» nokia-pc-suite-12931-dp.exe
Overview
Analysis
File Details
Downloads (11)

nokia-pc-suite-12931-dp.exe

Kisi

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application nokia-pc-suite-12931-dp.exe, “Kisi Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.

File name:

Publisher:

Sacip (signed by Mode Beta (Fried Cookie Ltd))

Product:

Kisi

Description:

Kisi Setup

Version:

3.2.2.4

MD5:

96d3a8c47d0406589ce16659450f1ef1

SHA-1:

546ef0f23f478ab2fab49fbbf7b46c3b4c72b094

SHA-256:

fc39a8d0deeffcc2c5682284aa83e9d28ed872bf33c8d41570954e6fe1025de6

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

12/26/2024 12:44:58 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.FC.Installer (M)

16.4.23.13

File size:

952.6 KB (975,504 bytes)

Product version:

4.4.2

File Lite

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\nokia-pc-suite-12931-dp.exe

Digital Signature

Signed by:

Mode Beta (Fried Cookie Ltd)

Authority:

GlobalSign nv-sa

Valid from:

12/16/2015 2:37:06 PM

Valid to:

7/7/2016 6:06:18 PM

Subject:

CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:PjJz9OiMv1hlYlmHZRY5L5H/9x7NJXH6:PlZMb/5RYRV9h36

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file nokia-pc-suite-12931-dp.exe has been seen being distributed by the following 11 URLs.

http://www.appsfunbyte.com/WVl6OTRQVWw1V0VGUk1ucExlamhYY0dOSGRsbHRWV0ZGVFhGa1pGZG1UVEJhWjJsTGNIcERORFpuVjFRM1Iwa2xNMFFtWXoxR2VUZDNTRFJKV0dWdldIWlFTaVV5UWlVeVFtVnhTbm81TkZGWFRqQjFRbUpLVVUxTU5TVXlRbFpxWjBGNFUwSlBVVWM1TWtkdFEyRlRaR3NsTWtaeU5VNDNaVGRLWkZkemRYbHJaM2cxSlRKQ1VHVnRiSGt4VTJjMlJEWmlaakJzVFZRM1N6YzRWMFUwWm1wUVdqZFRZbVozUlcxMVNFRnBiVGN4WWtOS01rdDBjMHhhYVZkaGVWRmFPQ1V5UW5ZemVXNDVVblJZTjBkcU1YcHBZMncwWTBFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbWJtUnpNUzV1YjJ0cFlTNWpiMjBsTW1abWFXeGxjeVV5Wm5OMWNIQnZjblFsTW1abmJHOWlZV3dsTW1ad2FHOXVaWE1sTW1aemIyWjBkMkZ5WlNVeVprNXZhMmxoWDFCRFgxTjFhWFJsWDBGTVRDNWxlR1VtWkc5M2JteHZZV1JCY3oxT2IydHBZUzFRUXkxVGRXbDBaUzB4TWprek1TMWtjQzVsZUdVPQ==

http://www.gifttownsign.com/WVl6OTRQVmcwZWpCVU4wSjFTbmRaVnpOWWNuTklkblEyUTNwWVRVcFBiRzk0T0UxUFEwWkZWVU5aU0hoeU5HTWxNMFFtWXowNU1WZFJUMk5YYmxWSVZXTnhjbWxhV2xkMVMwTnlVMUphSlRKR01qUTVkVzFQZVNVeVFteFBUV3RNYmpKcmNqWTVXakoxUTFKalNIRndSWFZIU0V0UVZGUkZUbEJVTjJwa2N6aHlVbGxWY0dKNFdFUTBhVUp5VGpkRGVXcGpVV2xwZVdZeFdsUlNRMWRZWkhKVGRtd3lkVlpZUmxwRk5HbExUMUJHT1NVeVFrRnljVXBHWkRNMFYyMUpkMFIyV2tGRlNtdGhRVEZIUjA5TGRVRWxNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5oSlRKbUpUSm1ibVJ6TVM1dWIydHBZUzVqYjIwbE1tWm1hV3hsY3lVeVpuTjFjSEJ2Y25RbE1tWm5iRzlpWVd3bE1tWndhRzl1WlhNbE1tWnpiMlowZDJGeVpTVXlaazV2YTJsaFgxQkRYMU4xYVhSbFgwRk1UQzVsZUdVbVpHOTNibXh2WVdSQmN6MU9iMnRwWVMxUVF5MVRkV2wwWlMweE1qa3pNUzFrY0M1bGVHVT0=

http://www.currenttoursclear.com/WVl6OTRQV2RUWVhWU1ZsSkJKVEpDU2taUWRqRm9VVGRZZG01MVVISmxjVUZwUzJGbFZWTTVWbmRqWlc1S2QzSTBkeVV6UkNaalBXSXhWV3hTZFVaWE5sQlplakUyVTBGV1ExcHNNMng0ZURKdmJVaFZSbXhMVVVWTE5YQmxSRXROWkV4T1JuUkhlRUpKTVhwUU9IQjBNalJOU21sdlMwSnpkMlJHVUdoelluUkZjM052UkVWcE5rTklXbXBhV0dscFVFcFVkM2hyTUhGdFNYUk9TU1V5UW1GWlZsa3hVQ1V5Um1OcFR5VXlSblpKVkdWTVRETkpVa2t5U0RWNVkxRnNZbmRNYUZwRFdEVkJVRnBPVVcwelUyZFhaeVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVp1WkhNeExtNXZhMmxoTG1OdmJTVXlabVpwYkdWekpUSm1jM1Z3Y0c5eWRDVXlabWRzYjJKaGJDVXlabkJvYjI1bGN5VXlabk52Wm5SM1lYSmxKVEptVG05cmFXRmZVRU5mVTNWcGRHVmZRVXhNTG1WNFpTWmtiM2R1Ykc5aFpFRnpQVTV2YTJsaExWQkRMVk4xYVhSbExURXlPVE14TFdSd0xtVjRaUT09

http://www.sharerepositoryhosting.com/c?x=iobA6x/YgobTL4u6j0mSiAfMRVx7Sb5A2ZY18U3U4pc=&c=pCCAnu/1wl3TUcTvi4jMwLU7a/3Wyn/GAIPIEWYZuVlEmDC3mq8lD5Apn/p1xNMadwVthXxeX0MV GolQxGtOLDYCGScpgCG4LIGP3qBk8F/oEQIB61Yj7AwJilo3i/LT0qYX/HX21j4fSktG6lj5YJVNm8XES2dMso z94Dqahh8XkqR77iIboSwvsKTS0&e=0&fallback_url=http://nds1.nokia.com/files/support/global/phones/.../Nokia_PC_Suite_ALL.exe&downloadAs=Nokia-PC-Suite-12931-dp.exe

http://www.gifttownsign.com/WVl6OTRQV3BEVkd0RGNqaFZaVmhCVTFOQlZIWm1lVEZVY200bE1rWTBVMmgzUkZRMllYTkxVbkpsZEd0cVEwYzVRU1V6UkNaalBYaElOVlZtVG5aTk1tRmtUWEF6VG1KUVl5VXlRaVV5UWtoTkpUSkNTV2h0VmxwS1RuazJOakJVUmpKeFFVbEJjR3BDU20xVFRUVlFVV1ZWY2tSVUpUSkNRM3BzUmpkWlVFaGtVMWRzTTJKSVNtVmpSVEZoT1hCcmFVeFJhMUJ4Y2xjd1oyMHdXWHBHVkVKTVUxYzJjR0ZUV1hOemVERXhiVzFEUWs1MVJrOUZlVmhTWW1JMVNHNXVKVEpHTVZwR04yRjBWRkJKV0RoVlEyNDNXV0V3UjFFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbWJtUnpNUzV1YjJ0cFlTNWpiMjBsTW1abWFXeGxjeVV5Wm5OMWNIQnZjblFsTW1abmJHOWlZV3dsTW1ad2FHOXVaWE1sTW1aemIyWjBkMkZ5WlNVeVprNXZhMmxoWDFCRFgxTjFhWFJsWDBGTVRDNWxlR1VtWkc5M2JteHZZV1JCY3oxT2IydHBZUzFRUXkxVGRXbDBaUzB4TWprek1TMWtjQzVsZUdVPQ==

http://www.laboratorysafehead.com/WVl6OTRQVTVhZG1ZbE1rWTNSbGhhUWs1RVJrczJWWEJPVGxwVVRqTm5RMWcyVFZWSFFrSTNkVmhHZURad04wRkJWU1V6UkNaalBVVlJPVWxXVDBKaGRqTnhUVVphWW5kbE5UVWxNa1pRTWs5V05sUTFPWGR1V1hjbE1rSkRaMmRCV0ZoUGJYcFdjRlZsT1ZFd2VVNVpRbUZ4UmlVeVFrdERiQ1V5UW1ZemJXSnFXbGxqSlRKQ1FsUnVRMU4xY1NVeVFpVXlRaVV5Um5odlVXNWFaWGxqTWxkdWFVSjJVVlJsYldWMGRVMDRRMU51Wm5kS2IxQkZUWFpEVGpkV1JFd3dXa0ZZV0hKbWMwdDZUMmh2TUdnemVWaGlWRk5hSlRKQ1UweGllWGRUWnlVelJDVXpSQ1psUFRBbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0yRWxNbVlsTW1adVpITXhMbTV2YTJsaExtTnZiU1V5Wm1acGJHVnpKVEptYzNWd2NHOXlkQ1V5Wm1kc2IySmhiQ1V5Wm5Cb2IyNWxjeVV5Wm5OdlpuUjNZWEpsSlRKbVRtOXJhV0ZmVUVOZlUzVnBkR1ZmUVV4TUxtVjRaU1prYjNkdWJHOWhaRUZ6UFU1dmEybGhMVkJETFZOMWFYUmxMVEV5T1RNeExXUndMbVY0WlE9PQ==

http://www.conceptsbodysafe.com/WVl6OTRQVmhqYzFsTWNVUnhhVFpLV0hsQ05HSnpjM2wzVFdJM1VYcFRPVGhsUWtOTVJWaG5OMUJEVVdVNFpYTWxNMFFtWXoxNVozVklUbXhPVlV4VldHeFhjblpGZEhRbE1rWlliVzg0UTJoTmRESlFWa0pVUldwalEwazNTMVpMWjJOMGJ6TkdWbTVGT1ZKb2RVbDZPVVJIYjNSVmFtMWhURmRHVVhKb1EwRWxNa0pXZHpOVFFXOTZjVk5NZVZaalVXbHBPRFl6YWtSb2FFZFVUMGhOVW1rMmJVOVdPRkl6VUZWelIxZGFkRXh1ZEdzM2NuZEVXWEF5VTBNNFFtRnBjMmxoTm5kUU5ISkRTVmRzTlV4UkpUTkVKVE5FSm1VOU1DWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpZU1V5WmlVeVptNWtjekV1Ym05cmFXRXVZMjl0SlRKbVptbHNaWE1sTW1aemRYQndiM0owSlRKbVoyeHZZbUZzSlRKbWNHaHZibVZ6SlRKbWMyOW1kSGRoY21VbE1tWk9iMnRwWVY5UVExOVRkV2wwWlY5QlRFd3VaWGhsSm1SdmQyNXNiMkZrUVhNOVRtOXJhV0V0VUVNdFUzVnBkR1V0TVRJNU16RXRaSEF1WlhobA==

http://www.appsfunbyte.com/c?x=noe3BWSWqcbgo6SIMPxyjZC2W/5WhnA8W4wJkwTazpo=&c=0P7d9o8v3ZdVdWMd7AJtovqKQLxA0Ll4/twARE4BNmHDIEaNY3NVx/ZfazYrGxqvaxQs FqbXgHih9H7KtUvOt4PGhmXSS Pl8LH5URuWNU2cZvDZJznJfIrevGvY dsGbdtsFWSvMLO4avo6QsHNl0I8JDd7udWmq3K8xolHgA=&e=0&fallback_url=http://nds1.nokia.com/files/support/global/phones/.../Nokia_PC_Suite_ALL.exe&downloadAs=Nokia-PC-Suite-12931-dp.exe

http://www.laboratorysafehead.com/WVl6OTRQVEpEZHpKMmIyUkNaemhWYW1oaFdGbHhiblp6YkRsamFrdEhXRWhKVFhkdFdqQlJhSEpTV0VsRFFtTWxNMFFtWXoxMmJFb3djM0paVFhJeFVTVXlSa05RTlhKbk5IQjNkVzE1ZVVNNGQyc3lhRFF3V1ZGelMyRjNOSGh3YjA5TlMwVjBSazk2YVVVNFdVbElkR1ZyY0hrbE1rSlJjV1F4YkRZelMwMVBlRlpuY1dwVVZIaHhhbVF5ZEdSUWEyczVaMGx0VlhGcFkwOU1abGhoYlU5R1dtRkhWbWxoUjFjbE1rSmtjM0F3V1ZFd1IycHdiSFY0UjFOR00xZDBZMWxuVmxkalRHUlpObmx4U2tkWVRFRWxNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5oSlRKbUpUSm1ibVJ6TVM1dWIydHBZUzVqYjIwbE1tWm1hV3hsY3lVeVpuTjFjSEJ2Y25RbE1tWm5iRzlpWVd3bE1tWndhRzl1WlhNbE1tWnpiMlowZDJGeVpTVXlaazV2YTJsaFgxQkRYMU4xYVhSbFgwRk1UQzVsZUdVbVpHOTNibXh2WVdSQmN6MU9iMnRwWVMxUVF5MVRkV2wwWlMweE1qa3pNUzFrY0M1bGVHVT0=

http://www.capitaltoursoftware.com/WVl6OTRQVVpyZEVKM05UUk5SRWxHVlVVeFVEbFROSEZVUVRGRVJEQXlTM1pUYTJsbGIwaDNkbTU1VDBobmFHTWxNMFFtWXoxcWFteFBKVEpHUm1sSVRDVXlRblpWWmpNeWJXcEhKVEpDSlRKQ0pUSkdaMmxpVGxaalpEbG5Va0lsTWtaMFFtZHdiR0ZSY1hkWmFqUjVjRlZDVXpWSU9YaHNXSFV6ZG5VM1ZGTklWaVV5UmtFeE1qSWxNa0paUkd4V2NHZFdNbXhzSlRKQ1VtODFSVlJJV0VnelZXWmFaa2h3YzFnMVNGUnRWU1V5UmxCaE55VXlRbVp0UVZOblJIa3dTMmQySlRKR0pUSkNObkpQU1ZsVlREQXhNRWMzVkZCUFFuTlNSa0ZzZFRKSFpGZG9aeVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVp1WkhNeExtNXZhMmxoTG1OdmJTVXlabVpwYkdWekpUSm1jM1Z3Y0c5eWRDVXlabWRzYjJKaGJDVXlabkJvYjI1bGN5VXlabk52Wm5SM1lYSmxKVEptVG05cmFXRmZVRU5mVTNWcGRHVmZRVXhNTG1WNFpTWmtiM2R1Ykc5aFpFRnpQVTV2YTJsaExWQkRMVk4xYVhSbExURXlPVE14TFdSd0xtVjRaUT09

http://www.farmtowntowers.com/c?x=RmxQIUYKe5UxPKO7o7SlgyzTvyVrduedXHk1jIeffkg=&c=TQTnrB7yltuiPY0W iIBu5ipkx4g1O8sNs3JFapcfOhk479EZZBGueXJLeb72/02K9L3zeh8osWXPNiKUDf3fIgrzzK2dzaftpIx2XSZudLX7fYFSWe9GhnPjHzAOh645w97Pmml6 pMvgQYOQJY4qoIGHz0GOkTHr8xVoLY8NXrd8kumBk5sjXpP h2IDXb&e=0&fallback_url=http://nds1.nokia.com/files/support/global/phones/.../Nokia_PC_Suite_ALL.exe&downloadAs=Nokia-PC-Suite-12931-dp.exe

Remove nokia-pc-suite-12931-dp.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.