home

opera-12614-dp.exe

web

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application opera-12614-dp.exe, “web Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Internet Program   (signed by Mode Beta (Fried Cookie Ltd))

Product:
web

Description:
web Setup

Version:
2.2.3.1

MD5:
450056ba76fa12bad21d326623434b47

SHA-1:
55c52ace488f3b034b572b2b58dedf8214142539

SHA-256:
7afb7ac408e69aa4d5c61bb31f43e3f1a209606fbc1ef306c6818f2d9b3c4274

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/26/2024 5:43:53 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.1.31.16

File size:
945.5 KB (968,184 bytes)

Product version:
1.0

Copyright:
Installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\opera-12614-dp.exe

Digital Signature
Signed by:
Mode Beta (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 2:37:06 PM

Valid to:
7/7/2016 6:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:NfTpRTDleJhejpMM9xkEfKuwBOioow6zXqOImo9GPP9DanXoGM/5pvAyVyNHc/7H:NfTL/ZxfK1OioQyGPVDGevALh/8FlCh

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file opera-12614-dp.exe has been seen being distributed by the following 16 URLs.

http://www.safecapitaldownloads.com/c?x=5JqS4qctYKNlUtAJyo75q 6 yUJ5yG/ t/2NpxCwClc=&c=BvGK2qPx x5V luK3EE PXZp8MB8c1/PTTAynkB TWe/hzkOmevm A3WKJcklX0Bgv9I1TxGOinrIMVbFe96MhzyIpryEPfy5 3q0p4YTTIMvrWTEwqeYztL/TrgTKUV&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.50/.../Opera_34.0.2036.50_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.giftsendhosting.com/c?x=W3l 9MgA5QRwg1f VkrWB0a09GlxmbiI8n8ZIsczt3E=&c=DwuNIdFKnpzZQAL6Y4tYReXEqznWZ59x QPYA05fVAgR 15L500a0P4ENCA7MU zVaItZAVBrPU2DAkPar0b1Vna8Cibgsb8wsYP8pHYbQqFNjap0eX495128 QiAaA&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.50/.../Opera_34.0.2036.50_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.safecapitaldownloads.com/c?x=Yn/OMLW1UtHglkh3L/BMEPB0BqMxMxCZSr7c89R4i0E=&c=Ci0xnLeK4eTvIADXYKmYz5o46HpJTxsTd/YX65LvGveINXLQmVHAjOXkBe4wgmRRR5sLrcxC0jszAufgKwAINGZHpLzSVXef8SVrEUroS3t5YLVDn4/Oj/uzxpYe1wAj&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.50/.../Opera_34.0.2036.50_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.safecapitaldownloads.com/c?x=XKojtkxaki0YBzPbQGKUTHUPDVu8AeT5e6iCucRt10o=&c=s2369GAj6KqlLkYkS6g1JlrLUvv2vuJAgKMfqGDBqJAYk2x45ssT/xPczkuBDW2DEr6sLyBn6zmUx/gD3N8QRkQVY Zv5LkScCcLg2OWxovAb0YLu6cSzGcQPunpTUSw&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.50/.../Opera_34.0.2036.50_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.giftsendhosting.com/c?x=qPrCRWzMN8l3Czhf61DAueEiOo/lZpgZQmIjXvsBivg=&c=u4u20Th5QGYTiM/IKumsFhWU7fh3UN6erQsh1a8Qk9olRuGetzmXORsTfPRvFl382TJu1d0O5sI3cZtzIVFTlXNmTlHM1rnnoEO/ aVVPd5EABIQRhiXcV4A3jzGxMZ8&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.50/.../Opera_34.0.2036.50_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.safecapitaldownloads.com/c?x=MRCrQb4aKXckX/i5LTmD83cosjHMvPO/oEBfhqXslhM=&c=39XH9GSqwof5zfQT6Nb145fULaaf7yNii/DmXufU GXSqJzAxN8JaY5PXECsWWsMVl7w7O1OdqJT9mZDUGVqnGHbHXWQ jZw0ObfOnTTkiixJg0BlDWZwSP/yILQMBFL&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.50/.../Opera_34.0.2036.50_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.headsoftwarebody.com/c?x=iwdh0K/pR2bf0BLC6OG JOb09hezKq6joBqP/o6/FY0=&c=AstLyEDLxBRXgE6BXWMZx4qRxrnmOWlS/zRYpMcYpbHkx6bhzaMGldhK4zcMeNV6KK0rVjryWA5rdEhCCZPmGG 62h4PRWxK6MpLq52gkqQS/c4XBVh9HjC5z3O/tP6t&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.50/.../Opera_34.0.2036.50_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.giftsendhosting.com/c?x=zvqzyaxUQJBTafD cdWdHcGc46lS o1km5 Cu1nHUL0=&c=KfF47J8bTTliWxbF7qzw0aeehJNyZIO7Hths2RuSw9u5uCUyft0xc8QE/FeyXZd4COgsbgBCj74VVAeag/RzY8n5BQR/RfPpVHVvgu4XxUB9Le3DehiUCiuPzOhzjSFV&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.50/.../Opera_34.0.2036.50_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.repositoryfactorymeta.com/c?x=2Ux wlH4eIjadgRL2tzCTJJDz4La2PubVxDXtNdbtEM=&c=S7KP/AV4dD8Qc8B8U/yMQAGIJG5GxwK7l GzSphuY/P2HGLuSsFEBJzEzmAVSOAAUxGGojnvK V99VD5mRQzlmVrCzHoplEUIlRiZeeyCNWPN1GUiqChrz5WKaXH0xrj&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.50/.../Opera_34.0.2036.50_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.giftsendhosting.com/c?x=iQl6llqS9u3U4NqoctqTVXNfnISGmT8ij8c8bFMWoSY=&c=DRi5Hvk1EAI5m1QDlplITU/lm1xet9ner7VxolwtZZl697NaNO93F0pjr5Xnqj3JFXI0 6un/wmWCx4ZoqNBTXYaVyE/ B0CaFqf/2nJ1Cg/5liSixNZ21lB TvAEJeo&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.50/.../Opera_34.0.2036.50_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.headsoftwarebody.com/c?x=vmCcDKTbhSQ66VI/y/5kLkEGqeGdZ4cave7h3lXvRPk=&c=GxdBRA1s03nQAgDMXRFT7a7VV2YPEivPPS/fLeKWDz4cywL3I8dbFFRZSCSElGzcdGLw5baCQmI44zMHFn oJhMRuvFlcYALmLnqsu6WM9KuobrfTw05p9xBuI/x5eRF&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.50/.../Opera_34.0.2036.50_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.safecapitaldownloads.com/c?x=W43HF htV70GKaTo8jGOu3tcWdwcSZ84Ar8xJtLiirA=&c=kr wDyEtcoKt/4qbosi8/8cDBGv8SePAZfrTEHn/ /vz4d1EhAM4NDzfxsftXYemLmk1GWSM4kNT3mch1kbJYS akJdrjBmhk1xDsihpN/8Uwyb2rbb0/AxP6mJlvH4n&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.50/.../Opera_34.0.2036.50_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.headsoftwarebody.com/c?x=S8F7I/wQk8W6Je78oO4FNEyEnXHw9nmuCgYLcI75GZg=&c=GBaI6QYWfMKFIdzZSaeJkhSAHb35VEtUV6Xgubgl5PJu0AgeyyYGptbexv7oE9Izn6SuOGwPjGIfij6tNQAWmZ/5wKV7ARBF0GsFNhgG3PTHnTqRPMo4QYHULTJ2rSkx&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.50/.../Opera_34.0.2036.50_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.appvaultworld.com/c?x=fkN4VUyD/EbxopL6yTaGdvWa1R276E9OHW9BrqtE8UE=&c=F6RPKEwPWw88tuI13JfBfkexIU4MrLXA5XwXHXgu0mrKcuCnc5BGYDRcKOK/0ApMFIM4P8BJACmkNyxJEwi ULlMslMugbncLGIN8bO63JdkSTm5FGtWz71/SS8zCfqT&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.50/.../Opera_34.0.2036.50_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.hoststockcentral.com/c?x=FdszNaoREbv i6tdiKmO55BYHo85vHBe x0CxrJ34qg=&c=JeVR/j1gIsf k/Cmmn5wvGcmxIQXwLcSmnstMmsaHlFwxCgZIJ1JtgjlNwAI59t6OPIZNTqBV0 6Cz20dD6o1uC9s30sobs/bcJho8ItEye5JyhZOCmCiPcg0EXZxK9&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.50/.../Opera_34.0.2036.50_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.safecapitaldownloads.com/c?x=zvur30X5EMfelXyqgGuK1lMLY08HYonq4A/qay0p6KI=&c=NzWgw UX0QjEV3utnRbNbI9/MoEUCYlBRryntazjsM/jBBtEDtg1JJHCwEB4t8Bg2y0u5rFH2VgxROYPh8ug1PCn4rzfE3hEoN nlgXybIRueKO07LjR6DdwuWLoh3 R&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.50/.../Opera_34.0.2036.50_Setup.exe&downloadAs=Opera-12614-dp.exe

Remove opera-12614-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.