home

samsung-pc-studio-18722-dp.exe

Rukimakin

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application samsung-pc-studio-18722-dp.exe, “Rukimakin Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Mode Beta (Fried Cookie Ltd)  (signed and verified)

Product:
Rukimakin

Description:
Rukimakin Setup

Version:
3.7.4.5

MD5:
361dbd291d28c15a7d8ac18fa3f8ba2d

SHA-1:
e89f19ebc6f4cae748d72763100328451bd42485

SHA-256:
7fb080692cb892470bb43b93e9f7c4038ccff0a03393bee5c48a9829b7666e58

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/1/2024 4:34:59 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.6.12.9

File size:
960.6 KB (983,624 bytes)

Product version:
1.2.5

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\samsung-pc-studio-18722-dp.exe

Digital Signature
Signed by:
Mode Beta (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 2:37:06 PM

Valid to:
7/7/2016 6:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:lCi46vIpWeGEvHstSIgFnM2MXLk03/hNcQQicg6pxiEW8:lrrwwXEvHstlgJM7k8DNcggxC8

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file samsung-pc-studio-18722-dp.exe has been seen being distributed by the following 10 URLs.

http://www.funsignssend.com/WVl6OTRQVTAxZWpCNGVIZFVkWEpaUlVoV01pVXlSa052T1haVlMybG5jMlp1WmxORmNYTkJVMFZEUjJ0cFYxRXhNQ1V6UkNaalBUUnRSa3RKTVZkVVkxRXdSMGRLTTAwMFFWSm1jalZGVjBkaE1YazRhRkZ0U1dWU1JHaFJKVEpDVUdaQlRDVXlRalJJTVRSeWExTjNaMVZTZFd0bVRUUlVSV3hQU0ZsUFZGQlZVVXN6ZERKaVNERnRkWGhLVkhsRVdFdFRSbVZpTXpabk5IWkhOVmQzYnpkMmFGcGFRMGRJYkZwaGJFaENSbXR0SlRKQ01uSlRiWG9sTWtaSVQyUktSR2x5YkhSM1drWkVRVnBwY0hWM1dIQTJkbkJCSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm5OMGIzSmhaMlV1Wkc5aWNtVndjbTluY21GdGVTNXdiQ1V5Wm0xdlltbHNibVVsTW1aVFlXMXpkVzVuWDFCRFgxTjBkV1JwYjE4M0xqSXVNalF1T1M1bGVHVW1aRzkzYm14dllXUkJjejFUWVcxemRXNW5MVkJETFZOMGRXUnBieTB4T0RjeU1pMWtjQzVsZUdVPQ==

http://www.deliveryheartconecpt.com/WVl6OTRQVTlNYmpnM1kySjBZbEYxUkhaTVJuZFJPSEJtY0ZSSGVUZGlOa05HV0UxMGIyVlJaMEozYzBZM2FVa2xNMFFtWXoxaVNucEZWMlJIY3pjbE1rWk1halE0TWs4bE1rSXpVa3RpWlZoT2VUUkhWMEZqZGxGUlJEZG9kVkpvVEhWa1VqY2xNa1k1UlU5UGFtSkZaVXRDYlU5SmNqTktTbll6T1VJeVl5VXlSamQ1UTNGS05FWm9aV2QwT1VkV2JYVmpUVXR6VkVKYVNsQmpiMEpoYTNNNWMzSkZaRGwwY3pkbk1XMWxaV1paVTFGbWJYbDBjRU5WYXpCSFRuTk1UVFpNUWpKMGFraHNNbG8xY1dGdFJYUmFkeVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVp6ZEc5eVlXZGxMbVJ2WW5KbGNISnZaM0poYlhrdWNHd2xNbVp0YjJKcGJHNWxKVEptVTJGdGMzVnVaMTlRUTE5VGRIVmthVzlmTnk0eUxqSTBMamt1WlhobEptUnZkMjVzYjJGa1FYTTlVMkZ0YzNWdVp5MVFReTFUZEhWa2FXOHRNVGczTWpJdFpIQXVaWGhs

http://www.grabappsdownloads.com/WVl6OTRQVTFMVTB0WFpHeG9VbHBxYm05VmFrYzBPRFFsTWtZMGFtOTBTRmR6YlZWdFJXbEhTMjlzVFVVM1ptbDVPQ1V6UkNaalBVRTBlV3hhVTNaNlFtUkxNblp6TTA1VWQwaHNKVEpDYzJoSU1uaHViSGxqWjFsTVkwUkNWM0E0ZEdWTmJXUjVOVEZFSlRKR2RUY3djR1ZTVFVrbE1rSnVka2RJUjIxM01HSkNielJXV2tORWFFVXhTRXdsTWtKNFVVZzNTRVZVU1NVeVJqRnplblF6TkdaS1RGQTVhMUJIYjJ4WFJtSkNXalZZYlV0cEpUSkNXazk2YVdZMmVUTmxVMjV6Y21aTVdISnplbkp5VGtOdWREaFdNbWRZTkVVNWR5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWnpkRzl5WVdkbExtUnZZbkpsY0hKdlozSmhiWGt1Y0d3bE1tWnRiMkpwYkc1bEpUSm1VMkZ0YzNWdVoxOVFRMTlUZEhWa2FXOWZOeTR5TGpJMExqa3VaWGhsSm1SdmQyNXNiMkZrUVhNOVUyRnRjM1Z1WnkxUVF5MVRkSFZrYVc4dE1UZzNNakl0WkhBdVpYaGw=

http://www.clearuniversecapital.com/WVl6OTRQVk55WmtGaVZrVjJTM1paTmpsa1IxcG9KVEpHTm1RbE1rSklkMmxvTTJOVGVtOWhUbmhqZG5ZMFltdFZOVUZGSlRORUptTTlXREZhVjIxNWNUQkhWREV4Y3pGUlEzbHRhV1JoUVZSMFkycHlXWFEzWVVKU1NscFBiVWd6Y0ZjMVJrUTJPVzlPUWpabldUQmhabVZDVDJwdk9VOW9jRVJNUWxsTk5HRkNaMjlLYlRkdlFYYzRiWG9sTWtKQ1RYRlVjbVEyWkRKb05YQTJNM3BuVGsxTVNYQlBVVTB3YVd4UVFtTklWbEp1VldkYWFtNTJZamxJZFhsaVRrRjZORWtsTWtKdVZrbzFSR0pzY2tJMGRteDNkeVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVp6ZEc5eVlXZGxMbVJ2WW5KbGNISnZaM0poYlhrdWNHd2xNbVp0YjJKcGJHNWxKVEptVTJGdGMzVnVaMTlRUTE5VGRIVmthVzlmTnk0eUxqSTBMamt1WlhobEptUnZkMjVzYjJGa1FYTTlVMkZ0YzNWdVp5MVFReTFUZEhWa2FXOHRNVGczTWpJdFpIQXVaWGhs

http://www.worlddlstock.com/WVl6OTRQV1V4TVVwemQzbERPR05NYlc4NE9EZFlVWFkwVlU5SVduTjFjSE56WkZKcmFuWlFORmxwUldGSWFFa2xNMFFtWXoxdmVpVXlSbk0xVURnNGEwdHFKVEpHZFdadE4zSTBSbEVsTWtJNVNYUlJNa0ZMTUdWVlpqZzVVREZXUjFkQk4waDNha2RRYTNCc2JHMHdKVEpHWWtOSlZEVlliM1ZJT1NVeVJuRjRaVk4zVFdvbE1rSTJkRlUxVFVvbE1rWlhhVU5yVTFBeFJYQkVhR1pLU0d3elFVMUtNRlF5TjJWTmRuQjRkVE42Vmt4UlQzZFhNa3hwYVdVeVdXNVJSR1JxT0dJMVZHcHlkell5UVdGWlMyZFJRbnB5VTBabVp5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWnpkRzl5WVdkbExtUnZZbkpsY0hKdlozSmhiWGt1Y0d3bE1tWnRiMkpwYkc1bEpUSm1VMkZ0YzNWdVoxOVFRMTlUZEhWa2FXOWZOeTR5TGpJMExqa3VaWGhsSm1SdmQyNXNiMkZrUVhNOVUyRnRjM1Z1WnkxUVF5MVRkSFZrYVc4dE1UZzNNakl0WkhBdVpYaGw=

http://www.todaymetabundle.com/WVl6OTRQV3RTZGxoWlFUQjNUVElsTWtaNVVHVnNjV3hLWjA5VlR6ZFBaMmhXV2xvbE1rSm1jWGd6SlRKR2NYbFJURUo1TTJjbE0wUW1ZejFEZVcxNVFrMTFkV0poT0ZnM1pIVkNZVXhpU2xvbE1rSkljMnRvYUdobVdYcGhkMHRpWWsxd2VERmpNalY2VldGcVRIaG9SRWhvT0d4UWNsWkVUMU5DVkdoelZIZ3pibTl0YVhCUlJHbDNSekpEZUVOWlMwazVZaVV5UW1SS1JVSTRWVWhZT1RsU1IyeHZlbTlaZVdRM1FVNVpRa1ptVlZWWWFHUkdTbkV3SlRKQ2FUaGtiM2hFTkRWbWRIQTJlbFExWnpKU2JYTXlVVGQ1UmtFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbWMzUnZjbUZuWlM1a2IySnlaWEJ5YjJkeVlXMTVMbkJzSlRKbWJXOWlhV3h1WlNVeVpsTmhiWE4xYm1kZlVFTmZVM1IxWkdsdlh6Y3VNaTR5TkM0NUxtVjRaU1prYjNkdWJHOWhaRUZ6UFZOaGJYTjFibWN0VUVNdFUzUjFaR2x2TFRFNE56SXlMV1J3TG1WNFpRPT0=

http://www.funsignssend.com/WVl6OTRQVzFVYm5ObVdsaHVVa1J2YUVwWk4xTlNNMHQwYlVoeWIxZFhWbUkxUWtGUFJHczBZMVZ3U1RaQlIyY2xNMFFtWXoxNlEyNWhSMlVsTWtaRmMySXlkakZNWTJkNlNXZG1iRzkyWVRCVmQxUmtlR3Q1TnpGb1JFdHBSamxtYjNWSllVSTVZaVV5UmtseFpGZDNPRzVoYm1WaFIzWm1NRmhYWjFSWE5ETm9aRnBCU0VOMlkwVTJabmR3YmxCeFltSnRXbXBKWVZOUFRVSjVVeVV5Um1VMU5YWXlUVTFRV1RKSVdWbG9VVXhGU1dGc2JFOVBZa0ozVmxOT1pGRlFjVTVEYlVWT1EyOTZNVWhyTW05SFpVRWxNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5oSlRKbUpUSm1jM1J2Y21GblpTNWtiMkp5WlhCeWIyZHlZVzE1TG5Cc0pUSm1iVzlpYVd4dVpTVXlabE5oYlhOMWJtZGZVRU5mVTNSMVpHbHZYemN1TWk0eU5DNDVMbVY0WlNaa2IzZHViRzloWkVGelBWTmhiWE4xYm1jdFVFTXRVM1IxWkdsdkxURTROekl5TFdSd0xtVjRaUT09

http://www.worlddlstock.com/WVl6OTRQVGRSUnpacVpqTkhPVGR1TjJWd2N6RldibGg2Vm1FMFJtNTZSMjAwVDI5TmNrMVNPVTUwWkdKeFZHOGxNMFFtWXoxeFVGbHRSa2RWUzNwbFNtWmpNRkJhTmtKaVowbGxkbFZVWjA5aFZrRkVXSE5EUjJjMVIxcHdTRWRzYTNoMmFHeEhaWEkxVGsxNE1rSXhkWEpPWlVSaGRUTTNWbWRsUm05dk5FcG9VV2xaYjNGbU0ydENkSHA1UzI1bGJXdHdlRVJJVUVKNFdXOTBOR0V5WTJsT1N6ZHNOelk1WjA1eU1XRlZhVkpHVEVwc1dFeE1jRTFUYWxWREpUSkdkV05FWWxCdEpUSkNSa2RWZFVWQkpUTkVKVE5FSm1VOU1DWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpZU1V5WmlVeVpuTjBiM0poWjJVdVpHOWljbVZ3Y205bmNtRnRlUzV3YkNVeVptMXZZbWxzYm1VbE1tWlRZVzF6ZFc1blgxQkRYMU4wZFdScGIxODNMakl1TWpRdU9TNWxlR1VtWkc5M2JteHZZV1JCY3oxVFlXMXpkVzVuTFZCRExWTjBkV1JwYnkweE9EY3lNaTFrY0M1bGVHVT0=

http://www.grabappsdownloads.com/WVl6OTRQV2htYURWemR6aDFlRFJ5UmxwcE1VTkxSVzRsTWtJbE1rSlpOeVV5UWt4dVExTXhVVmxGTmtSRlExTmlVRlJOU2trbE0wUW1ZejFHY1Zaa2NUTmFUVWRaVERGVlFuRjZTa05aYUd4SWQxTWxNa1ptV1VSYVdXMU9SQ1V5UWtaTVJVOURhRzVqYzNoU1QyRmFSRFp3TkVSdWExRnljR1YxUWxwQ2NuSllOVmh4VUd4eU4yUmphSGM1TWpGUVNHSnVZMlZRU0V4bk5GUm1ka1EzYURSUGJGRjFTeVV5Um5NMmRrdzVXVkZaUms1SkpUSkdKVEpHU0hBMVptWWxNa1p6UjBKUVQySnNjRmxLU3poNFduRm9WRVY0UWtZek5YSlRWa0VsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptYzNSdmNtRm5aUzVrYjJKeVpYQnliMmR5WVcxNUxuQnNKVEptYlc5aWFXeHVaU1V5WmxOaGJYTjFibWRmVUVOZlUzUjFaR2x2WHpjdU1pNHlOQzQ1TG1WNFpTWmtiM2R1Ykc5aFpFRnpQVk5oYlhOMWJtY3RVRU10VTNSMVpHbHZMVEU0TnpJeUxXUndMbVY0WlE9PQ==

http://www.stockbundlecentral.com/WVl6OTRQVkphTm01Uk5HNVNObWhSWkdkalJqZzBNRXRDTjNvelJtYzRVMlpFVWpWTFRFbE1WalJGYnpCM1NtY2xNMFFtWXoxbU5UVlhkM0ZQV0ZWWlRrWnNRM2N6Tmtselp6UlBUSHBPVlU5UVJuRTJaQ1V5UWtSWFJtOXJUbVp0YTFsRmIwOW9WRlJVWjJFbE1rWnBXazQ1TlVwVmVHbDZUbTA1WnpaYWVFaFBXSFZIUlhaclVXNURRM1ZaVjA4NWRERmxkbk4xWWpBd1luVnlkVkJLWlZKSlFsRjBUbnBKUkdKQllYcExXR0ppTkRWSlYyOUtTMUpUWXpJbE1rSm5NMFZ6ZGtRbE1rWllKVEpHWTNwaEpUSkdTelJvWjBFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbWMzUnZjbUZuWlM1a2IySnlaWEJ5YjJkeVlXMTVMbkJzSlRKbWJXOWlhV3h1WlNVeVpsTmhiWE4xYm1kZlVFTmZVM1IxWkdsdlh6Y3VNaTR5TkM0NUxtVjRaU1prYjNkdWJHOWhaRUZ6UFZOaGJYTjFibWN0VUVNdFUzUjFaR2x2TFRFNE56SXlMV1J3TG1WNFpRPT0=

Remove samsung-pc-studio-18722-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.