home

minecraft.exe

Internet Generic

Alpha Apps (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application minecraft.exe, “Internet Generic Setup ” by Alpha Apps (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The installer is marketed through download protals and search ads as Minecraft but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Alpha Apps (Fried Cookie Ltd.)  (signed and verified)

Product:
Internet Generic

Description:
Internet Generic Setup

MD5:
7c5bcd6160f1885f2015ca101bfa8458

SHA-1:
8cb22bb3976af7d6721cd9e60c3d86bc08cf4414

SHA-256:
2e777f0086c935bd392b6bd6c9bfd3c49737b40eb75aff23a7ae3222c45e2885

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/23/2024 5:13:17 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC (M)
16.8.7.7

File size:
788.8 KB (807,704 bytes)

Product version:
2.1

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\minecraft.exe

Digital Signature
Signed by:
Alpha Apps (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2014 6:17:05 AM

Valid to:
12/17/2015 6:17:05 AM

Subject:
CN=Alpha Apps (Fried Cookie Ltd.), O=Alpha Apps (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112116F755147494667BE08D39682946E152

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:8UoKx0WaF5w8IZSmprI+wvNg1ZtVDqhTDs54G2:8/nF5w8IfI+i+v+Twb2

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.8839

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file minecraft.exe has been seen being distributed by the following URL.

http://cdn.captaindownloadfiles.com/?data=GlqMSYU6oan6fdz7/G4jCrM65vEN70c3KdpIEeTi3A/8ta3g6jI8lDahSyiT0OKClHGE8awsH3JqdgfvVcUOolN XDEJKJuVHmfYTWXhcXu01QFbnEqZ4KsJBMu6npgMUXplLiXMDa3HC95WivfFmDM xzGgeyOxQLK0/l2k82rd6kf/Qx6D7VH53fMahO8EVwnHvd/U0KjbE7U6NLiruqL18fv26H5w XZVXIYoDlZutpDJxblPlXhaw6BKCYnTbtqsyjBSKBMZ8bVsLJ5Vzdjeg8KzZHlZPY51edG0tVDQNPOSGx7s9bvzfF8zvF3vMkZ9Mh014T5uaFRgwMBFV4SBoVHees83Iaj0qey4kOuCJscs0Ie3 eZVFowXNYwR3FKsIxdBnJVDqklKqj84oIldAJevJL630iqbYWXNTCVCcBqTEHi2/2Tjk4dhSA72po5PHs S50s5YwjquidK6/YcGhIa3c r8WzQkGZj1kGY Pmxsi cs0GQzcVc1FVeMP2OauiUtO8tu3zrjkFo1nnFc8x1Ycw/FhiEvOEeuLFaPEAr3EmtUKbUm2FoFprKbNIAb2bvp8GiHmojAtdS9y6HES oK4T4D8XLiTQIHNvr Wgz nOujUS1AdxXYcBOtoVAuJX1360dsrzUzGNRV 2sSdYU6vmbEBfN58T64L Y/Mr51Anp4yBRwv7fEHF5mcmOkMLvofcbgkgOn2HyOW/YvRwMrUEqDHgrNYgO OTXrz7WtHAf676EMFMPu71gUO EAb /yGfJwflmVZZmrcMoP7297cuFt1FbktaZPG4Nnyq024b1206ktPLPAlOZKJ/aAG8T7B8RYl7bOq4GZtRKfhSZKoJFjE/.../cbJYXGbQGxSkDke2xJVWGVuMg2XR3OLyqSMJ0hV446Vbd3Nsczw5fq63a14zmDrgfN57mqpH QLmMS1FAwcliV

Remove minecraft.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.