home

the_culling.exe

Sisaf

Morava Group

The application the_culling.exe, “Sisaf Setup ” by Morava Group has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.appsfilessafe.com and multiple other hosts.
Publisher:
Morava Group  (signed and verified)

Product:
Sisaf

Description:
Sisaf Setup

MD5:
a181c73d505c0c3212f939bddf12f315

SHA-1:
4ce89a4ebf64de24960c734406a985e7fda8e22a

SHA-256:
e9ec8b74371a57b174f91ae9d8791d6cb7c3f640003b920fe310424e50561955

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
12/26/2024 2:44:28 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.MoravaGr.Installer (M)
16.4.22.9

File size:
946.1 KB (968,824 bytes)

Product version:
3.4.4

Copyright:
Lite Internet soft

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\the_culling.exe

Digital Signature
Signed by:
Morava Group

Authority:
GlobalSign nv-sa

Valid from:
3/7/2016 2:28:01 AM

Valid to:
3/8/2017 2:28:01 AM

Subject:
CN=Morava Group, O=Morava Group, L=Towson, C=US

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121A83F14C1C6D435814D1A4B9EC949DB5C

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:VEDl3xWjyFEt1c6nkEwC7/ZCx3gt1iohufopkHA1gPIK:VEBBWbC6nkEwwYxO1reAWQK

Entry address:
0xAA98

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 2E, 86, FF, FF, E8, 35, 98, FF, FF, E8, 9C, 9B, FF, FF, E8, B7, 9F, FF, FF, E8, 56, BF, FF, FF, E8, ED, E8, FF, FF, E8, 54, EA, FF, FF, 33, C0, 55, 68, 69, B1, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 32, B1, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, D0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, C2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, 24, 93, FF, FF, 8D, 55, F0, 33, C0, E8, 66, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9354

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
40.5 KB (41,472 bytes)

The file the_culling.exe has been seen being distributed by the following 4 URLs.

http://www.appsfilessafe.com/c?x=KzcMrYv9Iugo7gAt17uWlPlaPE1rAAYW Ppva4sd6KY=&c=7MytGlN4gWHrKpeLOn3sTylggce9fZMLOYiSL80DvzOP7U0oAupTBft6XNGEa/XQOlU1B8YvivfdUd9Nafqq9z0IcXBxuQkS1vVpWaq3YfxWW1n ggOa 5/.../LWavGnLaZhjtNMsHGZjFMb054=&e=0&downloadAs=the_culling.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=kIV/l9XfC rfgqHffnnpuPYKro/uwxo75T2f//1B968=&c=sljtSOBOxgVdjwBWNYhJ1K6Sg7blq68HcZhvIPfLdwpMFvHT3LdeTagf1zCKO8rzxA3l/.../zDQq8CD8=&e=0&downloadAs=the_culling.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=OSx8NTICG6M0/drotcHAJpsbFK/.../rayYR1eRyXIKNVL4oPusindVf5yrf9NBK8rK62SNYvwruBwj9dfk3b2bUi7JY93HyyzkDACW8CQpd5Ho308oXOnyzsz94rgyT7E xP5ECj4I1h5hZPhO3Ehxy7BNk6osuW fmllNyuc3dncuR1vQ9g=&e=0&downloadAs=the_culling.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=D1leSrzP47oRG6sPdxS4 Dqtl7HBV2fjsEJ ASMpJFU=&c=g3Scrf9QqGwR7OCKaewbpqMWAbERUe7wWprcSzDkCMMwuSRll1L5SJHbZ9O4FEcg2BJyXhgTN3k82D K3Nq0a4CjpSfj73DKRgQ/.../5otFmgGUuh YRPu7Q5EeCbm0B1 31ALllJylwRvin8=&e=0&downloadAs=the_culling.exe&fallback_url=Fallback URL

Remove the_culling.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.