home

minecraft.exe

Internet Generic

Alpha Apps (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application minecraft.exe, “Internet Generic Setup ” by Alpha Apps (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. With this installer, users are expecting to download Minecraft but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Alpha Apps (Fried Cookie Ltd.)  (signed and verified)

Product:
Internet Generic

Description:
Internet Generic Setup

MD5:
199108a2ffdfe27e0539ae97ad066ee3

SHA-1:
6dd85931d324d14f76af37b241bfa8c92a8c7851

SHA-256:
2756ad044fab653292c6315541584f2fea4b4b5869edae73f63b9d305a2a9813

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/23/2024 4:36:03 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC (M)
16.8.5.17

File size:
788.8 KB (807,704 bytes)

Product version:
2.1

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\minecraft.exe

Digital Signature
Signed by:
Alpha Apps (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2014 10:17:05 AM

Valid to:
12/17/2015 10:17:05 AM

Subject:
CN=Alpha Apps (Fried Cookie Ltd.), O=Alpha Apps (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112116F755147494667BE08D39682946E152

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:cUoKx0WaF5w8IZSmprI+wvNg1ZtVDqhTDs54G2:c/nF5w8IfI+i+v+Twb2

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file minecraft.exe has been seen being distributed by the following URL.

http://cdn.captaindownloadfiles.com/?data=vAsmUO958ZBYUf1LctnTzzwvnc7mFklxqnv/kc3Djc8HOvaNyCDV11axWGaOgtqc9cSgRddEs42GRJIS6f3wpEQ MOUeBRmomH7svC6KjGox34Vl5Gw Ns9znWWaSyw//frncbbLZbTSLXr5veINE3IH DQFGmuU5DHodMnx9KUT 4JArNmoi9k ynWnG1s YVFFkK6I1Xfz7Ltbo oibwVhXtG4RrzdJqrzUQz/slFn47P8VvkfQEJp8gzdDZ53ZnkCyCPC9XLOyYb3Y9yScUInfGiSMKqFddkN5of1DE58iwX j fLdpusVXu9xZkLeRQP/VTJ1F3mfk38oTGa/s8vk6yToMT7lDhNSjBcAOSoL0qp9d04WuRUxOhIIA6E4LerW01QbUuL15ar9Gv6 1y17TZa4wDJK6C0whTKF9VeLtkP0TDf6GJHITkx3asUawa7x0Rku6CvBnxfusOrQ9iGLWg74V07VoxYI5kxMpdGO/oz27ONwD8XX5GyWXHHxfm95T4tNk0fHIKOzbXPgzQ3f ug5n 6ha4EvWEHzNSBNlZzU3625RQ062d8lKhM29nI6BwN1pSYhFnvzcQMdNzhjaSWhAUC7FGYoccMwmuqR47BfKAjKccfgGovzUraNLd/Dc7ypOW0 ClWv/kBIiUzIW9A9gFEdLipxAY1Q7okTrvJ0q9bI5RTjT7m rKRuebEBSvGnbXEy/oa5WUJK 6OZjlE0r8xZ4ixxiuAzZJok0gUzbnoXmFFwV7pKgkcbU6 iBSrrwRWka0/ZJzFiXEkvpyaUBPyNqlrPSL4brqWvwNe cjm/.../SHKFpKJj

Remove minecraft.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.