1tWnpkR0ZpYkdVbE1tWTFMakV1TWlVeVpuZHBiaVV5Wm5nNE5sODJOQ1V5Wmt4cFluSmxUMlptYVdObFh6VXVNUzR5WDFkcGJsOTROalF1YlhOcEptUnZkMjVzYjJGa1FYTTlUR2xpY21WUFptWnBZMlV0TWpFMU5qSXRaSEF1WlhobA==

http://www.packagesoftwaretowers.com/WVl6OTRQV3hoTmt3MWJWYzVkMWxvUTJsU2IzZFZVbVF6T1hGeFZreDFiSEpxYkd0dWNEUkRNMjFZZEV4d1F6UWxNMFFtWXoxVkpUSkNjRFZIYVUxNU5YQk5NSEJMVHpGYVQyRjVlRzlpYkV4NVNpVXlSbVp3UVVSQ2VrWlNTREI0U2pNek0ydHZZelJaVGpJeVRWcDJiWFYxU0ZaRk1HczFTRmRHWkRKaWEwUTNkMGxuU21GblNETktZbkJNTnpCUmVFTnpKVEpDYUhaSWFYVjVRMU5oYm14cWFHMXFaak13ZGpOb05reFRlV1JZUTJWR2VFcDJTRTFGVldrelpVUTNXR2xGVmpsTmRGb2xNa1poTlhad2RuUjNkeVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVptZEhBMUxtZDNaR2N1WkdVbE1tWndkV0lsTW1aMFpHWWxNbVpzYVdKeVpXOW1abWxqWlNVeVpuTjBZV0pzWlNVeVpqVXVNUzR5SlRKbWQybHVKVEptZURnMlh6WTBKVEptVEdsaWNtVlBabVpwWTJWZk5TNHhMakpmVjJsdVgzZzJOQzV0YzJrbVpHOTNibXh2WVdSQmN6MU1hV0p5WlU5bVptbGpaUzB5TVRVMk1pMWtjQzVsZUdVPQ==

http://www.headheartvault.com/WVl6OTRQVEl4Ym5weVVGVjNNa0owYUdzMlZ6SldKVEpDYmlVeVFtSkZNRGRPUWpsWU4wSktZVzVVYmpOcVduY3phVmRySlRORUptTTlRMkY0UkVGemEyaHdaVlpwV1NVeVFsQWxNa1kzUzA5UldqTnVaMEkzT0hoM2JWQjNlVEZWTmpoTFZqQlZhM1pZSlRKR1luVmlSR1J4YTNCMVYyVnRiVTlXYkVwU1FXcEtkak5qV25BMmNYTm9TbU5qZVUxTmVFaHFWeVV5UWpZbE1rSldWMXB6VFVGWVVsazRWRXhxVG1wSWNsZHllalpFVERWUVoxcHVOa1Y1YW1sbU1ucHVXVFZKU0VGcVMweHNSMjF4WjJOclVIWXhjR05FV2tkQ1FTVXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWm1kSEExTG1kM1pHY3VaR1VsTW1ad2RXSWxNbVowWkdZbE1tWnNhV0p5Wlc5bVptbGpaU1V5Wm5OMFlXSnNaU1V5WmpVdU1TNHlKVEptZDJsdUpUSm1lRGcyWHpZMEpUSm1UR2xpY21WUFptWnBZMlZmTlM0eExqSmZWMmx1WDNnMk5DNXRjMmttWkc5M2JteHZZV1JCY3oxTWFXSnlaVTltWm1salpTMHlNVFUyTWkxa2NDNWxlR1U9

http://www.tourcontentdownloads.com/WVl6OTRQWFJDVEhsWE5GTk9TSEZXUld4eVNrUmpiU1V5UWpWMlJGWlpjR3R0Y0haU1IxWndNbUZSVHpaMFlqRnpZeVV6UkNaalBTVXlSa05TWmlVeVJsRmxVak5hT0d0MFdqVTRXbEJ6V0UxRVZuQTBaa1pRUjNSalNXSkxjMEphVlZnbE1rWXlhVUptU0ZReGFVUmxlbEZVUWs1Qk1GQnRSVTh3VEVOd1lWWndSVmd6ZWpGSmFFdExSRkZJYzJrMWMzSnlhVkpzVlROdlJrOVlTVU0yTVZoWGMxbGlOVGwyV1hCVlFtUWxNa0l4VERBbE1rWlVRM0ZKWlhCaGNHUlBSMHAyTmtocVIzcElKVEpDSlRKR1ZFZFFUSGRtT0dvbE1rWnBSMEVsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptWm5Sd05TNW5kMlJuTG1SbEpUSm1jSFZpSlRKbWRHUm1KVEptYkdsaWNtVnZabVpwWTJVbE1tWnpkR0ZpYkdVbE1tWTFMakV1TWlVeVpuZHBiaVV5Wm5nNE5sODJOQ1V5Wmt4cFluSmxUMlptYVdObFh6VXVNUzR5WDFkcGJsOTROalF1YlhOcEptUnZkMjVzYjJGa1FYTTlUR2xpY21WUFptWnBZMlV0TWpFMU5qSXRaSEF1WlhobA==

http://www.headheartvault.com/WVl6OTRQVmhJUlVOS1NqTXhKVEpDWTA5VU9UUXhkaVV5UW1vM1RFMTFaMUZWWkRBMFRGYzBNbmhxTlRVMGVVTkxVWEZCSlRORUptTTlla2R3T0VoUFJ6aHhVM015YjJsbVFsTmhVRXhtSlRKQ1kzTmxNMDlHWmlVeVFtUkxaVTFqYVU1TFFVbDJhR3RFTWpWUVNGaExOSE5DT1RBbE1rWjJiR3c0VkZVNE5sWTRVR013UTFwRWQzSktkVFI0WWpKUkpUSkdjME1sTWtaa1UwRmxNelJSWTFOSk0zTXpjU1V5UWxkUWVrMDRXbkJDT1hCa2NWbHZla3N5T0ZSVFZqZFlUU1V5UWtaRWVXZFFVbWR6ZW10bVdWaFVhWFZIZEdSRGJqSnpUa0VsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptWm5Sd05TNW5kMlJuTG1SbEpUSm1jSFZpSlRKbWRHUm1KVEptYkdsaWNtVnZabVpwWTJVbE1tWnpkR0ZpYkdVbE1tWTFMakV1TWlVeVpuZHBiaVV5Wm5nNE5sODJOQ1V5Wmt4cFluSmxUMlptYVdObFh6VXVNUzR5WDFkcGJsOTROalF1YlhOcEptUnZkMjVzYjJGa1FYTTlUR2xpY21WUFptWnBZMlV0TWpFMU5qSXRaSEF1WlhobA==

http://www.headheartvault.com/WVl6OTRQWGN6WldkcFptTmtXREJsUWtWR2QzbE5ObUYyYkRCR2MwcDRNMmhJVEVwdWFXNVVialptVVdRd2RuY2xNMFFtWXoxRFZURmtUSGhFZW5aVWJ5VXlRa3RKZHlVeVFtY2xNa1pZVjFkYU9XaE5hRXhrWWxaNWJFUkRaek5EY0ZSa2NHNVZNamQyTUZwT1kxRTBUbWc0ZFRNNWFHRkJkVzQyU1hsUVpIQnZjMjlxVGxOd2FGaGlaMnh1UVUxaVUyTktRVE5VUW1wRFNsRjViMkY2YUVvMVVYRnNNSGxKUTFNMk5rSlFZa2RGVkc4NVIxVnhkRk41YW5kbU5sUnlSR1ZDUzNKb0pUSkdTWEkxWmxnMFprcHlRU1V6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVptZEhBMUxtZDNaR2N1WkdVbE1tWndkV0lsTW1aMFpHWWxNbVpzYVdKeVpXOW1abWxqWlNVeVpuTjBZV0pzWlNVeVpqVXVNUzR5SlRKbWQybHVKVEptZURnMlh6WTBKVEptVEdsaWNtVlBabVpwWTJWZk5TNHhMakpmVjJsdVgzZzJOQzV0YzJrbVpHOTNibXh2WVdSQmN6MU1hV0p5WlU5bVptbGpaUzB5TVRVMk1pMWtjQzVsZUdVPQ==

http://www.tournowsend.com/WVl6OTRQWEIyWmxabGFuRmFXV3N5ZFZrM1VGSnpTalZUUmpsbmFGWlhUVWhYWmpoeGVUWlpNVlVsTWtKcmVucHJXU1V6UkNaalBTVXlRa2hGZFRaRGRHaFdkRVp0TUhwMk9VY3haMEYzUjAwNFpGZzVSWE41WlRVbE1rWk5hR0Y0YUc5RVlTVXlSbkJLT0ZKNWJrdFlNVTQyU0Vsa1F6TkphVWRHVkhNMGRIQlpNV3BvUjFJd04xUnlNWGRuT1ZSRGNFbExkMXBEWTNOdFZGbDFTRGRvUjBsVk9XaEdOazV2ZW0xbU55VXlRbmx4ZFZOU1pGUXpZVWR2SlRKR1YzTjNPVXczSlRKQ1QyOW1TREJKYUdSS1JqUnJhbmg2ZDAxNVp5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWm1kSEExTG1kM1pHY3VaR1VsTW1ad2RXSWxNbVowWkdZbE1tWnNhV0p5Wlc5bVptbGpaU1V5Wm5OMFlXSnNaU1V5WmpVdU1TNHlKVEptZDJsdUpUSm1lRGcyWHpZMEpUSm1UR2xpY21WUFptWnBZMlZmTlM0eExqSmZWMmx1WDNnMk5DNXRjMmttWkc5M2JteHZZV1JCY3oxTWFXSnlaVTltWm1salpTMHlNVFUyTWkxa2NDNWxlR1U9

Remove libreoffice-21562-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.