home

stardew_valley.exe

Befibir

Morava Group

The application stardew_valley.exe, “Befibir Setup ” by Morava Group has been detected as a potentially unwanted program by 2 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.appscleanflash.com and multiple other hosts.
Publisher:
Kulat   (signed by Morava Group)

Product:
Befibir

Description:
Befibir Setup

MD5:
d1312795817ee4382ad59d31f5635bde

SHA-1:
58034349159c3aac881606695c6df24a623ab680

SHA-256:
2e87ee4cfd76de93c3a1d5fbe0f9cc7bab0fcfcd09d7d25284ba53228697a3c6

Scanner detections:
2 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/6/2024 6:23:52 AM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/InstallCore.AFW potentially unwanted application
8.0.319.0

Reason Heuristics
PUP.InstallCore.MoravaGr.Installer (M)
16.4.12.22

File size:
971 KB (994,352 bytes)

Product version:
2.3

Copyright:
Software Internet

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\stardew_valley.exe

Digital Signature
Signed by:
Morava Group

Authority:
GlobalSign nv-sa

Valid from:
3/7/2016 12:28:01 AM

Valid to:
3/8/2017 12:28:01 AM

Subject:
CN=Morava Group, O=Morava Group, L=Towson, C=US

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121A83F14C1C6D435814D1A4B9EC949DB5C

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:HmdmwFjzyzV8q8viESE6v3auceqLPmaNtz5DyP2jGnyO9:HgPBeRcviE503auceqLug8CGnyS

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9055

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file stardew_valley.exe has been seen being distributed by the following 7 URLs.

http://www.appscleanflash.com/c?x= STfjnwWqs5OR9qxEN6eQjJhycsTP6htr2CLEWRyxn4=&c=eT4VossVWBoTkZl4rHOzwbQykZw1UO7gMORmCdWTW8SjM3/yARb9iUsl96WiPuguajGAREwPBbdykYJe5zLz0VI7iEEvKpCRig/enmwvGGS3zi/dI1 9bKYKbME/.../E3V5jreX88zA=&e=0&downloadAs=stardew_valley.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/.../Tm5HLWvLVZtPX55gf6 39vofPFM17f4wTvMuFEI nSKAWU9quFci6kCb7BNNJEn9dMSlpVUK066yG9GsKj ebvFN718A JytyFRyeVnIgq8szhFWdqeHiDYof2oxl1lMrIlyNdd2aXnemzsjCdlAehqDq7K8agsvoZrI3tg=&e=0&downloadAs=stardew_valley.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=JV4hXzGt6i3mmmgoiwok7qUGYPCBauYouHEM9riWMfE=&c=dEESWHmHCJo1AkEyVB5CqQzqYOWwT3AhryWS/nvjA vTpwiS44rN5a3SOs8d0p3A0itI5pM5exMinOBxKa/JDUVc4H70y3pgEhR1QhUEAtpWntMY8M1FYw4ZvQWmN9k99ln1gSIWYOYe1abDboZlAsKEC6Z50phgvgPvqwo/JFQJ6rIA/.../h&e=0&downloadAs=stardew_valley.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=cgRVNzKWvGN/b9NE6DWhOa5XT bzQWbFE5zivGRjSEs=&c=d0yxIIRmN5ivoeYvh7StEi4 n5oIcY0MEcJLDoWuqSx q3Wf/f94MZn05TsyTIjaFX4mbKbg0777Q4dBI3KhnM/.../M3mDn0MqwJJQrg0S&downloadAs=stardew_valley.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=nCsNVhEk7yICCNFkFP84U1oAyx0AVXhXvoqGuQTBsyU=&c=mDgHbtwkBwL7 wO/6DrITlRo4NWleB3FCWf0oNFnmX2/GWdEY6/Z/UnCvKzaoOOejls7gg2zjf7sw7e4lJp3qIYP66EG0mBhF/.../LSLESKY6wgBwzmZ0jW5S6JY P&downloadAs=stardew_valley.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=rQVgLWa9xBkkc4C3BaKp N9OdpZYrQ9 gRVvMJoIcj8=&c=cXfSBWLc3sLAhXO4fzOIzEKpbOzBeL8QnaN9X9JQHurpeJL0ufbwuogIHh8qaV0eCIVOQrHAU7EKzwF2qeURXBUP5Fb0OHz7qrRhaL5hGV/.../AP1A=&e=0&downloadAs=stardew_valley.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=i7f5AR1zINJo9Y T87qZX2ahBoGVdZWLMzwZ9xMKg5M=&c=nosv9iZyWownDp4TN065soZETCvcZjuRA10A2vCWRXpNbjC9XCzjlMFcwIwVNBVrf6AN3nsAPjR/.../wU438TFlYaCnLpn35NTxd&downloadAs=stardew_valley.exe&fallback_url=Fallback URL

Remove stardew_valley.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.