» producer-for-powerpoint-11667-dp.exe
Overview
Analysis
File Details
Downloads (10)

producer-for-powerpoint-11667-dp.exe

Rukimakin

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application producer-for-powerpoint-11667-dp.exe, “Rukimakin Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.

File name:

Publisher:

Mode Beta (Fried Cookie Ltd) (signed and verified)

Product:

Rukimakin

Description:

Rukimakin Setup

Version:

3.7.4.5

MD5:

41ff110df86deddffdb4b258aa3143ec

SHA-1:

89d2e24b4727998f953117e37c4ebd4c8566be96

SHA-256:

6e958afb5ee2e8eed0d81f1ec3400ad6d2de97be458f4c863cf5137f9c2bef08

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

11/1/2024 4:25:05 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.FC.Installer (M)

16.6.9.16

File size:

960.6 KB (983,624 bytes)

Product version:

1.2.5

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\downloads\producer-for-powerpoint-11667-dp.exe

Digital Signature

Signed by:

Mode Beta (Fried Cookie Ltd)

Authority:

GlobalSign nv-sa

Valid from:

12/16/2015 2:37:06 PM

Valid to:

7/7/2016 6:06:18 PM

Subject:

CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:KCi46vIpWeGEvHstSIgFnM2MXLk03/hNcQQicg6pxiEW8:KrrwwXEvHstlgJM7k8DNcggxC8

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file producer-for-powerpoint-11667-dp.exe has been seen being distributed by the following 10 URLs.

http://www.bundleflashapps.com/WVl6OTRQVlpYZEdGU1RDVXlRamRMWldWc04yVjFXRnBuTjBRbE1rSnFaMWg2V2pkRGQyWkdZMkphWnpOVVMwOUJjRTgwSlRORUptTTlhR2RHVDFOTFpGVTBOSEpvY0ROclZqVlZjM294UXpsNE5sZE1iRE1sTWtKMFUzcDBPR1JSVEZKa1VuSndUM1pQZGsxb2MzUmxhREI0ZFhKYWRrRlViWFE1YVc1VFQwczJOek50V1hsRFJqQTJaWEZHUVhKNFdIZDBPVzgxVms0NGFGaDRPRVJ0TVVKWlVVZFNTRlJ0WTJablYwc3hTbEZuUzJSTWJXWm1jV04yWTI5RVRqZGhlU1V5UWxFbE1rSnBhM1JRUVhCdlYxQllKVEpDVFhjbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbWMzUnZjbUZuWlM1a2IySnlaWEJ5YjJkeVlXMTVMbkJzSlRKbVpHOWtZWFJyYVNVeVptMXBZM0p2YzI5bWRIQnliMlIxWTJWeUxtMXphU1prYjNkdWJHOWhaRUZ6UFZCeWIyUjFZMlZ5TFdadmNpMVFiM2RsY2xCdmFXNTBMVEV4TmpZM0xXUndMbVY0WlE9PQ==

http://www.todaymetabundle.com/WVl6OTRQVXg0TkVGaFdqaHRhMk5GVjNSM2NEWk1VVE0zSlRKR1ZFeGFVVGRLVWpSbFNtUlNRV2xCV25oMVIwd3dPQ1V6UkNaalBTVXlSa1puUzBoS2RHTkpSVTVCZURRMlpFOWxVR2hWT1c1T1IyUjZSRWRaWW1KR1JtNWhOVk53TlVkUE16SXdTVVJ2WVdKR1pGbERhbkZoSlRKQ2MwVWxNa1pGZGpCdU9GRlhjWE5WTURSU1YweE5WVzB5UWtoRU4zaFdSMGR6U0hwcU5EZDZiVGd6U25oUVFTVXlRa3BYVUU1MmNYWkdWa0ZtVjFwTVNXOHlhVEJrY1VoaVozbHdTV0pPUzFocE5qZENkREF3UjNOQ1kxbG9jR2xCSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm5OMGIzSmhaMlV1Wkc5aWNtVndjbTluY21GdGVTNXdiQ1V5Wm1SdlpHRjBhMmtsTW1adGFXTnliM052Wm5Sd2NtOWtkV05sY2k1dGMya21aRzkzYm14dllXUkJjejFRY205a2RXTmxjaTFtYjNJdFVHOTNaWEpRYjJsdWRDMHhNVFkyTnkxa2NDNWxlR1U9

http://www.grabappsdownloads.com/WVl6OTRQVlpSV2tOdVRWcGlPVTloY3pSbFJuaGliSGdsTWtZeFl6Qk5SR1ZpWkROWVdXaExaMFJ1UTJkaGJtOVZkeVV6UkNaalBVVlVNV2xoY1ZGSVdrNUNNMUVsTWtKV2MzZGlVMUU1YW5WT1lWbHRlRkJwVGtsbldHdExlalZTUkhWamNHZzVVRGN5ZVZWVldVZHNkWGxGYVc4bE1rWldjbVEwT1d0RUpUSkNWMHgxZVc4elFVNXljbVUyUzJWWGNVNXJhVVJDV1VSeGJXRjZNVXMzVVZGT0pUSkNZbWhHVEZSMFlteEZSVUkyU2tsTmRIQTNWa1JHZGpOeWNUZHNVM0JIY25oS2VVVldaR051TmtSTVp6VlNSbGgzSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm5OMGIzSmhaMlV1Wkc5aWNtVndjbTluY21GdGVTNXdiQ1V5Wm1SdlpHRjBhMmtsTW1adGFXTnliM052Wm5Sd2NtOWtkV05sY2k1dGMya21aRzkzYm14dllXUkJjejFRY205a2RXTmxjaTFtYjNJdFVHOTNaWEpRYjJsdWRDMHhNVFkyTnkxa2NDNWxlR1U9

http://www.bundleflashapps.com/WVl6OTRQWGd3TkdNNGR6SnplVFY1YVVRNFoyNVlhbU40ZDJOcmNtUnBXakZQWVhsS2IweHhUamRoUW5RNU1UZ2xNMFFtWXoxYWFUSnZlVUpJUVRSVFYwWkdabFJpUVZkeU5VSXlkR0ZhYVZKTFQyaFlhMkY2YTNGaE9UZGtOa3AzYzI1Q1ZVSnlSak5NVFhneVRIZHFRMGsyTkNVeVFrUk1NelZoTTFNM1lteFlUblJuVkRFNVJYcEZhRmd3ZWtSWFozZHpVMEUxUWxFNGJqTm1VREJGWW5SS1REaE9SSGxwTW5SSk9EWmlPR0pRYUhsdFRrNUVNVTFFYkUxMmVuWlNOMlF6Y2tWdmRVbEhabUpVVVNVelJDVXpSQ1psUFRBbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0yRWxNbVlsTW1aemRHOXlZV2RsTG1SdlluSmxjSEp2WjNKaGJYa3VjR3dsTW1aa2IyUmhkR3RwSlRKbWJXbGpjbTl6YjJaMGNISnZaSFZqWlhJdWJYTnBKbVJ2ZDI1c2IyRmtRWE05VUhKdlpIVmpaWEl0Wm05eUxWQnZkMlZ5VUc5cGJuUXRNVEUyTmpjdFpIQXVaWGhs

http://www.funsignssend.com/WVl6OTRQWE13SlRKR1ZYZ3pWMGxKTUhKRWJDVXlRbkp0ZDFGa1drWm5XakZHUWxacGVuVjNObnBKSlRKQ2NXbzJaR0ZHVG1zbE0wUW1ZejE0ZWtSR1Z6ZFFha2xrTTFaclNXWkdNMWRsZURSb2FXRmFOMlZJZGlVeVFqSm9NMjlwWlRkRU9GVmhVMncwU25waVdISnFOMjFvZFRjeWRraExNbTlQSlRKQ09IZFBWMHMyWWs1VFFVTmFlbk5JV1hOdmNYWmphRkZSWlV4SldYQklNeVV5UWpsRGVUZFNOaVV5Um1aQmIwbEJkR2hNTW1sRllreFJjbXhXTUhGNlZGQnNWbTRsTWtaVVUzaHNTR3g2V0ZjMGQwdEJjbXhHUWtzMVduVlJKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabk4wYjNKaFoyVXVaRzlpY21Wd2NtOW5jbUZ0ZVM1d2JDVXlabVJ2WkdGMGEya2xNbVp0YVdOeWIzTnZablJ3Y205a2RXTmxjaTV0YzJrbVpHOTNibXh2WVdSQmN6MVFjbTlrZFdObGNpMW1iM0l0VUc5M1pYSlFiMmx1ZEMweE1UWTJOeTFrY0M1bGVHVT0=

http://www.presentheartapplication.com/WVl6OTRQVGxaWlV4eGFIUkhjMkZWVHpoRFpYRktlSGM1TTA0bE1rWTBObE5RYUhBeVZEVTJjRWxvUmpaTFIyWnZVU1V6UkNaalBXNDNhSEpuUlRnbE1rSkNUMEZGWWxORU1IQnVhbmRKUjNaS01UbE5Xbk5rUTFOeWRtbGFaRkF3U1ZKYVpXNUZRbUpKVEhOUVdHaHFjVmN4Y1c1ak1ITXhOVkpHU1dVMVNtUnpWRXB2UldnemRXbFVNa3BZYm5STFpHTmlPRkExYTNoM2JGWlRZMkpzY200eVZ6ZFBKVEpHYmsxNWJGRjZUVWh6YWtKU1JDVXlRa3hDZVVGRUpUSkdSMnhZYTFSbVZUbGxKVEpDTlVGekpUSkdOR1ozTjJWTlp5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWnpkRzl5WVdkbExtUnZZbkpsY0hKdlozSmhiWGt1Y0d3bE1tWmtiMlJoZEd0cEpUSm1iV2xqY205emIyWjBjSEp2WkhWalpYSXViWE5wSm1SdmQyNXNiMkZrUVhNOVVISnZaSFZqWlhJdFptOXlMVkJ2ZDJWeVVHOXBiblF0TVRFMk5qY3RaSEF1WlhobA==

http://www.todaymetabundle.com/WVl6OTRQVGxXZWs5d1kzaFBTMFpVWlc1VlIwbDRaR2RLWjJsSlJFWnFOVGtsTWtaamFYbzNaVkJTUmt4d1ozbFBWU1V6UkNaalBVZFNVRXRUVWs1eWFtbGtZM0pNVW5CWlFsaFFTMW81T1ZoaE55VXlSamh3TkhOcWFXWkhlRmh0Vlc5NlZXSlZUMlZHY1V3Mk0wbEhRalZYV1VOSVprNU1lWEJrUkRaSk0wRmFjSEUxSlRKR1EwWm9UbTlZVG1WbVQwSlBZU1V5UmxKbGVFWm1WRlZvYUhKbE1VRjRiRXh6ZUZodWRqTmlWU1V5Um1OVE1FWkxNRUpuYUU1RlYyWkhSSGxLTlUwMFUzUkhZV1Z5T1hSVVNVMXJja2wzSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm5OMGIzSmhaMlV1Wkc5aWNtVndjbTluY21GdGVTNXdiQ1V5Wm1SdlpHRjBhMmtsTW1adGFXTnliM052Wm5Sd2NtOWtkV05sY2k1dGMya21aRzkzYm14dllXUkJjejFRY205a2RXTmxjaTFtYjNJdFVHOTNaWEpRYjJsdWRDMHhNVFkyTnkxa2NDNWxlR1U9

http://www.contentdownloadmega.com/WVl6OTRQWHBwSlRKR2EyWlhjbmxLU1RWMmExZ3lhRVEwUkhkWVNFTlVWbTFKYW5SNlUweFRVVmhaZW01WlVrVTFOQ1V6UkNaalBYaE1jbXdsTWtKSmNUbHNkRVk1ZWpCdUpUSkdiREIwZFVaMWJHNXNhalptTm1OVE1UTXpkVmxSVEhOM1NYTk9jVkU0UzJnM2FYSldjRkV6Y1ZCUGFVcFhOM2xrTjNKcVVVTmhlSFJWYVVWeGNUTkhVRXRsVmtoblVITmpPSEU0TVRCS2FVSnJVREpZVFdsUE9VOTVWM013UWpJeFkwWllWR0ZYTjFwc2IxUlVPR0ZZYURFbE1rWklkbmtsTWtKb1luSldWR0pGVjB4RUpUSkNiR1ZWSlRKR1FTVXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWnpkRzl5WVdkbExtUnZZbkpsY0hKdlozSmhiWGt1Y0d3bE1tWmtiMlJoZEd0cEpUSm1iV2xqY205emIyWjBjSEp2WkhWalpYSXViWE5wSm1SdmQyNXNiMkZrUVhNOVVISnZaSFZqWlhJdFptOXlMVkJ2ZDJWeVVHOXBiblF0TVRFMk5qY3RaSEF1WlhobA==

http://www.grabappsdownloads.com/WVl6OTRQVmxYVDBsRVlqTTVPVFZYYzI1M1dIUnBORXhqYVZSS1UzWjFKVEpHWjNCS2IxWjNaV280VWpaNk5UUm1WU1V6UkNaalBVaE9hVzlMYWpZNWFtRmhUM0JWTW1SNFRsRnhSSFIzYlhwaVRERmlkbFJZZFU5NVNrRlVOV1pOTkhjNWJWUkhValZ4VXpoNmNURjJjWEZzVWtsTVVVWTJhRGxuZVhVMFYzTndTR3hDSlRKR1EyVjNTMnBIUW5VNE16bDNiMUpHTUVSUVdWa3lWRmtsTWtKS2EyWjZPRFV3SlRKQ1NrdFJhSGhHU2tGbVlYQk9ZbEUyT1ZoUGMwaG5aSFJsZFhjeVZrcHVUMHRVVjNRNWFIb3lRU1V6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVp6ZEc5eVlXZGxMbVJ2WW5KbGNISnZaM0poYlhrdWNHd2xNbVprYjJSaGRHdHBKVEptYldsamNtOXpiMlowY0hKdlpIVmpaWEl1YlhOcEptUnZkMjVzYjJGa1FYTTlVSEp2WkhWalpYSXRabTl5TFZCdmQyVnlVRzlwYm5RdE1URTJOamN0WkhBdVpYaGw=

http://www.tagtowerscapital.com/WVl6OTRQV0Z3VEhKd1JFVnBTbGRHUjNNd2IyTlJhMFZ6SlRKR1RXOTFlaVV5Umt0ak0yMXJUakI0VVd0dU5XcHpOa2x2SlRORUptTTlWSFZPYjJWUlRqUkZSVFZRWlZSM1pWTlVXazVXVFROTWJURktVSGhWVkVOa04zVldabTgxUmxOQ2RpVXlSa0pLWld4VFVuVTVRbXB4Tm5CaVRWSk9jV3hVY2xrM1JFSmljRVJoZERsd05sVjJWMlJUSlRKQ2VYZ3diVk5DVTFrMFVUSjJUVE41TmxKSE4zb3lZV00yYkhjNVZIWjRRbWxSV1VodlUxQkNWMHBJVkU4NGRrTllVM2R4WldGSmNGTmxla2x3TVVWdFMxUjVRU1V6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVp6ZEc5eVlXZGxMbVJ2WW5KbGNISnZaM0poYlhrdWNHd2xNbVprYjJSaGRHdHBKVEptYldsamNtOXpiMlowY0hKdlpIVmpaWEl1YlhOcEptUnZkMjVzYjJGa1FYTTlVSEp2WkhWalpYSXRabTl5TFZCdmQyVnlVRzlwYm5RdE1URTJOamN0WkhBdVpYaGw=

Remove producer-for-powerpoint-11667-dp.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.