home

octodad-dadliest-catch-full-version.exe

Cagolig

Destiny Dream S.A.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application octodad-dadliest-catch-full-version.exe, “Cagolig Setup ” by Destiny Dream S.A has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from www.repositoryshareflash.com and multiple other hosts.
Publisher:
Huful   (signed by Destiny Dream S.A.)

Product:
Cagolig

Description:
Cagolig Setup

Version:
3.6.3.0

MD5:
b15b043607bdd5ca01941a7a45c30e97

SHA-1:
be4cb894621c3cb95bc8904fe1dbf6636ac4205d

SHA-256:
5354f528e83001e9be36a306617cf759eefea90e366948bcad01fdcc307a4ac7

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
12/26/2024 11:13:56 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.DestinyD.Installer (M)
16.4.21.10

File size:
989.7 KB (1,013,448 bytes)

Product version:
2.0

Copyright:
program

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\octodad-dadliest-catch-full-version.exe

Digital Signature
Signed by:
Destiny Dream S.A.

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 7:55:11 AM

Valid to:
10/2/2016 9:36:18 AM

Subject:
CN=Destiny Dream S.A., O=Destiny Dream S.A., L=Clarens, S=Vaud, C=CH

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11217A75EB912AE2167326222C18D9E2357F

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:uo9v/Sb8ISdMPNf/kLkfz8HF2+7jDBVCyP39KvlDVJx:u6SkaPNXkQfziF2sjL8l/x

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9262

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file octodad-dadliest-catch-full-version.exe has been seen being distributed by the following 9 URLs.

http://www.repositoryshareflash.com/WVl6OTRQWEE0Ym01UWRrdG1PV2x4VlRBd1IwTjBibWwyV0RaaWFIQkNSbGxrYVZoNlFXbFpSVXRJVkZWdVFtOGxNMFFtWXowMFR6RlFkMjVKVUVSMGNIaDBTRUpFV21oSVlrZElUMmNsTWtaMWJFTkhKVEpHVUNVeVFsaDVVa2g2U21sVFJUQlVURWRNTmtGdlZreE1TRkpYV1ZneVJWQmxNRXgzVlZCdldVMTFWMkZ3VFd0SlFtaHhVbkJTU1VGdVlXRnJXbGRoU1dSNWFtOUlOamg1UmpCeGJHZG9WRWt4YzFCWGFGa2xNa1l6VHpFNU1HOXRjRzU2VEVGNGIxaGtkbmg0Vkd4ak1VNHdhVXBRSlRKQ2QxcERWalZSSlRORUpUTkVKbVU5TUNaa2IzZHViRzloWkVGelBXOWpkRzlrWVdRdFpHRmtiR2xsYzNRdFkyRjBZMmd0Wm5Wc2JDMTJaWEp6YVc5dUxtVjRaU1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6UVNVeVJpVXlSbk4wYjNKbExuTjBaV0Z0Y0c5M1pYSmxaQzVqYjIwbE1rWmhjSEFsTWtZeU1qUTBPREE9

http://www.presentupdateguard.com/c?x=hhgUF9PNFjryq56JaWbeviOVZPjbs98lri tQov2kg0=&c=MnpTvXUUKfO8rRy5 DpiMuq6IBofKFVOCiveZjKqgQOy/OGWR9hv5EfaTZcGKbTOK6M4a2WYUpt3KuZ1dwGJtMsgCKb djI9rakAeaETCvEN/vVvTjOP6XgKwI86H21cFWBv2v9DhOv1Bmh4SlvHgk d6yADCZ/Y91 ATga8OOE=&e=0&downloadAs=octodad-dadliest-catch-full-version.exe&fallback_url=http://store.steampowered.com/.../224480

http://www.contentsoftwarepackage.com/c?x=OzdvzPptswnIDrmJOP1rQu8NJYaXz/7 iyqSjWbTThY=&c=9yrAAQcmwo7YLvvvG1F/F53O7B88hztRN4qRixhKlEnBXrwIb7/1UU 0V 6kPoC7Jtt8kG5NEQ2Q/Yhpf211fDoQ4F8KXkq3tJ/Rc/J3YJCw2b5WXMDjFjgjOn1f1ZTMV3D76df9EVZjx/h84VScbyWYq4kmD80o SnsD6J0YCQ=&e=0&downloadAs=octodad-dadliest-catch-full-version.exe&fallback_url=http://store.steampowered.com/.../224480

http://www.sharecapitalbulk.com/c?x=dRVZiWW25R6pCdn6wrJLhuCPe98KtOrzmPS Af9Qytk=&c=UU2hHAJsEbB1tYF0fCTY2PjZLLYNwuPaT0I5vmk99ZskTfEQd29Du1ty2Wk15sZ819vciPfCGaLJdida84thil9oUE4Nl25iZH9PQWSWfgNa4WUPltM96QWwcYMaCE21mkA4V78RtmpvPFlwkHVXB4DZQOkkzq9Q2VlVKXsDsgk=&e=0&downloadAs=octodad-dadliest-catch-full-version.exe&fallback_url=http://store.steampowered.com/.../224480

http://www.bundlesbinariesnew.com/c?x=4EM2ykfkYr1MssUbH9ZqnyZj074neDWb75VAi/d3/d8=&c=f142ZamQfvKo3LEU8ZCknRRyeS pHj8FQfnnWWbn sIHUHt6GEkN /ZXA6opPSRDAXMcpSleqO8p9yCbmky3P4QSxTq1Y6oO2WoPAb42ilKqMTRtUnE7GGaPYY36PQzvZe9KBSIjG kzARjB6853hAB6oBW5BZ03puBDRO5AyTw9m/SFX4XLeMDQEVvqcjoE&e=0&downloadAs=octodad-dadliest-catch-full-version.exe&fallback_url=http://store.steampowered.com/.../224480

http://www.sendcurrentfarm.com/c?x=V07p8Mz/aJ9eGWEP9y16PMtLRjP8T/XO/QK6lsLDkRc=&c=9AVcLJw1loKIOtZiPQhJ8O85zC57VPDPp/zw1RbzvsYwG2nIfKK5ID5yqUTYq8wcu/Fyn SIaG6I2p/hAAF7iKcPIXzxx0KjkxlFK1zZyI2d53oHT03CklDTbP4a6g2U Vgn2NPzB16y 0WTP4XZEbiunoykXQZUIwsm/Ze6Y c=&e=0&downloadAs=octodad-dadliest-catch-full-version.exe&fallback_url=http://store.steampowered.com/.../224480

http://www.todaytowerschuckle.com/c?x=t/VziZ04Y0vrqX6UzorvdySpgcioxSOAWl6a/SQnb6w=&c=SRKmTkAEmdyn3lgCJJIWaPH9bkm7/dogsBY3obmupf21BGGrwVIqg3F8mNvp1r5OcGlWgt5RsfYozhBwB9n2v9hNeWyRMfGkWwSRgGGtfaoscBeul/5rksBOpegzFdxkMKjUEEW0SXfZBedbX0ccrA==&e=0&downloadAs=octodad-dadliest-catch-full-version.exe&fallback_url=http://store.steampowered.com/.../224480

http://www.sendcurrentfarm.com/c?x=ZrqCNBUE84fdHujHOg1/GyS4EOJdPgDyaV Sd7hCg8M=&c=Y4C/w16rlWR4kgIQRrjA0lhK0A24fFq4F4hHGVgsA2q6doVWvS0VueNQf0b9JxvOAqBSE6yTr zGve Hi6iyQVeJpRTuhKuysPDT7Sz9sbn9mH3KHB/uBIg4Cs9hcJw6EMB2K7EIfMK5lcbBeFdeKw==&e=0&downloadAs=octodad-dadliest-catch-full-version.exe&fallback_url=http://store.steampowered.com/.../224480

http://www.bulkcyclecenter.com/c?x=Ic5yaaPo5Zy73D/yeJ4f2pqv2dz7UnzSS x4eo1FKyo=&c=CPhNwBTqcfg0boPdC0kI WDdd8r20BBSxufLW/2B S 4BIY6rqpNPla/r5mUWhZ/t2V2/FApwc8kfnYtqWCjZCP0FwSnMV37DgV3buH3LA3omEXB7N2pRqyLcKfgs16lcSRrb8Glw5FHNmVJ3GEpH1OCExjpZcSiof67aJCYSG4=&e=0&downloadAs=octodad-dadliest-catch-full-version.exe&fallback_url=http://store.steampowered.com/.../224480

Remove octodad-dadliest-catch-full-version.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.