home

openoffice.org-12495-dp.exe

Lite

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application openoffice.org-12495-dp.exe, “Lite Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The installer is marketed through download protals and search ads as the free Apache OpenOffice but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Mode Beta (Fried Cookie Ltd)  (signed and verified)

Product:
Lite

Description:
Lite Setup

MD5:
7797febbad8c6c6ce774aa96d0e37fbf

SHA-1:
eed8d7f9430d1678b75c2a4a001e709c86bbbb9c

SHA-256:
e24532a94c2f5819ca960fa136c521815b601066075edb979669d6606bb9f798

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/25/2024 6:52:49 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.2.15.21

File size:
944.3 KB (966,936 bytes)

Product version:
4.2.2

Copyright:
Application

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\openoffice.org-12495-dp.exe

Digital Signature
Signed by:
Mode Beta (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 2:37:06 PM

Valid to:
7/7/2016 6:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:LTtBYvtCO6iNum4dvHgNoW+iN6jEvZJCblnxIGX:LBWvL2HgJ+iNFRJwIGX

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file openoffice.org-12495-dp.exe has been seen being distributed by the following 10 URLs.

http://www.appranchsoftware.com/c?x=Wsgdr2ea6U29KoHHUzYpZx7zLE9QF ieuW6dNYde95M=&c=tRFr nDRa4WUww6dFJrBRqNnB0N1s69A2dPOuvV53iNtnHmWA/Rv2YUSQXTZCLHOmH8LeqzUwVUeQ2Uf199j1R/FWjPbzpY7O/6oPn8ze9yDiz8SAVai/7VorbDUs5mS&fallback_url=http://storage.dobreprogramy.pl/.../OOo_2.4.2_Win32Intel_install_pl(dobreprogramy.pl).exe&downloadAs=OpenOffice.org-12495-dp.exe

http://www.contentheadtowers.com/c?x=ncvdgSAEhO89vtCNeNYdDfeh0 TN X7GkdCXjxAder0=&c=dQ zkG u3VWkez5MKB0oBYIx3ig1GVnuGZf gaVFnOktO1/Lxtqp9A2uCfJ5FNPUEo2bj4eLvjJCg1r7usPFgq9KjuqKzdxg1Bd5q0gWpITVzghVetngJszIZ1CpwJ9B&fallback_url=http://storage.dobreprogramy.pl/.../OOo_2.4.2_Win32Intel_install_pl(dobreprogramy.pl).exe&downloadAs=OpenOffice.org-12495-dp.exe

http://www.laboratorysenddl.com/c?x=cr1dkJUHeBR7XF eStFNDncRFEMc9CGvfIx5lXPXFhM=&c=b8GTnJVQIrIXdePFdClFQ/0BFESikCOgCXNFLTzAm4hwqeVDvo2URELGq/yKFYf9eAPzCnANGj9xEd68Up1IfByLl/rmbCYPkSStbjeQlr0uUUBN QOWB85/kGp1Gn5N&fallback_url=http://storage.dobreprogramy.pl/.../OOo_2.4.2_Win32Intel_install_pl(dobreprogramy.pl).exe&downloadAs=OpenOffice.org-12495-dp.exe

http://www.laboratorysenddl.com/c?x=K5hZqbPhpxnmWGpnLQJ3FvFh0NrR/oSo2AJjmWe doI=&c=no7i0Y3IKrpHfWKuBKkh59t9pyWiqsrV9GxgO7t8cenQ0e63953hHAD6oM6y34UdyWhuX844X23A8ulgNabKSpTDwW4RIC4nX0FMgI9E/CZCRcnkIFwvWRPdipJ aD/f&fallback_url=http://storage.dobreprogramy.pl/.../OOo_2.4.2_Win32Intel_install_pl(dobreprogramy.pl).exe&downloadAs=OpenOffice.org-12495-dp.exe

http://www.appranchsoftware.com/c?x=/kVmEgN9IIb/9sgRgJuOobHKqFgi9HNgAcH/KPvu0Es=&c=kwmgIo7flKN5XZBiR621F 0qs5pIj8tIKvju0ApZfamwPNGnEj7VtIXWL3oVaZeFM/7EVlj9M142tAtKG4WsIY3iNJcpgfB4yxaooxqKuiMqfOmXouFrrshl/rWF0oJ&fallback_url=http://storage.dobreprogramy.pl/.../OOo_2.4.2_Win32Intel_install_pl(dobreprogramy.pl).exe&downloadAs=OpenOffice.org-12495-dp.exe

http://www.sharetowerbyte.com/c?x=vFd7GBmRJcF3KgjilUsohNoNzLD92kyYAEfdqIhN/Uc=&c=fLV5M8dv5fEbNOLEezRDkNUCVZbQZzOwyQ8Wy3UaOMn5EgaffauXAhG7IpF17ihGn2wd5iW5H4beZCzHPr9 MEi1LEEccMBrIKXJwTsV3HfdbcFwzhrEciqBU4asn1Ax&fallback_url=http://storage.dobreprogramy.pl/.../OOo_2.4.2_Win32Intel_install_pl(dobreprogramy.pl).exe&downloadAs=OpenOffice.org-12495-dp.exe

http://www.sharetowerbyte.com/c?x=eeOeDPh duEEXip cXKjUpLRDVqqdIambEpvQfmWXjY=&c=vPB1TJ/zblKtWDIkaRNVpkHYnNXzGtqqM34mT6zuXZDl7r1gLy9F0/Fjh0YoWPV13qmAmn5IiHuZPCLs5daScjBN7NVXU4P47fT9LI zpVQIKwUkV BMDmA8y4stZ4U0&fallback_url=http://storage.dobreprogramy.pl/.../OOo_2.4.2_Win32Intel_install_pl(dobreprogramy.pl).exe&downloadAs=OpenOffice.org-12495-dp.exe

http://www.contentheadtowers.com/c?x=yXCjzYWBlEe/AAg RcxTluqccHPxGypY0UELTUX HrU=&c=eTxsioscewXaWzJgIDojfIhmmOQ6e4e8UdhO08sILeYErrXQsFGqaUTYFAbG1YezGziJjuvtEEqHjZaogCnvMoBe0ksTUOfipzcjYJa1on PBGUgo6CHiNy24HvanSH &fallback_url=http://storage.dobreprogramy.pl/.../OOo_2.4.2_Win32Intel_install_pl(dobreprogramy.pl).exe&downloadAs=OpenOffice.org-12495-dp.exe

http://www.contentheadtowers.com/c?x=uQ1HGX9Owx/YzHYvf06I3c N65IbmjTFPcPJBQEOHbw=&c=4brWk14U2TAtnFF7sWeB/DEQBvVky9dG6m40K2dazmvLL21fkzl378l1fk8hrvokpOxsYB/A5gaJA9H3osXhytw7vOA/p304SaD1SZFr1lP5X4c SefnwIZre8wsGoEx&fallback_url=http://storage.dobreprogramy.pl/.../OOo_2.4.2_Win32Intel_install_pl(dobreprogramy.pl).exe&downloadAs=OpenOffice.org-12495-dp.exe

http://www.contentdlapplication.com/c?x=Ua1TVkfkI2UTq01id8b/o8YGO3S3ReJcnUtiJIvY5ag=&c=YI8C5Duej7lQMYkYboUfPjheEBZ/6nLkSBBlpq E9Bqhysgj8XjjfVGfjjyq/EtKk9M dU rO0ZcN/rcCM7s 2JxH0cZviW1StxgrU8YFvc94msdWZCDD6ZltC8f6/mU&fallback_url=http://storage.dobreprogramy.pl/.../OOo_2.4.2_Win32Intel_install_pl(dobreprogramy.pl).exe&downloadAs=OpenOffice.org-12495-dp.exe

Remove openoffice.org-12495-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.