home

opera-12614-dp.exe

Faferonaco

The application opera-12614-dp.exe, “Faferonaco Setup ” has been detected as a potentially unwanted program by 4 anti-malware scanners. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.updatebestbits.com and multiple other hosts.
Product:
Faferonaco

Description:
Faferonaco Setup

Version:
4.1.3.1

MD5:
32f55f21de4729e5df095b29f961d349

SHA-1:
5486e986bf847c6b6edf3c7f42df623fa05fff2a

SHA-256:
9baa5f33ff74241c3b53299ced4a65529c852cbd5f509ad28058aca1880d30ef

Scanner detections:
4 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/16/2024 5:59:36 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Malware-gen
160215-2

ESET NOD32
Win32/InstallCore.ACH.gen potentially unwanted application
8.0.319.0

Kaspersky
not-a-virus:Downloader.Win32.InstallMonster
15.0.0.562

Reason Heuristics
PUP.InstallCore.EST (M)
16.2.25.17

File size:
1 MB (1,100,108 bytes)

Product version:
5.4.5

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\Documents and Settings\{user}\Local settings\temporary internet files\content.ie5\{random}\opera-12614-dp.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:jskZjI1q6dxdT9FvFw0N8u0n3EQrzQR7cjS5debIl1Qe8iBUoX1:jfedpvcu6zOSbSSey8

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file opera-12614-dp.exe has been seen being distributed by the following 5 URLs.

http://www.updatebestbits.com/c?x=qQonTG9385B0K1CN1UE4ekVrep65EVVnUXIusFJlyVI=&c=bHz20Z0zFXwZK1n1BZZaXH7yMkjLyZlM36i3OSbXcnYepM0hD 4SyJCxoyfp7KTN K2IL 5AVE0lrPPm7MhcgT5AZORhciN/bJe2PrAp7vDH8JWqivn/YbZkqmpID2rv&fallback_url=http://get.geo.opera.com/pub/opera/desktop/35.0.2066.82/.../Opera_35.0.2066.82_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.downloadapplicationbest.com/c?x=ekoDvRnijIavVVTNps0Net6wugjg1bhVVYc2Eu9WipU=&c=BIh GPgH4pDIe4yKwV0i1yhWn9/Fhi7AUTTsmX04faQji0h91DTLyMVlg9gXShw2jLSN4p9jGgx0n7O1aaLE/x7Cfs5/Zo51HH1WdDu7UmjWQgGuy82IfNVlSDZ7T8tb&fallback_url=http://get.geo.opera.com/pub/opera/desktop/35.0.2066.82/.../Opera_35.0.2066.82_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.tourapplicationshost.com/c?x=JH7SWpyd dtnHntl2K6PoULrN TAZHY1Sc1d/jXB1TQ=&c=nI6hdUYyqrymol7UGgmWSWEh/hf4PwihjBqsGG4vOkN7EumDtsRfA/TEvkRdSLJgfUdMP9G/8ejw6Ujm8ojvFPlvBYMMSDVpJSVI0aN2CLQnuhnl1zaSeB7jbvKI2UYd&fallback_url=http://get.geo.opera.com/pub/opera/desktop/35.0.2066.82/.../Opera_35.0.2066.82_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.tourapplicationshost.com/c?x=2m/BmNuXIH6lkN4iOQH1T0CF7az Zdxsh20b9bhjlHk=&c=CJ77IdgxgkZzevNjs4NoqJnLrFQaNyVon g4es/tu2lRbD6CVSNAz035 QTIoCCf2Yw9iMbe9owTc0yNqpcsiN/QOdoRUUMaBAI6Xe9ZI8HveI7Eb0nTbrl46272dYwd&fallback_url=http://get.geo.opera.com/pub/opera/desktop/35.0.2066.82/.../Opera_35.0.2066.82_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.applicationconceptssoftware.com/c?x=/lqycNIfu0VwbyEs52J8bZLcVbvX dQ3YlrqE6dYvGs=&c=bVtu0s4x/yD9MeDfBnXFjh7Tb4r TMPycKdJ qIhAbvGrmTVhov2Qu/wu9S/6ajNHKEI44FC8/eQR4jzSBOE9J4C4JXMdeupFhGR/ydX3e1rwR8PZ2NocwtI5DZYgT9P&fallback_url=http://get.geo.opera.com/pub/opera/desktop/35.0.2066.82/.../Opera_35.0.2066.82_Setup.exe&downloadAs=Opera-12614-dp.exe

Remove opera-12614-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.