odkurzacz-12322-dp.exe

Hof

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application odkurzacz-12322-dp.exe, “Hof Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Mode Beta (Fried Cookie Ltd)  (signed and verified)

Product:
Hof

Description:
Hof Setup

MD5:
8fdd776aa991dfe360e162ab9a26e424

SHA-1:
13042c91e8a1764ebdafdf0bdb562aa440fcf9e4

SHA-256:
3e788e340ef74b90337aee579e86108cbcc890197c0608ed5f7a7830cda35890

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/26/2024 5:07:46 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.6.20.7

File size:
965.6 KB (988,752 bytes)

Product version:
2.7

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\odkurzacz-12322-dp.exe

Digital Signature
Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 2:37:06 PM

Valid to:
7/7/2016 6:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:0Ji+t786bZa4IfLxWBrPIaPoOghcuplRS:0oM786boTqrHoj2urRS

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file odkurzacz-12322-dp.exe has been seen being distributed by the following 19 URLs.

http://www.cycleapplicationshosting.com/WVl6OTRQVnBUU1RRM2RrNDJka0k1UXpocWNXOUtRa0p5TkVrMk5VdDJlbFZTTmxoMlZqTkROM0ZwYm5wM1RYTWxNMFFtWXoxb1NUbFNUV0pFTUVGM1lUVkRRVEpJTjFoT1RIbGpTa0ZPYW5CYVNUSjBkVmtsTWtaQllXOVdOVzVSYVhSUFZVWnhURlVsTWtZMlJURnpRMk5oVVd0R1JWRmtVVGQ2VnpOclZsaEJWR3BpTTNvbE1rSkRSbHBPYjJvMU5WZ2xNa1k0Ym05aFlUZDVOV3QwY1d4WVJHZDNZelYzWVVzbE1rSXpOWEUxVFhoWlZ6VWxNa0l6Wkcwd2NsSlRjWE56ZW5GdlZEZHBWRU5tT1VkS1VqUjVURmt3VTFFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbWQzZDNMbVp5WVc1dGJ5NXdiQ1V5Wm5CdlltbGxjbm9sTW1adlpHc3hOQzR4TGpBdU5ERXpObk5sZEhWd0xtVjRaU1prYjNkdWJHOWhaRUZ6UFU5a2EzVnllbUZqZWkweE1qTXlNaTFrY0M1bGVHVT0=

http://www.dlsendcentral.com/WVl6OTRQV3RKYWtsWE1HUm1TVE42U1dsaWRUQkJSM3BEWTBaVVpuSktSVTkwUkZGUlJUUkpXbWhRWlVjeVFUQWxNMFFtWXoxMldYWnZUVEJRSlRKQ1ZHRk1lVUZxVDI1WWRIQk5jWE53YkZoQmNDVXlRbm80ZVdzeldHZDJWVGR4TTA1TFUxUjBaSE5TYlRoaFlYcHVTblJRUVhnbE1rSjBkV05LTnpOaE0wMUVTbkpsY1RseGJ6RlpSME5MTUVoVGJ6ZFRTRGc0ZHpsRlIzYzBaRUpHZVZoMWEwUm9XalZQTWtWeWVuQkpZVU5ESlRKR1ZUUXdOM1JwUmtNd2FITkdhMjEzTWxwa1QwUXpVVEpTWm5OWGNDVXlRa2QzSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm5kM2R5NW1jbUZ1Ylc4dWNHd2xNbVp3YjJKcFpYSjZKVEptYjJSck1UUXVNUzR3TGpReE16WnpaWFIxY0M1bGVHVW1aRzkzYm14dllXUkJjejFQWkd0MWNucGhZM290TVRJek1qSXRaSEF1WlhobA==

http://www.softwaresignconecpt.com/WVl6OTRQV2xLU0VneFRuQkdRbXAxV25WcFRWSjRZM0ZxVkRsWVRrc2xNa1pIVldGUWFYUnpOV2h3WVRGTmVVMWxaeVV6UkNaalBVNGxNa0p4V0d4MFkyOVZSa05XVUV4NlRUY2xNa1pUY0U5TFZEWk5ZMHRRV0hwUlZtbHNVVUZKVlU5MGVqUnpielZ2VDJ0WlRDVXlSbXg2YzNKUFFUbFFRbTFDU0V0cVRGQmtZbTlrUjFKb2JtdEJibGxJVDB4eVRWUllOWFUzUjBnM1VEbFpTMjVyY3pGdVJGUldOMVJCYlRCc2VXMTRWazkxZFhoQ2RFNDFTSGRaSlRKQ1p6SklZV1ZJV0ZaMk5VTldkell5T1VnbE1rSmtUV0kxVmtFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbWQzZDNMbVp5WVc1dGJ5NXdiQ1V5Wm5CdlltbGxjbm9sTW1adlpHc3hOQzR4TGpBdU5ERXpObk5sZEhWd0xtVjRaU1prYjNkdWJHOWhaRUZ6UFU5a2EzVnllbUZqZWkweE1qTXlNaTFrY0M1bGVHVT0=

http://www.dlsendcentral.com/WVl6OTRQV2wwUW5BM05uUnJiRzFQY2twWVRHeFFKVEpDYjJWaGNGTlFRek5FWTFKM1NqRnRTamhoVTJsTk1VZFBkeVV6UkNaalBUUkZWekpxVmpabE5scFpUVGhoUmtGaWNEQlVlVTVXTW5WNE1Fd2xNa1pMY25wcVNTVXlSbVJ0YmpCa2FGaDJkbUZFWmt3bE1rWTRKVEpDZVdWek9UVlVZbkYxYVVoek9HMVNNR2hFUWpoc1dIZFlSME01YTFKSmFEUmtXRk5vTnpoV1ZtRmhlSEJQTjFGb1lrWXhNMGcwY1cxclYydFZjbGcyUm1NMGJWTk1jalJsY0hGSGVXdHZaaVV5Um5Wbk9GZE9SME5MVW5KcVVtMVZjamh2U1ZFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbWQzZDNMbVp5WVc1dGJ5NXdiQ1V5Wm5CdlltbGxjbm9sTW1adlpHc3hOQzR4TGpBdU5ERXpObk5sZEhWd0xtVjRaU1prYjNkdWJHOWhaRUZ6UFU5a2EzVnllbUZqZWkweE1qTXlNaTFrY0M1bGVHVT0=

http://www.cycleapplicationshosting.com/WVl6OTRQVlpMV0RVbE1rWk1PRzVNVDBsbGIwbGlSV1pLYlZreFZHcFZkMUJ6UzJVemNuWlVXa3RyUkROT1JIYzVVU1V6UkNaalBTVXlSbFp5UkZOS2NWSm9ZVTVQYzNCNVNWWXdiM2hyZUhSVFJtcDZaSEZ0T1ZKMmNVOVhaVTFvYkZKdmREWXhiRm8zTWxsTldISjBkRWR4V0VzMlQzZzVSVTlGVmswNGMyUnJXVWhzU1U1T1RqTjNiemhUWWxBemQwbHBWSGR6Y0cxME5HOWFjR1JsWnpOSldITlVUbEZxVTJkVFRUUkNWRmN4WW1aMVptRXlTM013VWxaaE1uTlVaazU2ZVd0NE5VMXljVXQwVkhwQkpUTkVKVE5FSm1VOU1DWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpZU1V5WmlVeVpuZDNkeTVtY21GdWJXOHVjR3dsTW1ad2IySnBaWEo2SlRKbWIyUnJNVFF1TVM0d0xqUXhNelp6WlhSMWNDNWxlR1VtWkc5M2JteHZZV1JCY3oxUFpHdDFjbnBoWTNvdE1USXpNakl0WkhBdVpYaGw=

http://www.vaultschuckleapplication.com/WVl6OTRQWEZGYzNkb1JWTjBiM1ZVYzFaSk1VVmtjWFJJY2prbE1rWnZjekpPZGpGaFVsSndjekZRYlZWbE9IaHRNQ1V6UkNaalBYTm9WMlFsTWtaM01rMVhjbFpRU0hoclRYbDNlVkp1ZDJaeVVXVjZhVTVTWmpCVlRHWkhjamhpYUV0WVQzZHllRmw2YkRsMVZuVk9hVWM1V0VoTVV6Tm9WMkpFVTBNeWRrOU9RVWRNU2t3bE1rWTBhbGx4U25Oak1XbHlXSGh1T1VGb1ZWRmtaRzF1V0ZkME5HWldTemhrZWxveVdXZE9ZMGRDYVhkalQxTWxNa1pDTUhwUE4xQlBKVEpDV0dkVVdWUTBPU1V5Umtac1dsWlRNRzVGU21jbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbWQzZDNMbVp5WVc1dGJ5NXdiQ1V5Wm5CdlltbGxjbm9sTW1adlpHc3hOQzR4TGpBdU5ERXpObk5sZEhWd0xtVjRaU1prYjNkdWJHOWhaRUZ6UFU5a2EzVnllbUZqZWkweE1qTXlNaTFrY0M1bGVHVT0=

Remove odkurzacz-12322-dp.exe - Powered by Reason Core Security