home

octodad setup.exe

Internet program

Agile Funnel (Alpha Criteria Ltd.)

The application octodad setup.exe, “Internet program Setup ” by Agile Funnel (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.centertowernow.com and multiple other hosts.
Publisher:
Web Program   (signed by Agile Funnel (Alpha Criteria Ltd.))

Product:
Internet program

Description:
Internet program Setup

Version:
4.3.5.8

MD5:
fff95813b3f288b33eab98de93ffe22b

SHA-1:
28278fe72a7708e42d806261fd92e5e17ff81287

SHA-256:
0ff3a5413854a4e92df5bcb73633a13b597e5146ea96d1c51c79e1cba805055f

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/6/2024 2:36:49 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
15.12.30.2

File size:
943.7 KB (966,376 bytes)

Product version:
5.7

Copyright:
Application Web installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\octodad setup.exe

Digital Signature
Signed by:
Agile Funnel (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 6:25:15 AM

Valid to:
9/2/2016 5:10:29 AM

Subject:
CN=Agile Funnel (Alpha Criteria Ltd.), O=Agile Funnel (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121703663FFB88F568A112BD801328BD38D

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:b5PtGKT3T947xcWA3V9qAS98gFN4fDjibF1vS:bdlTa9hAl9pSbF48

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9273

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file octodad setup.exe has been seen being distributed by the following 9 URLs.

http://www.centertowernow.com/c?x=LHEDISwEbg1S9cAMaNL0Wm3feIGsCbJFlpldceJFMas=&c=rYHpQ5lI9pJDf/wE1zdvYfJ5q1jkEHNzROPuQ3C9 4VLqDpJxJfXSqvhkNo31t/ONOBS2/dcE87C7KI0l5pH4J1t7oMFCzGBhIPK5QkrKn3tEYd0Min3zXfHS a3Mt KwVF44En/YqtyeiC/Y8Y4Ww==&downloadAs=Octodad Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=IFWZdhTW0XWs5hrYzKy7H7j7DUAaUOBCnRhDTC4F/Qg=&c=p7DmeiLiTUPuWgghJ2N/QLKPYki4atRu1 ZJojngPWoG7KjyIyVmL/ihGsr5sZA5KIPx9ej9w2 FzzWaevAxRRyRpooOIRicMbL/YuoOE9gnlOLd BJqbrfddNJjwPvfBgBS 8tcb2/hBY31KtU2xA==&downloadAs=Octodad Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.vaultsfilespackage.com/c?x=WCsIEy8KombRATmUPSAjojE56kSlGmvCGOuhgK2ELsk=&c=fsuYBB L6DJaUPaNqy7v6I/vVV6ctaufeXbIrLnb85L11ry2aKd tLmJhlhzadUrPnOT4WEw KFYb4EKEGhmlXECywjqnjIr6cGoKEowSRSksvevjxEJtO4xd2howkjzy5M4dl4QJ5LXiw7d/jJdgA==&downloadAs=Octodad Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.universecontentvault.com/c?x=7oToRHWMGCpJ2MJVfC0dYjYK34JjllTY5lQmICGXGX0=&c=76XPKPamnHNgjbCz0VN0Ct0XbwhG2HlhMC9mDxJ3ZR0z6JfVkPrFomZ7Z0FaMa1fbpsGA LUFpcVn00n2JRgARM3L1DJ7EgxPjkQYnxP4WOSqXwr5q2U4CPFUp4ssKrqv Mg5z Bn/AWQyhjnzxUiw==&downloadAs=Octodad Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.chuckledownloadstag.com/c?x=dzOeMcFRByLbPAbfjn4dJbCW1PRtZIrdMxoqhxmeeT0=&c=mKuaTCk20PMkvBDbJqUiaqTbNM /SxXkmLNddMeDDjrJk3nehdlocBiZnsRj1XUlJODrhqA0 tRuUgcmIQCS0WMrUEDS huBZxIao5v6mwC898TPOg6U3lRGlZ3fc8Lj BFXk3Y9XSHQfIVGmnWag==&downloadAs=Octodad Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=fmH1cGK/qUBRYt2sLfqT gO4M6ETyMAOzMplaXrYE6w=&c=H9fTZektNw/W6XvL9uwOElkqxzye/GzK8hILHknox/DRHSIK3lGXOXtgai8XAhJhksrsRwqxZY3hkRWA8uOXhvNa/PRVDtUBuIcgmRDC4oAB09BB3bcrErDs L5u1stulHwEE/rJAUNwK/7oBC32Iw==&downloadAs=Octodad Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=8VEJ1POVL9VKQynre9RlrkXZyPSbbqxXuwGk 2LRoRs=&c=xzBofx7DINSXHJ3ozicXGCefh4UaxwlciWozX8enl Fnx9Qi/5ueTGSteD3C1UjqphNYUVO4YACEeRrnAgLbrz LTX5ZeYX5PKspm4mmZBNPiFNwDA/QeKxA2O1dSuVvyBsjrXkEcL3epjU ZZUCDg==&downloadAs=Octodad Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.signssafebulk.com/c?x=/O5zS0Rn4/78WJws/8VUdIDf26yJjwhtz jW97sn0x8=&c=qusRdkzUmJp70YrWs6SBlzXbBqTD7LvLvOA4aYinBS EwgBNddgnORTfLRP5Z7ndv6dc/ oTbpQOAu1V7vqUxdyAlbxjIXGMmcPxFZXncdGtDacykAAnLdGnPIft8m41O2 Jns5K dxJfWqOELHBpw==&downloadAs=Octodad Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=r7HTEoZD5KemejJ3rhNt73phJn2K3MwzlJjNkOo3j1g=&c=mNIz/mIfhKlnqkA5PA5IWY7PhSWXL3iGXyZAf9UQZhcxzofsf5QLGfs0G0vBV eENBgzD7EZV3VmeoPOPeaGNyYdWlRSYG2UVwaP50c1A06ehzZiMZmHXlim4MBWdDxsIgaPDObpYD5ZJ2AA7nyMFw==&downloadAs=Octodad Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

Remove octodad setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.