home

outlast.exe

Tipo

SetupSpeedy (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application outlast.exe, “Tipo Setup ” by SetupSpeedy (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Pabete   (signed by SetupSpeedy (Fried Cookie Ltd))

Product:
Tipo

Description:
Tipo Setup

Version:
3.7.1.5

MD5:
46ab35e80ef942a6ee079adb7086eb80

SHA-1:
b3f41d070acd83c5d9cd69d294d1be1a51fcf52e

SHA-256:
3467a6945b322de2cfbac520f51bc08625b3392272f9f6274eabcd7331e93ee6

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/23/2024 3:25:54 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.4.13.15

File size:
952.6 KB (975,504 bytes)

Product version:
5.0

Copyright:
Lite Stub

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\outlast.exe

Digital Signature
Signed by:
SetupSpeedy (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 3:09:36 PM

Valid to:
6/8/2016 6:12:50 PM

Subject:
CN=SetupSpeedy (Fried Cookie Ltd), O=SetupSpeedy (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121EF8B655959B1CFE34F05FAFC8D598305

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:UAWFaX8929zr/aKGFkrkiWHdjogCH2kebsIusDXozq3mMX:UJ0XR9JEak1y2jbs+VW6

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file outlast.exe has been seen being distributed by the following 12 URLs.

http://www.conecptquickrepository.com/WVl6OTRQWE1sTWtKaFNqbHVRMjV4TkVkeGVVMDVZbUYzVld4V2RGQk1PVGRrVURZbE1rSndhV3RTVnlVeVFqZFdTREpNVVdzbE0wUW1ZejFOYkU5VFVEaHNSMjVhZW1wb2NsSkNSVkIzVVhvelJrMUJVRlpqSlRKR1drdzFiRTA1Vm1GSk1XTlBiemg2Ym1wRFMwMWtlRXBFYlVvNFJYVnFKVEpDVld4VVNUWXlTR1pYWW0xbU5FVnBURTB6TTBkclRHVmpPSFJNUTBvM1dYTjZSVXhUTWtoVE5XcHZiVVo0VVhGWVFsZGtVU1V5UmswNVFVbzFTbll5ZEhSalVVRkNZVk5CT1ZJemIzUXdVRzB3YjNkcVZIWTJXVkJUZWtFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd2N5VXpRU1V5UmlVeVJuTmxZM1Z5WlM1cGJtNWtiQzVqYjIwbE1rWlZVeVV5Um05MWRHeGhjM1F1YlhOcEpUTkdjM1FsTTBRd1FYRk5hazQyYUdKYWQyOTJSVjlDY2tSbFVrOUJKVEkyWlNVelJERTBOakEzTlRjMk9UY21aRzkzYm14dllXUkJjejF2ZFhSc1lYTjBMbVY0WlE9PQ==

http://www.quicktowndl.com/c?x=93dfmbC8/nRBXvjL1cFp8pNGXHcGPCTNf7//IZsBIrE=&c=pJ/AT2tDC4Qr9GxEZoYF07Y7rQRq/jduFBfTPDyMS3MtKBUJa9RAlZOrdNwPE7jfkTxHCvhWMjkpz35qRhaSI74lm8 h1qlUkPb8Ca6CktRtoSBL8IAu/MuE7U d4zKkUOs3vXalk LKTSjz5wPePN4I5gjceeaMDaTRqFKODbw=&e=0&fallback_url=https://secure.inndl.com/.../outlast.msi

http://www.quicktowndl.com/WVl6OTRQVGt6Y205T05rbEtUR1k0VWtNd1dUUm1ObEJQVTJsYWEzWjVhV2R5ZVNVeVJrMXdSa2xxTlUxcFl6SkRZeVV6UkNaalBVTjVXWHBNVkV0WFJEbDRPRGhVZG1aRmJ5VXlRa0pQVTFnMVpVUkxkbGhYUlc5a1JYWnNSVnB3UVhkblZ6UmxWbWR3TVRabmRtOGxNa0pITm5Nek5ucFdaRVZMY2tOalRsWnFkamxsZFUxTmNqSjBTR0o1WW5OTFZVMDFlVXh5YUhGYVZGQmxkVlExYTNOWVpXdEVOM1F4UVRBbE1rWlZWVEZNWjNCUk0waFpaRUpzZUhwSE9FcFpKVEpDYkd0MmNscGpOR1o0TUZOUU56TXdiVlJuSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0hNbE0wRWxNa1lsTWtaelpXTjFjbVV1YVc1dVpHd3VZMjl0SlRKR1ZWTWxNa1p2ZFhSc1lYTjBMbTF6YVNVelJuTjBKVE5FVTJWR1V5MDJTekZmY1RCdVZUVXRRbEF5TjJWdFVTVXlObVVsTTBReE5EWXhPRGt5T0RjNEptUnZkMjVzYjJGa1FYTTliM1YwYkdGemRDNWxlR1U9

http://www.quicktowndl.com/c?x=aj9cSBidO0/cgKlOXohaD2dIV2roTU5vpjCJms9Z7uc=&c=1 xri8OlCUNXEkZ8iTmdN2L/txnxfVQLygLnaKDIetpxZN1rGXGG0TiuYfSbwLeyvg0OpM6CGdtmsvH/m2giTyvaZF3JwIM042YeZDLN/lfQ51ryBoIL1FlFdmxGBRyx 3polJHz1FAxqa0U263aEwP89Ei5anUq4Lwr g/EsIw=&e=0&fallback_url=https://secure.inndl.com/.../outlast.msi

http://www.quicktowndl.com/WVl6OTRQWEJZUTBsdFVqTlhlbEZHYkU1V0pUSkdkVkZFU1dOM2FsUkpZMmxHUTBaTWRHUjJZVGN5WldJME5sWjNjeVV6UkNaalBUWm9SbGhZWVVKUWFWZE1hbVpKTkhWSWVXeFhKVEpHVGxnMWNrSm5aVkZZZFZwSWRscFNZWFEwVm5jbE1rSk9jVTFsSlRKQ2EyOTFlaVV5Um1Wck1XNTFkMU5ZYTNKQlVUSjFRalp3TlVKdVFpVXlSbnBuWTBKQ0pUSkdSbWh3Y0VnNWFuaDZUa2RZWVRBNFdrOXNUVXBuVkhack5HUnVSM1ZQVkRsS1kzaEJhVnB4WTB4dmJIZzBSekJwT1VaaFpXTmFWMVp2UkdkcldYaDZXa0ZRZW1jbE1rWkJKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjSE1sTTBFbE1rWWxNa1p6WldOMWNtVXVhVzV1Wkd3dVkyOXRKVEpHVlZNbE1rWnZkWFJzWVhOMExtMXphU1V6Um5OMEpUTkVUSEpEUTNWc2RXWTBjV05DVVhBMFJGZGFiVk5qUVNVeU5tVWxNMFF4TkRZeE9EUTVOakUzSm1SdmQyNXNiMkZrUVhNOWIzVjBiR0Z6ZEM1bGVHVT0=

http://www.towncyclesigns.com/c?x=919p0rRVF UVKfqyoO5nLwY5OkmDeX0NjzcC8x891To=&c=3pQG4TmnduoVTLZu SPGv6Qc5998hrEfdPwk4dVZMJPTGCku7ZhBvPQ4vzOKajmFkJf2oPxPemVqJoHa3rY1txc5WpgDMg7y7DadSaiz/pxxjnOjAuplpbVxASL3RpcEN5J35BjtC6VpFduuRhL43E3auR1aYvbkR 0SdaIrZCM=&e=0&fallback_url=https://secure.inndl.com/.../outlast.msi

http://www.quicktowndl.com/c?x=5peN8Rgv2QuZIyTjNqwgg036v3H5t8NMYF2H4Mbq81M=&c=8eqjsnlWFX2bCa7KWRPZwjNQDhqKzGy07VXUdCwwkYixvQSw2mrhD2YFrbkZgnhioiRGyrGVVeJsDrqMiCP8gCaGpT 5GUEQYgArrE0kU3M2HxlcTCyzUPJj 9C8twMzbjql9C/kRB bv3BY5XJlIXK9BZXqNcSq/o1hs4TjNMs=&e=0&fallback_url=https://secure.inndl.com/.../outlast.msi

http://www.towncyclesigns.com/c?x=bG8HXXAF9sIyF217ZVtxffAcEIvgMARXFAd0qpKMks4=&c=0suRepvLCL2GdiaZKiiZMOe4bxgpaXOVEd/cc3Ax1Y5je vDz2cMkzCCMVnORwoLYmAfvemZmXjgLcO90 enD4NZXO99Q1WMGxrY4xdxcMS7Z/F0LMDLpjAkcIZxq/Vwwc9W7gmxNzEfgqnHg4hhmdW2QTb0p5PFLhOr1vCSs6I=&e=0&fallback_url=https://secure.inndl.com/.../outlast.msi

http://www.repositoryuniversegift.com/c?x=dz3VDmmrntBni0LxxMrMAFiIgcZkCwWanBh3ngoq OA=&c=fjKpuTD9Jv379MJMV09mfe/3nDyG2ygMoBCE4Qnw7zPkMqjvRwkfROYOa6B4Tnnhh72DAeO SVVhoN8ToE2DGP7wwAVVddsxuqLAEb50ovG1q6OYT3kO8uh6ERSyBitKxAWhUTBHOOWJg9Y 8gh leIvCQgC9ZFiQIsurg5bN8=&e=0&fallback_url=https://secure.inndl.com/.../outlast.msi

http://www.conecptquickrepository.com/c?x= X8/SIKFSRZ3Ew7G43SCRSYk 58//MEhDEqmXi7dE9g=&c=xCPS9yNCffJzridvAb4o0iTesc2N8sb9/rMUC3OBydyyej3KsQrkErIvcdWIt/aAJZr/5GQLVBmb/iVvOOQXWoUFkz958nQLClYiSDtwX1n/dks2ddIawFqf01MNQXP9WEWEdd60rCKPx8q8tSKU5echdrU4UwsY18pjcsDjSTI=&e=0&fallback_url=https://secure.inndl.com/.../outlast.msi

http://www.conecptquickrepository.com/c?x=xZKDMmOBlxjm6u3Lob4Nuk91A/gnuV1dIYnRtGwIhgA=&c=IKc0Gp0c7tB iX0s/xr2svTZ5VpmqKqOKbZCIJB/IMaHO6YAmJ1hHUSLg6yqJVUrvOFd7A9U4UBg 8lWmjns3hNXcRHN tcCFa3huIfeh1xJVvJQm8IFqWhmBTAEsvUfullGb9FQx3MFFWyR6OAlYSAJ7QlE6upGCfPBCxGaQvI=&e=0&fallback_url=https://secure.inndl.com/.../outlast.msi

http://www.repositoryuniversegift.com/c?x=yGK21VWqWH 5rreig0JCXDgKfClUnCZt8HdtPX7a4jw=&c=c8k601EmzTaUiY4d4TdL4 gJFDdo/D4NGYr2n23CStNA4NueDS YD TcM5sOqM6ZDWm7EKSb6NivGwOjzFS4PJvNiCqp4ttKg08poN/VIu0ldiE0zh2lyJALBEUtoXlit35gCBhqzle/cJIU0wChRPs6AyWBBD3zZjFC7zBGWFI=&e=0&fallback_url=https://secure.inndl.com/.../outlast.msi

Remove outlast.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.