home

microsoft-powerpoint-2010.exe

Gulusul

SpeedyPrompt (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application microsoft-powerpoint-2010.exe, “Gulusul Setup ” by SpeedyPrompt (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
SpeedyPrompt (Fried Cookie Ltd)  (signed and verified)

Product:
Gulusul

Description:
Gulusul Setup

Version:
1.2.2.6

MD5:
cbc4e6903e31e7a278c4ca4ffe17bd27

SHA-1:
72af2cf436789393cc319512f059a495b79c7cf3

SHA-256:
cca00f385093f799c71692a7a8877706aa92d6439e01b0431bb251c37d04143b

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
1/1/2025 5:06:06 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.5.17.5

File size:
1002.1 KB (1,026,120 bytes)

Product version:
2.6.3

Copyright:
Lite Program

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\microsoft-powerpoint-2010.exe

Digital Signature
Signed by:
SpeedyPrompt (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 3:03:52 PM

Valid to:
5/20/2016 6:07:50 PM

Subject:
CN=SpeedyPrompt (Fried Cookie Ltd), O=SpeedyPrompt (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121D77437A5B286B055B435AA59CB4BA265

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:9QiZ4Cee716maCIJPMWb2L5z7NuvJKKJDQ76Yafb:99R6iIu2c5z7Nuv82DQ76Y6

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file microsoft-powerpoint-2010.exe has been seen being distributed by the following 12 URLs.

http://www.vaulthostinglaboratory.com/c?x=rH6FxSXmty O iA2r1wLbc ssCsGDeY6NP7iLK3VkUE=&c=d vBMFXbsMjxvjLOPd/eD60t 6NqTItFcJtZEGJaO2q1JEdIj7 Vsj6KwKN0QATDdf5GMZLNFmWHsO73o093EY6IMB oAFnoo0t36/F6Df5OthS5g6fhPMc6Pd90T8OX&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.currentsignbits.com/c?x=wxgi8TjPY0Uy/GOU9xsqmGtwIbfjy2xO2SVrG5jpgPw=&c=Lq0hCiOG/fxyJWrLSOA9HGD3G2lehBT4AslbAM35spdbmou01IFRc pfGUeUrSyV6b4hz3U8tutnFM0YgHW9CvWwEpvH6Nn 2TVOjTHbGMiPVkPX542MK590a94lmKvF&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=2MjCRFEtfERrr3j/WdkxPxYa//LEeJTyydpLQPTgr3I=&c=2SoRD//d/LJkl9gjBQ5otYLdTWzsxyLHaLTOFmGmi jtzLpGfjwu2Vsp8TWUe0A4 LoO3ukjUOE4XOTaHIZnV4vpoDKU55Fm 8038mkGSdW4XZnvtx5oKurxO2qKwE6X&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=D3zLIuC YrsND4qpzmzQkAgVPmk9xG8SLDkCuF1gEAw=&c=3qL2cnJhHnGG4sajyDAGJk1Yk2XInNMyPfNqUDfq2LfK4lbpPUuYPBI fsh9iN4AswBDvbvJYhmdWQ80nUl9LArb aX tLDdvqeKUxyhkqRDu91EOFiUfafleH3Vf19l&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=ac1Ltomr2KuttXPpv7SDaC 4G7cNJjUKNZk9LgxDuYk=&c=9X5k4kqCcqn98EHAkHbSYFTW36I 0v6yHigsIojpIJeBqQ9TJKZWC1gKPxRC/xyhhmV1LFHmIiVPIcDoIrCw3JMBjqKwsxBA88h45WcwMmiwIDhzh9wu5Aaz Ui/fBeb&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.appssoftwarerepository.com/c?x=H9DyR3z8hK4QdP2a8eght21gE/5l88zx9YADM zmSII=&c=wGtp1FG SrzL7nI2MuT2laYBXfkWdHeH2 YnJLBzYvuGAEAw8iDzsoWaIlTS6UWpfAHYbkcMbmk7SATCwJdM4cUq8/7QpYe5lodGyDoyLTM0HJXRKlnH6VHtjhCBdp2x&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.currentsignbits.com/c?x=kqvrNT MOQGmRhDwuhtvwncosNOLD DJQOFnY6dsZ1g=&c=sRa1yQ2/vcp6m0Xwl2P21TsXmEg0ZtDEyO0brLEq3KNyiUD7F4ep5dZj1iYGq5OzuAH2ft6EV7SJ6VEMS/55/i1G5 YgdJfkZwS6m3L22yh98agWpb5FQT1l9ixjVtog&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.appssoftwarerepository.com/c?x=bHVyVqVMQkLoj1N9mt05WU1EZw98I8qZjpFMWXGGeEg=&c=GoMuNIX7NfLvzQPnkkLT3MfPIKugA5Mu9iaVjfYstAp37SwBedNJwQ cU/NhjKLnzm8FJr5OU0Gw/ZnuROK3xMTD6vMwA6F4w8XF7yk0WsjE2lOVmc1jdGi0MPrKtUGv&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=lAu7ftGI9EqIxkbkrON1lPchXGEGgImQQdOHfCO8L9A=&c=FJTiTOj7OYyqKD3g8DuhBymkoQXjgW MfwaCtklA9mqQgjDo5P8HUTvlEPWE51KUYUd6yg6bMVIq23rAa6IWoyBFNijaCYv35SNVZ32x0gCVmgMAqsnnksQIXjvCTUaZ&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=rYdDcZa34T0HssKpu4fkcStzRecc1tMSl tI8b6ndGA=&c=k0ZgDGuoW KtOeNcgzBPvBGspd3VrN3qSrCw2dh6aaKlemeE5SgaQ6sv3qAo5hRNEkzuDQ1cG0Bqjbo8osxjl wPu0ocevw9GMbtuy7J0PPkq96TotnugzDp6yeGaHyq&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=XjH/uA8cs4vHBbnfp8on2S3bJ73H1DDwycT5pZuCjBY=&c=46F0P7tZOwCugwigYPRz i/Yn2rDQ Z 6KYxAG8wj/K672sx4KZo9OrIQNSO6PfXubjkHZ4e2lpUzlfPq6C96H5JvTVoI3T tkYorMl6yLfDvxxUlv85QWCcuzYOaQLe&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.currentsignbits.com/c?x=RGoEQDn5lUj8eAYeiZunNayM0nlsBQfLkxUlEck2YT4=&c=6GXwNVglJHKEP7IwSAmkOuegmIdb9O1eGa5tF/e8WgNl7lV4qck3guabZL0VVutih3gWwRQcQwwXLFTS684uaYc4vOL8oXjZDh5A21PY5wTtGorrjx7JVlWGl1mVbc4I&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

Remove microsoft-powerpoint-2010.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.