home

opera-12614-dp.exe

Cesol

The application opera-12614-dp.exe, “Cesol Setup ” has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Product:
Cesol

Description:
Cesol Setup

Version:
5.3.4.0

MD5:
6c08981265d43c6bdd5908988a9ff677

SHA-1:
c6de117dca4538c1a8a0fc06b9d2d82fe0b7dab7

SHA-256:
99de6190e351813f323331e590d8831a80c72913123e5af68945d03a7f77a497

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/15/2024 11:36:56 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.RE11 (M)
16.4.14.11

File size:
959 KB (982,033 bytes)

Product version:
4.8.6

Copyright:
Internet Fast

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\{random}\opera-12614-dp.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Mpas09+b2j18ARkQSK88Cy6h86fubS0nQ+UFfYxJSl:MgsM8afSK88Cyk8/hnQ+UlGK

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file opera-12614-dp.exe has been seen being distributed by the following 14 URLs.

http://www.chuckledeliverygrab.com/c?x=7xk0mr5tTy3oEgAPM5Npivwfh11xPFNysrwW8OffCWE=&c=zJ73ycewpCA0YODKkII qOVdLA9eGneVPXEmK2xTOsO5kRodl5FK2f2Wsid0ATGvRCFGae3bYeVDMXqvv0jA8sTqXpQqw6LkLWdN8AFIsy06HCkuiEq4ISq2bKPoA/rY&fallback_url=http://get.geo.opera.com/pub/opera/desktop/36.0.2130.65/.../Opera_36.0.2130.65_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.chuckledeliverygrab.com/c?x=bwHDM8WTJUzcpT6XlKlCu5xWVJYmw5mZm fxl I MW8=&c= 1Wg8DCaPFZxGjYVBif6UXvO3W6WXOG SpqJkHNpsUCF1Jq/wAJxZPBiXLfbAh0HpQ2RzARXu2yfG5Zrluwi71QwTbnxIZrDwUOhrsLyJ6E3a1d tVhj2eR69fTTIV1x&fallback_url=http://get.geo.opera.com/pub/opera/desktop/36.0.2130.65/.../Opera_36.0.2130.65_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.presentapplicationuniverse.com/c?x=X7MntWmRA/3ZBezRPE55mRqQmHq2B5qny8mZ8K22S/0=&c=YbKWTIh4qo7 AQF5d3ykOH6G5xkUmbzrNxfhxIIDS7zUXPbSuTxWDHow M/OVWPdn9LNRgnAWeG4dJXdwNeqcnT733MiPuhdOb5DV23CJMUfi51WZbrJc5wXqkiiAf3Q&fallback_url=http://get.geo.opera.com/pub/opera/desktop/36.0.2130.65/.../Opera_36.0.2130.65_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.bulkbundleapplications.com/c?x=DpUVPHbKdZUGNH5Og74zoBUdjQK/DNV/MoKmkeO1bmY=&c=A2EbCMyG6iFj7 jnVt/wwNTAL7yLFNR/eB/2fokZfG6gJl1XXUC8gYmQ8AD4g55k65jzvFlGhvPvH1xSaFgzCYh94tdTF/B1xWiC0uvFkzVi5kvvcafHFHGV2NFUhsik&fallback_url=http://get.geo.opera.com/pub/opera/desktop/36.0.2130.65/.../Opera_36.0.2130.65_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.chuckledeliverygrab.com/c?x=hHL6Bd6PmySvTpC6Zw3U/dKZwEB5iiNlZ5LhXOEWNZY=&c=8Sw/cZorgyLFhcHS2mgGFUe 0mNw3yHUFa4tFLxdkR9 IkrMD0/Rv8JMxIAw6IvxhTUfpnqoRZPb1j0HfxSFI8ZjPa1fzvFKg5B463Kc2BaFbGArGolb vdB30AmtSLa&fallback_url=http://get.geo.opera.com/pub/opera/desktop/36.0.2130.65/.../Opera_36.0.2130.65_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.chuckledeliverygrab.com/c?x=KkqSFgMp/TM4fsYmGYpNC KRunxVJr0azGDWd1i8fAI=&c=xCUFqhlUv7WmfoEhxcgXhmS85/jE5trUu5A6IWSYL6tdsIBZAJ UIBzaIe5lb1RFm/u26BxBdx8FwmRXgMepJS9mU/TCz4jkf4k9MgklwTljmVZk3MUBj0AZbbsPvhqa&fallback_url=http://get.geo.opera.com/pub/opera/desktop/36.0.2130.65/.../Opera_36.0.2130.65_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.chuckledeliverygrab.com/c?x=ImTrjrKLCvvWSWpiKREWtKT9mQesjD8INuwWql6saSY=&c=v4Un0/bddN6n2B9yq8pQy5zbPizwsBt2PHFr1hA0oBqIBZjPwdMnrtsAIMEF8xRkbyz12PLU 5wmZsmjPv1BI4BnJg/kQQhexxGYJCzpjJx3nan1rjZ rbj/F49vjE28&fallback_url=http://get.geo.opera.com/pub/opera/desktop/36.0.2130.65/.../Opera_36.0.2130.65_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.presentapplicationuniverse.com/c?x=XORH57oIvSHxnUFuvwTUUjKqhrMLcAiB/u7X4/1QVZ0=&c=3kVB8mTWCgiM9upSsKjR8BNlLTAIZlDZz5A iE9fwOogRscaiFW5S2Wd6LN4VPr16cBm6OOqfXOJWEm3NMZkP80Tp/TNPwBmRXogm9K2Uy8vHtJQMckw4 GqvLd1b1F9&fallback_url=http://get.geo.opera.com/pub/opera/desktop/36.0.2130.65/.../Opera_36.0.2130.65_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.downloadguardpresent.com/c?x=Bbhvkkx MB11fb/SG5oFFy2BZVKWgCl2rTUstpczF 8=&c=6CZaTkYYZhB5JuR0gIGYN5lSj8f8on9lpMp/dMFdwodaAgp1atGNrIYEQkKhAEaIr/OqlqmNxfLUz4qVCsbJcxiV4v1F9x5Pgl0krwSUElCKBuxR8bcF7g0udZNh5EuF&fallback_url=http://get.geo.opera.com/pub/opera/desktop/36.0.2130.65/.../Opera_36.0.2130.65_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.towertoursworld.com/c?x=Llw/Rg4ZvRh8OalnUuhQpK/RBRjLC2ztFbjph8UZpzw=&c=zUtnizAiZYQdmk38DhT biUI9m0GJmVlPfa/dk pV9lRKyHBo6EjLhag0jTRyjd BN0FvOKlylFsPsmBdsBAWubhPGyqkQfY8n5QdbZNbafco0zeGPhi8hO73CzrS0s&fallback_url=http://get.geo.opera.com/pub/opera/desktop/36.0.2130.65/.../Opera_36.0.2130.65_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.conecptbulklaboratory.com/c?x=26cwhZ CR5zvTBxv1MNvW x94sxpNlH9JNPBYhIPUxM=&c=uVD /N5/wI1M Z 9gaaWwOAQ1ZuA0Ur EDLkkOgSXT0O2wARfkWP9fC/P54aDn1qHLD8AG5LI90oOeNbjRqVOxNPi0q1o5nu8wwIAxlwCopZiKbdZPI6hkDMwzEE ePO&fallback_url=http://get.geo.opera.com/pub/opera/desktop/36.0.2130.65/.../Opera_36.0.2130.65_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.downloadguardpresent.com/c?x=fKnKh2xFI2XcxdBNFjKKnKDpu7RXEtz2qThyFx4jbt0=&c=X/lkrxaI26saCP94wbTKc8Z2BR36K3gmyq5HgbzlCuhiPji2IkhYz0lJykfbB68axsKA8rro4D366d8d7MFbMFIsHnmbo/QTRJJfgnGuSlL5NVEZA8jJyhxQcDVnC/9r&fallback_url=http://get.geo.opera.com/pub/opera/desktop/36.0.2130.65/.../Opera_36.0.2130.65_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.conecptbulklaboratory.com/c?x=WYubBRYV1AOBO1EXNmf1nxeq4/z9Z6Wto5YwJyHzG9o=&c=LOh2Xv7 0rBV7GKsU82YSRH4zGihs9F7woc85BokkiBXpf16ptPNxKGAPhmNtTrAlYSjlts7A6osWNZ6H6pJvvMzovAo7x7Zret9tEjv9kAx5wVte472pv3f/IPl/pNh&fallback_url=http://get.geo.opera.com/pub/opera/desktop/36.0.2130.65/.../Opera_36.0.2130.65_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.towertoursworld.com/c?x=ZRqAmDtyg3ehHH2kkbwVtGJ4lhyM3cZrlP/fSyKynqY=&c=nsuuutr3tK Lnl3es7QUFeSz50mS2q9E00N96SMDTwA4LveVdEXdTJy4wxyGzImkxmIv2iHxI1mm0rxgvwKvMWdt7mRmV4pAO1YTVppO6m0kJe M3kPX4Jha660awxFR&fallback_url=http://get.geo.opera.com/pub/opera/desktop/36.0.2130.65/.../Opera_36.0.2130.65_Setup.exe&downloadAs=Opera-12614-dp.exe

Remove opera-12614-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.