home

opera-12614-dp.exe

Fas

Docesipete

The application opera-12614-dp.exe, “Fas Setup ” has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Docesipete

Product:
Fas

Description:
Fas Setup

Version:
4.5.4.0

MD5:
989bccd0dc8f16025fc9787977fdb9af

SHA-1:
92b274d1fbc83a3c25c29b482947b72fe21202e4

SHA-256:
728397fa87f700464563f208e7e09cfb2056a7e97007595c70ca5ce2fac71ca3

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/15/2024 9:52:13 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.11 (M)
16.3.2.17

File size:
1.1 MB (1,112,881 bytes)

Product version:
1.5

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\{random}\opera-12614-dp.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:oRdMs9NnAHY4gDGedk9OA/G+J6bOBZJfWSNSFKFW4wefTE:ob5jAHGGedkYA1T4KFW4wgE

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file opera-12614-dp.exe has been seen being distributed by the following 11 URLs.

http://www.townfilesdownload.com/c?x= idDbWtyJU81bgJMdlIkStdVG1QZyJK58NdvX3QozUk=&c=f/Anyl77/KFhg 4iOOGyGFHnEIxV7YbAA2cGiYv4hyZdsTIRGIfEEcneFjFZtvir578mSWgNSgRKqsaUFX2rn6Opcg5rYlugoHMT6ZUxVA9ey8Way3FXibkDbI4TOIsD&fallback_url=http://get.geo.opera.com/pub/opera/desktop/35.0.2066.92/.../Opera_35.0.2066.92_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.universecentersigns.com/c?x=4lhKxnDHp1xkNUQbArKZ7UWQ87GsFT36o3l u8/8X s=&c=/CNpPCaicQHGBtZKEyWdTmyKmGPOwh3TFl6Nr vcgOaAmQTaqo3Kc661A v AvfYOxw2tZNUfXQRKmRdJIp/kW3YbP69I6gpXxZu46HpsI4PP 0LsQxK9Nyp4akU sHi&fallback_url=http://get.geo.opera.com/pub/opera/desktop/35.0.2066.92/.../Opera_35.0.2066.92_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.townfilesdownload.com/c?x=vY KEC7PKv5QBa7SNhuXosPRktdevz81/pxLIrrZIcc=&c=oiqPwES7YroCVo1206gjBtOoenDgTycGLHxwL0phW/uOK0TLtHgtj1Nlczwa UjCtRZeNs5P2ijdKALIrLG2L55lsQpycyEOr4HOKE8qkH0vGbVxj/yA0yjyO Q6LqIh&fallback_url=http://get.geo.opera.com/pub/opera/desktop/35.0.2066.92/.../Opera_35.0.2066.92_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.chuckledeliverygift.com/c?x=g 60DM7zsRbcaUU/y/2V6ZY7PBhXpT 52UWcHhEtr08=&c=vKU28YwMJrSeih7dxaoeY6jxeYj7PvmVVoBrmaLgrTvRJtWPdefHAm1iX5hJN78l5sea7 XNN99Z4WXBAZ8qTwzmudVY5PbqgRB0wZ OeH1Fb9uA3o6dw6TBq4RPutol&fallback_url=http://get.geo.opera.com/pub/opera/desktop/35.0.2066.92/.../Opera_35.0.2066.92_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.worldranchbyte.com/c?x=LJJExf4sS5J2SGdWQ/Lcd3U q8DXrAI8B1ecWqQrvMY=&c=YI7e/Dg68fri0dcLIyO 7c NCxPd8mBVW/mcp0msdXU4xDEmTCMQO7BPhP565wdIFijIkSLIjIlYcWWTsNBm E0wQogF9JzutfPkzolZsDekUKD3NEu/tGx3Mgne//GS&fallback_url=http://get.geo.opera.com/pub/opera/desktop/35.0.2066.92/.../Opera_35.0.2066.92_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.universecentersigns.com/c?x=dSz97iCyObk276PEVTkJJ9kkzJHNl1s0QSgxkQE/3oQ=&c=hB5E5K68p79hJNcj6PT7XigVds84Xvhq1Bp8aUdweKidthVQsAN/7jRdDm2sdXWMH/ggtcULZugtQbxK0vgip3vq0Am2eV6jh/mj8bnbnDYaiZ3fBcSLturHUu7QM0ON&fallback_url=http://get.geo.opera.com/pub/opera/desktop/35.0.2066.92/.../Opera_35.0.2066.92_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.townfilesdownload.com/c?x=S6KOk/rjF5sHsdXCXeMSrT68D9eaKoVyxzGelQdtT0c=&c=dStohI93t0xXrInTjd07yJAUNI/i8ZfrtrF8mQGbHjS1SzHITTMU/zzxFdmRbqtbqapJKs3sYJjV5 F0oW1nORL5SCJxiU2v9bk0UDw4u8ggDGdm9QiGs26fnirq0giV&fallback_url=http://get.geo.opera.com/pub/opera/desktop/35.0.2066.92/.../Opera_35.0.2066.92_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.universecentersigns.com/c?x=C18VzwtUU7Ccr /IuqkUNiLSjMNkvOY0UN fA zgZ90=&c=AzRKEHoD6P 0 TmIec2YkkCjfBU b7XyZoTm9qQlwLbDngKvHtVHSXVlFWxNcuCapYbYLsIYJevTGTzwW5VL3/QhTpOEOzguIcBjzlbG xzNrUJKIL/p1B1phgGC W u&fallback_url=http://get.geo.opera.com/pub/opera/desktop/35.0.2066.92/.../Opera_35.0.2066.92_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.stockhostapps.com/c?x=GT2FMmp rOlwb0ygmdo198MP5jcurgxRNy6/kUlukAI=&c=nx8NPd0/ILYe6aPVC2UUi8KeFwcidr7KipLh4cnzcd4q6Yfd5xMm03vuLZXwZ6LpG2RrjnfS54h7PDyh aaFo93xdREV9RSGa kGVx2 8zgvOI88oCCH7IprQkGq52DU&fallback_url=http://get.geo.opera.com/pub/opera/desktop/35.0.2066.92/.../Opera_35.0.2066.92_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.giftcontenttown.com/c?x=SCJqKuNtm213dvmSwlmJhShcltApnuD31OirfStdn0k=&c=g/z1RD1XoS0ohFE6EWA5KLMwOHNhK6MvfsBfDOiTA ZssF1PiWRByyoqa0H0xsrPBM5KjIUbzG/yaTw8csOi6/qYLlyi4yPlwMkALuWOLwri/Ygrv2lPthYYVeK8rIvX&fallback_url=http://get.geo.opera.com/pub/opera/desktop/35.0.2066.92/.../Opera_35.0.2066.92_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.giftcontenttown.com/c?x=32UAxeRmpTUw2nVJpzhCVuBi4ZOrWQp/K3rY2Hrvmj8=&c=3am1Nb1szOiuU3hpnzoo7gi6faFX6dID171Y8kyy xGZpXGFNYvR G HZZSDRJT3omH7y wW7jWlU98s91mwr Gixbr/CjTzWIBCzCwK01oFujKuec99tsaAGgj89UyK&fallback_url=http://get.geo.opera.com/pub/opera/desktop/35.0.2066.92/.../Opera_35.0.2066.92_Setup.exe&downloadAs=Opera-12614-dp.exe

Remove opera-12614-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.