home

minecraft---pocket-edition-0.14.0.exe

Lomikela

Bibado Investments, S.L.

The application minecraft---pocket-edition-0.14.0.exe, “Lomikela Setup ” by Bibado Investments, S.L has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Bibado Downloader installer. The installer is marketed through download protals and search ads as Minecraft but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Gelodo   (signed by Bibado Investments, S.L.)

Product:
Lomikela

Description:
Lomikela Setup

MD5:
82dfcc49e42d6399faffb99e7147e6d5

SHA-1:
61f88696de4a79b9dd9d4fb808ccfcdbb70a84c6

SHA-256:
40d86df64c9446a69d4db2dc6a8f21daef30efea0e9f66b1b6140d466f6ac53c

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/23/2024 9:33:50 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Bibado.BibadoInvestments.Bundler (M)
16.2.21.20

File size:
1.1 MB (1,156,184 bytes)

Product version:
4.1

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Bibado Downloader (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\minecraft---pocket-edition-0.14.0.exe

Digital Signature
Signed by:
Bibado Investments, S.L.

Authority:
GlobalSign nv-sa

Valid from:
1/12/2016 9:57:03 PM

Valid to:
4/2/2017 5:32:01 PM

Subject:
CN="Bibado Investments, S.L.", O="Bibado Investments, S.L.", L=Alcorcon, C=ES

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121212301396FAE08B19C17F8D9578163C9

File PE Metadata
Compilation timestamp:
6/20/1992 6:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:lxmdsKWEqY0axg2TjCfH5orzzog3V3sltXyTBXWSwlvP:lwXUMZEozzog3V8nCdSv

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.8728

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file minecraft---pocket-edition-0.14.0.exe has been seen being distributed by the following 6 URLs.

http://www.conecptbodyuniverse.com/c?x=aX5vy7MZrufYlOoeaB0l1J3GkNCAy0wVZaIJCp5Kk8s=&c=EfrzTrdzJB4XlwPdXxhJTyWYyV8zZfnfGx1OHWSCWE5Fy8 JN6tGdY/cSUQNQjhZ/mqOUUZU9ISUbhi34wexy EiuxWdcx2sEJDrpnE x sL5z 7ztEiAYXawVe ZcYAMyGPpuAJkI51gxx80i0mIFR2/IbSR9uiB/oSfVVRR0uEfPjN5n1G/0RWi1CqUSH&downloadAs=minecraft---pocket-edition-0.14.0.exe&fallback_url=https://itunes.apple.com/.../id479516143

http://www.towersbulkmeta.com/c?x=dSCoVyCYkPkDTiNxUAsONcHBoi9kcx QyMSfL dgtFI=&c=OJhpJtEUUQjbb1S5ZZU9W2Bax1L7qZfHYuRvR99cvjg6vA/wj6EMaWEk5N1rCLsLbfCiNsH5s9e0fYXKIyry3AbT68ZBTj9cw0Wzh8cShhlGQujunqcNRe0mAn5oPv7/4reKuMU7Y61C1vofjXbwMdoVg7Goaq0NjX46bhr69Mg2A/NPzfG6Kz7 kfKYIrSX&downloadAs=minecraft---pocket-edition-0.14.0.exe&fallback_url=https://itunes.apple.com/.../id479516143

http://www.conecptbodyuniverse.com/c?x=RITHD9Ii/hMuoNrMtI0JtgVFkNq3qm4YRBi2U0IDNRY=&c=wykz/ghaYcQf7Z1Mjcnm6iRGgjvHb9NbmgrRxYu8iuNPizh70cm54c/nn 6P47 FGgyP1wOFH4aXj4/Ow6Wn8fDvBrWCyW/feSTzEg7QiIdBbWqm6650X1zj11X5isGqR5GQ0BbA4rZzGhAetivaeOsvKMuopt2hQSwe7Pejm NIIOsPRG3UMvVilMM9aLZz&downloadAs=minecraft---pocket-edition-0.14.0.exe&fallback_url=https://itunes.apple.com/.../id479516143

http://www.conecptbodyuniverse.com/c?x=vSpafzLB1lX3jNTXMj6hMTzZJg2FYFph0qHcU0sk12U=&c=7l3GhQVDFTIPiN7qsj0qk55OsbxjbHpgCeQB/V/Py3jAILWahVroI13EU2o9Xny2RiTPu0qQLiWRj9YQsMWn1IErtdWdgaO4a zT94OukVZxbSDYANA6g9xf2/pMaGbxbq de3eKSQeUcsukTDSd8dk6ZuayCkaMax3niiX2w B/X4UhpRNddIVm9WQf6Ztq&downloadAs=minecraft---pocket-edition-0.14.0.exe&fallback_url=https://itunes.apple.com/.../id479516143

http://www.conecptbodyuniverse.com/c?x=Um5ZrELnTnbKSr2Qqb xBWFKNO8vyhxEx7QzplfbPJw=&c=fc5MpqBJ0LfBqAyqb2HDsTSo81CdgNgYCFSyZFf4daoXyHuLFfdI8kjgWHv9selc0MZC6iB pRdq5imRq47rjXN PWW2 vfa4ZfnMBPApMOUilLXAVPf5wxlhkwc1NZaf18UOH6Ojg7JdMzHj6ERhzaO4CRt5jkFYSQEoQthQwcTh EzDLOsMPPNrIRmNCgA&downloadAs=minecraft---pocket-edition-0.14.0.exe&fallback_url=https://itunes.apple.com/.../id479516143

http://www.towersbulkmeta.com/c?x=FURbpSL7Gry6eDQ4iOrXE4WH vJMnbfzCR1r3/nC5s8=&c=AnIEzmLUVusD0lB 0IbjeZC0axiA54ZHxPQby8DTzeg3MNErpG6e fdz0wAKopDNPZWIaWgEwMvWr1at86dWR2RBOW5PQXofh6jFfNK4PTZb8SrTYo6aeHw8cDMKuP38y/BfZ Ag/atQe/chbfnCgJKYBwSVmljZOAtmAYBAyiLcOrLD2BmmGgA56S7LiR6w&downloadAs=minecraft---pocket-edition-0.14.0.exe&fallback_url=https://itunes.apple.com/.../id479516143

Remove minecraft---pocket-edition-0.14.0.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.