home

roblox.exe

Tipo

SetupSpeedy (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application roblox.exe, “Tipo Setup ” by SetupSpeedy (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Pabete   (signed by SetupSpeedy (Fried Cookie Ltd))

Product:
Tipo

Description:
Tipo Setup

Version:
3.7.1.5

MD5:
c0a5d1a5957672b9ec57b32836a4b3bd

SHA-1:
a7a0e30acb026dd585bf56c3a2e9e4384d77c9c7

SHA-256:
c8801c18f071d0598e1b0db6b80c204a8acbb094136cc918e519b576aa340a15

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/23/2024 2:41:26 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.4.14.16

File size:
952.6 KB (975,504 bytes)

Product version:
5.0

Copyright:
Lite Stub

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\roblox.exe

Digital Signature
Signed by:
SetupSpeedy (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 7:09:36 AM

Valid to:
6/8/2016 10:12:50 AM

Subject:
CN=SetupSpeedy (Fried Cookie Ltd), O=SetupSpeedy (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121EF8B655959B1CFE34F05FAFC8D598305

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:nAWFaX8929zr/aKGFkrkiWHdjogCH2kebsIusDXozq3mMX:nJ0XR9JEak1y2jbs+VW6

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9307

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file roblox.exe has been seen being distributed by the following 9 URLs.

http://www.quicktowndl.com/WVl6OTRQVGdsTWtaSlVuUnlTMlJPUTFKc1JraHNkVEkwYWtoUE1qazNjR1ZzVmxwRVFsWkZVbmx2WTBGM1JHdDROQ1V6UkNaalBWRlhKVEpDUzJNelZIaFJWRTF1WlRWclptSnFUMVppVkhCMFJreHJZWG9sTWtKTFMxSlhUbEpDZGxSUU1rTkZNek5KUlZSYWJXSktVRTl0TkZjbE1rSlhVVUZUUjBJNE1EUkpNMHR4YUZONmJuVk5iRmhOY25kR1ZETkZhMVZyUWtSek0wVnRjSEJyY0dOME5XdzVSbTlMYVVWa1dFZzNOVXhuVVVsVWQzY3lKVEpHYVZSMlMyNGxNa1l5U0hSSVdtcDBibVI1ZUZOVmJYSTFSa2RhSlRKR1VTVXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQnpKVE5CSlRKR0pUSkdjMlZqZFhKbExtbHVibVJzTG1OdmJTVXlSbFZUSlRKR2NtOWliRzk0TG1WNFpTVXpSbk4wSlRORWJtTklUbGs0VTFkNE1FWkRXbVI1WkZwbU9UVnVkeVV5Tm1VbE0wUXhORFl4T1RNME1EZzFKbVJ2ZDI1c2IyRmtRWE05Y205aWJHOTRMbVY0WlE9PQ==

http://www.conecptquickrepository.com/WVl6OTRQVk5LTUVoT1RIVlFTR293ZFZNeEpUSkNhbGRUU0hkTk9WUmxhM1o1UjBSUVEzWm9KVEpHVjNabEpUSkNUR0ZxZUVFbE0wUW1ZejFYUWtacEpUSkNXazAyT1ZwUFltMHdZbVkxVFRKbWJUSktWWHB4Vm5kbloxSkNVRWRwWmtkS0pUSkdNREJLUm1RbE1rSndTakJOV1Zsb2FtbG9lbmNsTWtKTGJtcDFVV2RNWVVKd1IzY2xNa1oyVDJaS1JuVnJlRmc0WmpNbE1rSjVaM1ZZTlhWVVkydFdTRGRhVWt0dWEzcDBkV05sY0hNNVFtSnJiVkpYY1VKbEpUSkNKVEpHV1RCYWIxUkVUelJpWTIxeFJIRkpSRGw2VFRSV1VFOXJkbVZMUkRGM0pUTkVKVE5FSm1VOU1DWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNITWxNMEVsTWtZbE1rWnpaV04xY21VdWFXNXVaR3d1WTI5dEpUSkdWVk1sTWtaeWIySnNiM2d1WlhobEpUTkdjM1FsTTBSV2FYSmtiV3hFVkZGMmVtVk9NVGRhYURVNGVXSjNKVEkyWlNVelJERTBOakEzTWpVNE16QW1aRzkzYm14dllXUkJjejF5YjJKc2IzZ3VaWGhs

http://www.quicktowndl.com/WVl6OTRQVEJEUzJ0M05WZDJkVmRPYjBkc1NGSXdTR3hFWmtacE5rNWxkRmRWU1dkSlVsQXdaWFJTWWxsM1ZHTWxNMFFtWXoxU1dVeHlUWEpDZVVNMGFsaE5NRlZ0UmpSRWMyd3lWMVYzYzNoV2VsWmpkVWxIWmtOcmNtYzBVRmxGUmxSTVQwVTRkV3BVWjNsV1RUQkVaSFZRYWxjbE1rWkZRMVpFTURGNGNqQXdWVTVVYkZKM04xVTFNVzVrT1RWU05qbDVUbmwzUWtKdU1tbENTbGxVUTNrM1RsTlVaR1pzVkVoNlJHOVFaRzh6YldoWWVqWkVVemh6T0hCYWVqSTRVMkoyZHpoQ1EzaDZSek01VVNVelJDVXpSQ1psUFRBbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhCekpUTkJKVEpHSlRKR2MyVmpkWEpsTG1sdWJtUnNMbU52YlNVeVJsVlRKVEpHY205aWJHOTRMbVY0WlNVelJuTjBKVE5FTWtWcGEwTlNVVXRsWjNOeGIxcFlaMTlCTmxaelFTVXlObVVsTTBReE5EWXhPRFUzT0RjMUptUnZkMjVzYjJGa1FYTTljbTlpYkc5NExtVjRaUT09

http://www.repositoryuniversegift.com/WVl6OTRQVTRsTWtadlZIWlNTVXhzTkhaaVVHbDNSa2RESlRKQ1pYRllZa0o2UTFjeE9VWkZiemhCVUdwTVdqVnJiV3R6SlRORUptTTlPV3QyTnpGMlUyTnlhRXBSYVdaNWRYQXpibXNsTWtKdFpWUTJiMFJVVHlVeVFtVkVaMkZoUzFaMVNIbG9jRUY2ZWt3M09YVlRSR1F4YmtGUU1tTmtla3BtYlVFeE9YRkZXR0ZwTUdwUmNWWWxNa0oyWlZRMFVFTnBibUpxVVhsRUpUSkNZM1ppVlV3MWVtcE9iVmhzVGxsemVGVjRXVk5aUVhsUk5HWXpOblV5YTNkUlREQkthbmc0UmxSc1RXOUxhMkpZVWt0amR6RktOMXBZY0ZFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd2N5VXpRU1V5UmlVeVJuTmxZM1Z5WlM1cGJtNWtiQzVqYjIwbE1rWlZVeVV5Um5KdllteHZlQzVsZUdVbE0wWnpkQ1V6UkVGdU1ESmFPVTVpUWtoeFZYYzVXRGgwUkVSeFIwRWxNalpsSlRORU1UUTJNRFl4TXpneU5pWmtiM2R1Ykc5aFpFRnpQWEp2WW14dmVDNWxlR1U9

http://www.quicktowndl.com/WVl6OTRQVU5hVW1oeWNVbzJkalZPVVVsNWMzVndRemg1U0VoM1QwYzFlV3QxVUZOUGRuUm5VWGRaVWxSU1VtOGxNMFFtWXoxa1kwWk1kVk5UWW14R2JEVm9WeVV5UW14Qk5EaEJPRmRXYzB4a1dUUTRSV0pwY21NelUxWk9XVXBtVDBGa1VqUlpaVTQyVEZacFFtOXFhVVk1YkhCa0pUSkNSM0k1Wm1aNVpWZGpieVV5UW1JeU5rNXdWbFUyZFZKaVFVODVVMkpQZVcxNE5rWkpTRWswUlZSSlJIUlhNM1JuTXpSRGJ6Uk1Wa2RRUkZOUmFIcERZek5yTUVFM2QzbHVURVZTU21jNGRFcEdiMjU1SlRKQ0pUSkdkRzluSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0hNbE0wRWxNa1lsTWtaelpXTjFjbVV1YVc1dVpHd3VZMjl0SlRKR1ZWTWxNa1p5YjJKc2IzZ3VaWGhsSlROR2MzUWxNMFJrV25CaFFUaHVlVzQxTXpSbmRqRnZhamhYZURaM0pUSTJaU1V6UkRFME5qRTRORFEzTlRBbVpHOTNibXh2WVdSQmN6MXliMkpzYjNndVpYaGw=

http://www.repositoryuniversegift.com/c?x=yZIxVPANFj33xxnJNpABGiayDMmbICOa8VricyOW/GY=&c=X7VBh6Lm7hZjsNDtqRhLAR1IaNSsB5WyapyM VpLacXRMAcZs zrg5dr4u ebepEiUWA4A2f8YKY1Pki5L26Zrv1H60pEWLVAOWci1czt6mwcwAhaeqoTHnQmy29JSytyFrUGC6vM/xJDaLmuqHAZ 0vQX rjq2sB3m4OLOnPAc=&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.repositoryuniversegift.com/c?x=DxlCC4V3iyNJAu2p1RDeVd3ZzCtk6h1N9oQ9DhpiJT4=&c=ec87r6OmVUe7u6RxNhJUzQ1OWTDF31BzidQk5/hHBdc/fRRHu9fN62avA6O225Rm 5cA/1DBEk/sGGwt3slocFVoI/3kXK3gPbwWdw7Kqgmmfisx4M4kPa8HVBoI/xlZiac1U3k9HU9hXCCYZIwFfHYNxg2VPvEjB2evE qQRog=&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.conecptquickrepository.com/c?x=D1zFrLineVswLfsoqlMhvnUqW 5TwGL9fhBaBLd7Tuk=&c=TdE4ue0dqkjS82GgQJc5T0xZ7HuXeb6ecjsX9VDNzqM7FB9JWjlFNgqvxQ nDIpy/R4Q vyZbctJ NIOhGPqEwyRC4PYMY8PyMaeiWsYZui90Jq1oPI1/dNTmRrEG73Hh1dnNpKX9hnbokAuHnxdgpT9mGF8WNfb0Yr5K 1iVm0=&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

http://www.repositoryuniversegift.com/c?x=NbWDT19hjIGK CZ4x17iYok1vpLaWbd5qEVy PTtpxE=&c=4OFeHnkFPEBJ/ZEcjQULxc0IuoydTSp0qf0QUgJjFVVdmp2coEVrfuvhT7esDZcTROiYIaFdCMt2s5Emfx93MFuGYebbUUG tfYA/ulvSQULBZunwkj/E0WgwGOLJ 2oj/XXuNJkRAFIP4rax91xRWmnyFCZuWoqWEsSX0CWDgg=&e=0&fallback_url=https://secure.inndl.com/.../roblox.exe

Remove roblox.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.