» photoscape-12505-dp.exe
Overview
Analysis
File Details
Downloads (12)

photoscape-12505-dp.exe

Hico

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application photoscape-12505-dp.exe, “Hico Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.

File name:

Publisher:

Nifalise (signed by Mode Beta (Fried Cookie Ltd))

Product:

Hico

Description:

Hico Setup

Version:

2.0.2.8

MD5:

6a09955bf907088a59626681436fb467

SHA-1:

d9dc3799313174e522a2d2d1a216e717442940ec

SHA-256:

7ced8e750ba39718ef2b440b5a4b36abe96f12a9f6f56a1aa34cdb610fd953b7

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

12/26/2024 1:04:38 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.FC.Installer (M)

16.3.19.4

File size:

1002.1 KB (1,026,152 bytes)

Product version:

1.8.5

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\downloads\photoscape-12505-dp.exe

Digital Signature

Signed by:

Mode Beta (Fried Cookie Ltd)

Authority:

GlobalSign nv-sa

Valid from:

12/16/2015 2:37:06 PM

Valid to:

7/7/2016 6:06:18 PM

Subject:

CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:DJ2D03P2/b9Gb7eDa+GrQws4NTGVCE48JbD7Vvs9VK42r:DcD0f2/bEJ+k5Op/bVvs9VKt

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file photoscape-12505-dp.exe has been seen being distributed by the following 12 URLs.

http://www.bitscentralgift.com/WVl6OTRQWEY1ZGpWRVQwNXBRblpxWVV4blNqVnNNalozUzI1UVNreFRaR055WnpacGRuZDJPV2t4ZUZscmVVRWxNMFFtWXoxTmMxQlVTMHBzY2s1V1VqZ3daREF6SlRKR1UwdGpKVEpDZFhaeWVIWmhUVE5ZVTJWa2MzZ2xNa1l5V1d4amNVa2xNa1pzV25aNVlUQktSVUoyWVRKWmQxWkVTRWcyVG1kV2FXOU1TM3BHVjB4d01rOVNVVEl5UVVWa1VGSkNTSHBQWW1semFVZExaamh6WTBzMFdrMGxNa0lsTWtKMFRXaDNialpHZGtwRGFDVXlSbGx0Y0dGdlN6VWxNa0pwVWxSdmVXdFZReVV5UmpGU05HOWlhM1ZvTmpaaGVYRTBlVkVsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptYzNSdmNtRm5aUzVrYjJKeVpYQnliMmR5WVcxNUxuQnNKVEptWjNKaFptbHJZU1V5WmxObGRIVndYMUJvYjNSdlUyTmhjR1ZUWlhSMWNGOVdNeTQzTG1WNFpTWmtiM2R1Ykc5aFpFRnpQVkJvYjNSdmMyTmhjR1V0TVRJMU1EVXRaSEF1WlhobA==

http://www.todayuniversebits.com/WVl6OTRQVnA2T0ZGNmExbEhkVnBNY21kYVVVbFJjbll5VTJ4emRWUnlabFo2V1ZBMlpuVlJSWEJvYkdwS1VsVWxNMFFtWXoxbGRrZFFKVEpHTlc5NGMxZE9TbU5IVjI1alYybDBhemhDUmxnbE1rSldiMnhSY1ZodmFXSnZhbkJaVFhKamRFeDVUM3B1ZDFGbVZESlVaVGQxTkU5T1dDVXlRbWhuV1ZoMFIwWnVhRXBRUlROeFRVZExkR1JCTjBsUFVtRXlTbWRHWmpCQlluaHFSRU5aTjJwa1JTVXlSa2d4VkU5UFFtSTFZWFUxUlVaQ05HZ3plRGgxYkZkNVUzSjFjeVV5UW5ORWRteE5XRTFpUkhNM05IUnpOV3RSSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm5OMGIzSmhaMlV1Wkc5aWNtVndjbTluY21GdGVTNXdiQ1V5Wm1keVlXWnBhMkVsTW1aVFpYUjFjRjlRYUc5MGIxTmpZWEJsVTJWMGRYQmZWak11Tnk1bGVHVW1aRzkzYm14dllXUkJjejFRYUc5MGIzTmpZWEJsTFRFeU5UQTFMV1J3TG1WNFpRPT0=

http://www.todayuniversebits.com/WVl6OTRQVmh4UVhoRmVHMGxNa1pLZVZOblRscExaU1V5Um5adU15VXlRbXBEVlZaRlkwZEpZblZYTVhOdVNrbFZKVEpDYURBMlNTVXpSQ1pqUFZjbE1rWXlaRVUxYWlVeVJqZG5OMloxZVdJd2JYWTBXbTA1Y25VeFoweE1ZbUpaV1RsaFJEaElORFp5UjNKalUyVnVUM0V5ZWpabFlUWk9WM0ZZYURoaWRqQTJlVmd6WkZZMmFpVXlSbm9sTWtKd1NGbHNXRVZ0T0NVeVJsUTRlVlEzYUZRMVMxcExTMEYwY2pkNlRXdE1SMEpIVDJnbE1rWWxNa1pOWTIxUGVDVXlRalJIZFV0QmVGVmpTbk5WZVVWUlNXMVZXbk41VGpjd2VHdDZXbkZyYjA1RWFuY2xNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5oSlRKbUpUSm1jM1J2Y21GblpTNWtiMkp5WlhCeWIyZHlZVzE1TG5Cc0pUSm1aM0poWm1scllTVXlabE5sZEhWd1gxQm9iM1J2VTJOaGNHVlRaWFIxY0Y5V015NDNMbVY0WlNaa2IzZHViRzloWkVGelBWQm9iM1J2YzJOaGNHVXRNVEkxTURVdFpIQXVaWGhs

http://www.todayuniversebits.com/WVl6OTRQVFZEVkZWWE5XaGpSRnBtVldGbGVFbEhiMGg0WW1KaWFETm1PVnBVVkRaa2JuWXllVGhGVVRrMVEwRWxNMFFtWXoxNFZsazVSbmQyTjJsdVNGTnJUVTVXYlRBNFpWTTJWa05ZZUZsVGF6UkJhRWR3VWxreFFuUWxNa1pRV21JMVRFVkxVREJESlRKR2NqSk1WRnB5VFhaTk5WY2xNa0kyZEZsUE9YazRKVEpHUlhkQ1JqTktiV2RQYzNjNWMyWmFZMlZCUzFoUWFsaFFZakUyVURGM1ltbFRSVUYwVWtrMU9HTTNiWGhuYWtzbE1rSWxNa1pDTUhOQlEwTkxOMVZwYkNVeVFrVWxNa0pvY3lVeVFqbFFkM0J2UVVadk5VaHJlVUVsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptYzNSdmNtRm5aUzVrYjJKeVpYQnliMmR5WVcxNUxuQnNKVEptWjNKaFptbHJZU1V5WmxObGRIVndYMUJvYjNSdlUyTmhjR1ZUWlhSMWNGOVdNeTQzTG1WNFpTWmtiM2R1Ykc5aFpFRnpQVkJvYjNSdmMyTmhjR1V0TVRJMU1EVXRaSEF1WlhobA==

http://www.grabtodayupdate.com/WVl6OTRQVWxhVXpOYVEzaDRZMVk1TnpaaWRWTlhiSFF5WW1OcVpVVlZRM1ZUVHlVeVFuSTVkRE5FY0ZwaWRFMU1XU1V6UkNaalBWWWxNa1lsTWtKcE5UVnBabWhNY2sxc2JUWWxNa0l5Y2xKVE5WZDVPQ1V5Um1rMWNUVmhlSGRIYTJOcFZ6ZGpOa3N4UTI1c09IVlBXblZhYmpkVWFWTXlabXczZW01MlEzWmpZV280VDFkRGJWQjBSRkZZTlVWM1UxWjFSVmRUSlRKR1pHbzRUWFpyY1ZsaVdUTkNKVEpHUld3bE1rWkpOMHREZW5ab1kxRjVUbEp2TlhGWFMyNUlSVEZsUkZoMlUwWnRTR2RGVlV4R1N6SjVWVmcxUlhacE5rbDNKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabk4wYjNKaFoyVXVaRzlpY21Wd2NtOW5jbUZ0ZVM1d2JDVXlabWR5WVdacGEyRWxNbVpUWlhSMWNGOVFhRzkwYjFOallYQmxVMlYwZFhCZlZqTXVOeTVsZUdVbVpHOTNibXh2WVdSQmN6MVFhRzkwYjNOallYQmxMVEV5TlRBMUxXUndMbVY0WlE9PQ==

http://www.todayuniversebits.com/WVl6OTRQVU5oVVRGQ1pVdDNlVEJTTVZWS2QxVlVWVWwxZG1abVRqZHdaRFZuVFc5RFNFRmxRMk4wUVVZMFNEUWxNMFFtWXoxbFRVNUpNRXBTWWtONGR5VXlSbWcxUlVnbE1rWkdZekJQVkZWNWFtSnNSMlJTY0V4MloySjVkRmgxWWtzME1sVXhZVU5hTkdrMWNVWTJaVzF2YlRkU05qTktia1JUU21SR2VUSkxOR2xWUzA5bFJGQmhRMVpCVm1Sc1ExUklWVGhUUW5CTVpYWndZbTlwU1RSbmJ6WlBaalI1TlVOb2VpVXlRbk0yWVhodGMzUnZWVGtsTWtaQ2RYbGlXV1puYTFWdGNGa2xNa1p2VFhsbFV6Um5TREpCSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm5OMGIzSmhaMlV1Wkc5aWNtVndjbTluY21GdGVTNXdiQ1V5Wm1keVlXWnBhMkVsTW1aVFpYUjFjRjlRYUc5MGIxTmpZWEJsVTJWMGRYQmZWak11Tnk1bGVHVW1aRzkzYm14dllXUkJjejFRYUc5MGIzTmpZWEJsTFRFeU5UQTFMV1J3TG1WNFpRPT0=

http://www.worldsignbits.com/WVl6OTRQVEZxTkRReFoyTTRSR2xFWTFnbE1rSlZVWGw2Y1VNelNIbFZZV2RZSlRKR1JXc3djR3B5V21SWE5VUmFRekJWSlRORUptTTlSMVpzTVZZd1oydHRSbFJoY0hCa1dYbHdkRU5PTmpSelEybHdTa1prVG10a05VNWFaMjVrYmpCbWR6ZDBZamxKWjJoa2VXcDVTSFJhZVNVeVFtcHZkVGhNUzFaVVN6SmpTWGt3ZG1SVVVHVnhWekphUzBsamFtNTZTRWxqU1VodVozUlhRMGROY0c5V1dERnRlbFZYVHpBbE1rSmhNR2MzUnlVeVFrRTJZVTVzZFVKM1FYWmtRMGxMUkRabGJrSlpiMFZUUW5GWlJXVTRlWFJuSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm5OMGIzSmhaMlV1Wkc5aWNtVndjbTluY21GdGVTNXdiQ1V5Wm1keVlXWnBhMkVsTW1aVFpYUjFjRjlRYUc5MGIxTmpZWEJsVTJWMGRYQmZWak11Tnk1bGVHVW1aRzkzYm14dllXUkJjejFRYUc5MGIzTmpZWEJsTFRFeU5UQTFMV1J3TG1WNFpRPT0=

http://www.binarieshostingtours.com/WVl6OTRQVWNsTWtJNEpUSkdXbUZXZDNkTVkzUXhVbko0VURoNFMySnNVelp4U1dFeGJWcGtNa1pySlRKQ05tUnBPRkJRVG5jbE0wUW1ZejFqYTFkWlMxQkNXRFF6VURGblNGQmhiR2syVldkbVdUQXdZbU52VVc5WVEyRnlja3gwWldSMFdVMUhSbTlSYzNSMmJsWllTME40VDBKb2JUWlNNblIwT0hCV05WWXhkMjFYSlRKQ1pteHRVeVV5UWpnMFZVaFVlRWRSYTJOMmRYY2xNa1lsTWtaWEpUSkdXbmRRYUZkcVVqRnNNblZhZFRGNFVqUk9PRFpZV1hFbE1rSm5WVlZRTVV4cmIwVkxjSEJSVVhwWVpsZEdXV1pwVmt0V2IyaEVORUVsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptYzNSdmNtRm5aUzVrYjJKeVpYQnliMmR5WVcxNUxuQnNKVEptWjNKaFptbHJZU1V5WmxObGRIVndYMUJvYjNSdlUyTmhjR1ZUWlhSMWNGOVdNeTQzTG1WNFpTWmtiM2R1Ykc5aFpFRnpQVkJvYjNSdmMyTmhjR1V0TVRJMU1EVXRaSEF1WlhobA==

http://www.grabtodayupdate.com/WVl6OTRQVGxxZFhsQ2FXNURhWEJpTm14VFkwTm5jek5WZDNOdmFUWkZjRXQwZW5ab1luazFZVWhsWjFGSU1Xc2xNMFFtWXoxVGEyTllWelZJTlRWUU1FZHRRVE5TTTJaYVYyRllWMHhHTkhOS2MwcHBkRmhhY1RoT04wUm1RMGxxTldOMk5EaDZVVkYwV0VSbFZHOVZOMFp0VEVoWlZsZFJNWFE1YmxGdFZIVnlVMGQ2Ym1rM2NHNTFSRFJJY0RGQ2NsbFlNRWMxVEVWd01HSm1iRnB4WTIwNGFHYzVjeVV5Um5aUmRtTk1URlphY0VzM2REUlROV2xJVDI1R0pUSkNXVFpKU25aaWJHOVBPVWxxTjJKM0pUTkVKVE5FSm1VOU1DWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpZU1V5WmlVeVpuTjBiM0poWjJVdVpHOWljbVZ3Y205bmNtRnRlUzV3YkNVeVptZHlZV1pwYTJFbE1tWlRaWFIxY0Y5UWFHOTBiMU5qWVhCbFUyVjBkWEJmVmpNdU55NWxlR1VtWkc5M2JteHZZV1JCY3oxUWFHOTBiM05qWVhCbExURXlOVEExTFdSd0xtVjRaUT09

http://www.todayuniversebits.com/WVl6OTRQV05xV1RWS1FXeEdXVlIzZW1GcFFUbDJTR042ZWpWelkxTjRNa1ZtZVV0elJGWTFibkZVTm1aYVVsa2xNMFFtWXoxVVpYbEZObWRxU1ROcFVpVXlSaklsTWtKTFZDVXlRamRZTlcxd1VsQnNPRVJ4ZG10VmFWWm5WMFJvY2t0SFRDVXlRa1ZHY1Vnd1JEQlpPVGR1UlhWc1FWSjBZak5MWkdwekpUSkNhM1pUTTBWVVF6STVSVkoyVEVOcFJFeGxNU1V5UW5ad2VYcGxSMnBTVFZZMk1qVlZlalZpYm1kYU1VOTJlR1F6UXpodGMxaExXSFZMWm1ZelJpVXlSa0pYY25OUFZVUktlbFYyUmxCMlFVSkhRa1p6ZUhac2R5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWnpkRzl5WVdkbExtUnZZbkpsY0hKdlozSmhiWGt1Y0d3bE1tWm5jbUZtYVd0aEpUSm1VMlYwZFhCZlVHaHZkRzlUWTJGd1pWTmxkSFZ3WDFZekxqY3VaWGhsSm1SdmQyNXNiMkZrUVhNOVVHaHZkRzl6WTJGd1pTMHhNalV3TlMxa2NDNWxlR1U9

http://www.binarieshostingtours.com/WVl6OTRQV0l4ZG5VME9HSmlOR0ZoWlV0cVJUQjFXa2gwTlZwVFZHVWxNa1pUUWpsSVFpVXlSamMxTVRJbE1rSk5TVzl4V0hjbE0wUW1ZejB6ZG5kVVZEWWxNa1kyYlZCVmVXaDBTM1FsTWtaT2VtbGhVVzQyUjI1RVp5VXlRblpYTkRScEpUSkNia1JzZGpkblZGbEljVXhLUVdRbE1rSnRTbTlLSlRKQ0pUSkdlVGhsTkVsYWRURlBPVXRsVmtSSlNsSkJXbFJNV2xkcWJtcE9SaVV5UW1wbVdsbDVPVGh4VkZwVGREVm5TV3A2VlVNM1UyVm9SRWczVmpKMWMyVklKVEpDYmpKNlYwbE9VeVV5UW5seVMxSjBOWFZ3UkRBbE1rSk1OamREUmxCemVrWnFjak5uSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm5OMGIzSmhaMlV1Wkc5aWNtVndjbTluY21GdGVTNXdiQ1V5Wm1keVlXWnBhMkVsTW1aVFpYUjFjRjlRYUc5MGIxTmpZWEJsVTJWMGRYQmZWak11Tnk1bGVHVW1aRzkzYm14dllXUkJjejFRYUc5MGIzTmpZWEJsTFRFeU5UQTFMV1J3TG1WNFpRPT0=

http://www.bitscentralgift.com/WVl6OTRQVkpSUlhabE5IZElNMk5FTjA5NVEwdzFRbU5UVmpadVdEaDJVbTE2WjNWMmNWZHRhM2RTT0dGUU4wRWxNMFFtWXowMGNGWm1TVlJzTm1kUVRIWnBWa05rY21jMlUwUnRjVkZ2V25aU1ZFeHVKVEpHVDBacVkwbFRkWE51VFZKNVZDVXlRazVQVkUxUmJUUkhNbGRTWmpKWWMwNXhNV3NsTWtKaFNuUkZKVEpDV25SWFMySkZhR3RzY0RrNU4zSm9ZMnBPYUVVeFptVkVlREJNTVZCa01saE5lSGxYVjNFbE1rWjJXRU5KY1U5UE0waElSSGt6SlRKR2NVUTJjbGdsTWtZMFFtcE9hRWxFSlRKR1YwMXRaM2hGSlRKR05FbFZhSGNsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptYzNSdmNtRm5aUzVrYjJKeVpYQnliMmR5WVcxNUxuQnNKVEptWjNKaFptbHJZU1V5WmxObGRIVndYMUJvYjNSdlUyTmhjR1ZUWlhSMWNGOVdNeTQzTG1WNFpTWmtiM2R1Ykc5aFpFRnpQVkJvYjNSdmMyTmhjR1V0TVRJMU1EVXRaSEF1WlhobA==

Remove photoscape-12505-dp.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.