home

outlast.exe

Des

PlatformPrompt (Alpha Criteria Ltd.)

The application outlast.exe, “Des Setup ” by PlatformPrompt (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.giftchuckleflash.com and multiple other hosts.
Publisher:
Dogosifuso   (signed by PlatformPrompt (Alpha Criteria Ltd.))

Product:
Des

Description:
Des Setup

Version:
2.6.5.0

MD5:
f7a37c0df08f21da0609a71f737efb7c

SHA-1:
ba7dcadbfe67ddc2a2eafb8383f96872d2b2c53e

SHA-256:
5272785e039133086ac035bc9db91fb91b675efdb3aa1bd79ab1e23a9290e03b

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
12/25/2024 1:25:30 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC (M)
16.8.11.3

File size:
952 KB (974,848 bytes)

Product version:
3.4.8

Copyright:
Stub Web

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\outlast.exe

Digital Signature
Signed by:
PlatformPrompt (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 12:17:26 PM

Valid to:
9/2/2016 12:02:46 PM

Subject:
CN=PlatformPrompt (Alpha Criteria Ltd.), O=PlatformPrompt (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112111817CD313A533F2A76178D4452F81A6

File PE Metadata
Compilation timestamp:
6/19/1992 11:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:37vDPwUFhDqNzcU16jVXw4VXNLnMXugux2TrhbIC:3jzwUFJqpKpVxnMXvq2TdbIC

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file outlast.exe has been seen being distributed by the following 2 URLs.

http://www.giftchuckleflash.com/Dma7qrzyV0aTNvutGa85u ylT1C7UBWrv 0PfHfP0gvyYqhhuM9PHvS00zB7xiLprsHcFfrQ1aws5gb6U9j72LWyvtaNu2pmP8iabNVaS6JUr4MgFEqS4k 9nEr2crY22KqKPJKU5GrYK7 c8rENF14xJ0B afZwqaiTTOJNYKiNgdCFsQ7hZJwcjqTUK0VXZip2A ZEQuAad_uWA_Mo8AIN fl5wlmyu39RjbaapyvQz4nOXZ1na_BHIHEN02qt0uZ3t3QzV7r_rnHnqISu79b9fikKTltsBNwAM5Sd3veTxD1UhPjuTxjgS4f5smqei2Jcz6_fj9jdKcyxDEp5LDnDzSgfqJI1DsYR5vB2l5CRM2RCrd30RmeO31QpU2wmT2P lv_KROYkV9nkgfTHyMdGFSFy6iXKak9EVyp0ohqc2OxFpEBKUEBYQ2kZRMf2vxrKSholSLRB5VYfLvYbwR4GpDKyn KGCbeuBIcqE6pnaCdoUTaCl_m5mfU7uoGTvg5LEy6ZY8M5DLwWC6X6tAPK8EI5tdETtGns1JDs56TmeJyHUos=-G04AAGRgnq0tSqrUCRtw4BJRgA1od6ZtH fP514C_ILLeV79XpQig67vR UJHu9Fen8EuGnLz7HO9VSZf_iOfUsJEgUYBASnYJqgaBIG-e

http://www.giftchuckleflash.com/KjeOul_Da63WxfZXfAxR2zPAxh e_x4tcqpQuLOW1u4WiL9mHqz1wL86oxULCIHaP7sPhh7PT1HayF3LRB A5yd05UEkVEwDJMB4AFd5864QbZWLaThFgNrtyVuddPcyuFoDJnN4ZSiUpGQJhmCCZSiKOmxf9wNTcyXic53COYZfcP_CNAW5NaM iYP3hybKMSWUu5q3_ANqQRVE5Dk0GbEEBv96A9AOoat272n7UrMvB8MytSBoyjmBeGoKA48y8ii5SSxgxdTRVomAWgxQOYjm7qHZHl5G1hUYJwnNo5pttgFWeaoPBvaNxVuJDTKaS xbi0bK2zna2t9ewBdDKre6ZtrPO_vqxczoeaMSJdjRZq0rySCAQtsJNTCbB2vCfb97cMsMjHVjKZYZzBQXdzHd3HIwA7xPhl1Bolfv5Tj84qoNjvVX4ofsP wrLFk2hNy7tMiDhG_vHr4M0iAUVX7_Y3NIaAXGIlD9uJedHo2SFLfJUqMBR6hEwhgMxcqDDqczhn72 8m7kxXhvE6ccNVAmYQzjg==-G04AAGRgnq0tAmhEAnDABhy4BBTggA9IwwYccFjDGZ7nuAT6Bcdt25tlUUUBtL9Pyglc71G6H4Ew_rm qY63G5hLrUSUBfbgAa2A4BRMQYwB

Remove outlast.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.