home

the-sims-4-full-version.exe

Cagolig

Destiny Dream S.A.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application the-sims-4-full-version.exe, “Cagolig Setup ” by Destiny Dream S.A has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.presentgifttours.com and multiple other hosts.
Publisher:
Huful   (signed by Destiny Dream S.A.)

Product:
Cagolig

Description:
Cagolig Setup

Version:
3.6.3.0

MD5:
b225b0a6b3c32cbec0578924892e337b

SHA-1:
81db20d7c086793b8f5e3b4015e3e0b2397ff422

SHA-256:
57c21696f4455d5a660770d56d6242c7635459748636ae1c979e4a517ddb728b

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
2/26/2025 1:03:46 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.DestinyD.Installer (M)
16.4.11.11

File size:
989.7 KB (1,013,448 bytes)

Product version:
2.0

Copyright:
program

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\the-sims-4-full-version.exe

Digital Signature
Signed by:
Destiny Dream S.A.

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 7:55:11 AM

Valid to:
10/2/2016 9:36:18 AM

Subject:
CN=Destiny Dream S.A., O=Destiny Dream S.A., L=Clarens, S=Vaud, C=CH

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11217A75EB912AE2167326222C18D9E2357F

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Io9v/Sb8ISdMPNf/kLkfz8HF2+7jDBVCyP39KvlDVJx:I6SkaPNXkQfziF2sjL8l/x

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9262

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file the-sims-4-full-version.exe has been seen being distributed by the following 6 URLs.

http://www.presentgifttours.com/c?x=kFb5fAhZfAKgKT6ofhn1xIYZGj/6hgFDT9XlYwf7cy0=&c=zavFqBmj2DzQkcJjzfjVQGrG6LBi88ZmXrI LRYhrOkyvNU71Uk3cVzfV0UA9kdGxgvG6Bac4sFSdU4GpR QX/TqXmslqnqtjdEZyWKsNDwmTXjlNfjDPhp/5e6Tp7NY&downloadAs=the-sims-4-full-version.exe&fallback_url=http://www.thesims.com/en-us/.../product

http://www.repositorytowercentral.com/c?x=vczVd1O5ajMOIRJzvywPdMgUKEDwVbrpMvb4njyXQYc=&c=7oVOh4mwWNmxe8rBuCNLdyJZdr0bLL5DEhbK7FGnbldee8IQKoJCCgrk/91e2x/o3sZkcOS4CDrvMYAOIntPvA2yXmLZx1hiuGGjVQdRSViXgArAHAMO4psoEon Kv z&downloadAs=the-sims-4-full-version.exe&fallback_url=http://www.thesims.com/en-us/.../product

http://www.signstownapplication.com/c?x=W3hkhaojkEu2KD74irGVh bAgyTJI0efMlivP5CoMJY=&c=VaOLznRI5EmEvAn25MXkmBqaRxXACX6UlVKtPM bbr5yCiYQWipaoKtxRqJrq4fspLOLeeruDR IGUr3hNb i0 0iygLVuFwYljtN1czLgpFLV7X1r36jTiqOCs2UMd9&downloadAs=the-sims-4-full-version.exe&fallback_url=http://www.thesims.com/en-us/.../product

http://www.flashtowerfactory.com/c?x=NQDACsXqN7h3lgy AN8Ykd2JGVsh9CkCtgKHVQXf6ZA=&c=ghCf65wShLS7 7htt3tyLMP8Zcp5om1n4vOYv/b1nsxJhxwa968U2tlgr7r7ifZdYPan2fttuf8TCGmpbLY69oStXVbyOEoIy1T 17yhgv5igcZxR5zdPT4Rn597P9Df&downloadAs=the-sims-4-full-version.exe&fallback_url=http://www.thesims.com/en-us/.../product

http://www.universesharehosting.com/c?x=t0v7dmKV9Ewoh3yXU1Onjxa/IjmTSYSajbjxG4XQG3A=&c=Nw4VlYnZ5i1aJgOpFovblXaPXuFBvuZvGjBrBl279TPfXBdilwM88qZGUvKnGHbQ1C22uwucLzNQbTMLwH1I/j0chIgJJjT0EILRyjXjReWEoMMz980yZY2 smyD5 A6&downloadAs=the-sims-4-full-version.exe&fallback_url=http://www.thesims.com/en-us/.../product

http://www.appsbestsigns.com/c?x=JvTQcV7wORHuF69jhBRoshWnibZumj2DJLVRuVuaDsA=&c=jN7bLcQ6Ok8SSyU14S3GBLs95rDwuGXfMD35BID2VXSNLhfoEm8p5nnp515GT80Sew5OJtmh97MyYtebfNXMFLvCS6Fo6V1gzYQ1twT68GzZUUk6i4D9NGUGscoJc9ih&downloadAs=the-sims-4-full-version.exe&fallback_url=http://www.thesims.com/en-us/.../product

Remove the-sims-4-full-version.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.