home

tor-browser-bundle-34312-dp.exe

Rukimakin

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application tor-browser-bundle-34312-dp.exe, “Rukimakin Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Mode Beta (Fried Cookie Ltd)  (signed and verified)

Product:
Rukimakin

Description:
Rukimakin Setup

Version:
3.7.4.5

MD5:
f33803dea46d798fccad1a5a08569710

SHA-1:
5170980ea96a8433eb79a25e2075ba56eafc45ed

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
12/26/2024 8:28:14 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.6.10.11

File size:
960.6 KB (983,624 bytes)

Product version:
1.2.5

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\documents and settings\lisak\moje dokumenty\downloads\tor-browser-bundle-34312-dp.exe

Digital Signature
Signed by:
Mode Beta (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 2:37:06 PM

Valid to:
7/7/2016 6:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:cCi46vIpWeGEvHstSIgFnM2MXLk03/hNcQQicg6pxiEW8:crrwwXEvHstlgJM7k8DNcggxC8

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file tor-browser-bundle-34312-dp.exe has been seen being distributed by the following 12 URLs.

http://www.vaultschuckleapplication.com/WVl6OTRQWFpHTkZFd2FqZFFhM0psUTA5b2NsZGtOM0kyZGxWTVpuUnlkRTVrVldrM01sZFpOV2MwV0ZwNFQyY2xNMFFtWXowbE1rWTBPRkp3UzBSa2NXaEdNV296VkdaeWJGcHlWVEJGYnlVeVJucHJabFZFVFZvbE1rSnlaR2RKUWtwR1RTVXlRakpFWW1KSkpUSkdlVEEzUkZaU1pYa3pWakZ1YWlVeVFuWkNKVEpDV0hoSGRURTVkSFp0UVdKdVpUbGFSbVZJVUhGRlpXWk1PRkUxUkZoNVZHbEZVVEphUldGWmFXOVFRbGxwWW1SSWVTVXlRbk5hT1VJMVpUUlNWSFJSWWtOeU4wRmliVXRoTW5sUGJIVTNabWxsT0ZsbWVGWjNKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjSE1sTTJFbE1tWWxNbVozZDNjdWRHOXljSEp2YW1WamRDNXZjbWNsTW1aa2FYTjBKVEptZEc5eVluSnZkM05sY2lVeVpqWXVNQzR4SlRKbWRHOXlZbkp2ZDNObGNpMXBibk4wWVd4c0xUWXVNQzR4WDNCc0xtVjRaU1prYjNkdWJHOWhaRUZ6UFZSdmNpMUNjbTkzYzJWeUxVSjFibVJzWlMwek5ETXhNaTFrY0M1bGVHVT0=

http://www.contentdownloadmega.com/WVl6OTRQV1kyU1ZWMWVGVm1VMXBKY1dSWU4xTlphMjgwWTBsR1oyUnNXbmw2T1VOblltRXphRVEyWlVWR1NuTWxNMFFtWXoxVFpFbEVjMXBwVEVsdU5FbHZUbEpFV1RFeFoyZHBlbFZ4T0ZGQmMxVTFVbTFhVEU5bFUybG9WbU0wVG5SbGF5VXlRbmxQZERsdFRGUkliVXBaVjFOd2JIWXhiMnAzYld4Q1UxZ3dhRWgxT1ZVMGJFdDBZMVZqWkZOS09Vb2xNa1kxU3pCWFRESlNVMkpaUVhJbE1rSk5kamxKUldNeldIaGlhVFZYU0dVM0pUSkNkM0paTUNVeVFtTnNTVGR4TUVoVlFqUlVkSGw1VVZKc2VDVXlSa3RESlRKR1VTVXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQnpKVE5oSlRKbUpUSm1kM2QzTG5SdmNuQnliMnBsWTNRdWIzSm5KVEptWkdsemRDVXlablJ2Y21KeWIzZHpaWElsTW1ZMkxqQXVNU1V5Wm5SdmNtSnliM2R6WlhJdGFXNXpkR0ZzYkMwMkxqQXVNVjl3YkM1bGVHVW1aRzkzYm14dllXUkJjejFVYjNJdFFuSnZkM05sY2kxQ2RXNWtiR1V0TXpRek1USXRaSEF1WlhobA==

http://www.vaultschuckleapplication.com/WVl6OTRQWGhvTlhwVVQxSjRWa2wzYlhoMWF6QkRXRWh6YkRCc1luRnVkMDVZZDJkelUzcHpSbVpITm1zek1rMGxNMFFtWXoxU1psY2xNa1psYlU5blpXbEtKVEpDZDNKTVFubG5aakpoTjNSelpIUm1ZWFpRVDJsV2JHTnBWV3BEY1RSYWNYUXdURFlsTWtKVWVGZHZkbmd6WkVGTE5tZ3pZU1V5UWtoWWJuRjZhbGw0TVNVeVFrcGtKVEpDVm1wTWNHUlROWEZVZW10bmJuSTFhVFZLYmlVeVFqRk5PVkZZWTJsd1JsUndhVE5WZEZObE9YVkxlV1JMU25kRVJqZHFVM1ZRTUdsd05UQXlSekJNV2xCVkpUSkdhVFZoWW1wbWFuQjNKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjSE1sTTJFbE1tWWxNbVozZDNjdWRHOXljSEp2YW1WamRDNXZjbWNsTW1aa2FYTjBKVEptZEc5eVluSnZkM05sY2lVeVpqWXVNQzR4SlRKbWRHOXlZbkp2ZDNObGNpMXBibk4wWVd4c0xUWXVNQzR4WDNCc0xtVjRaU1prYjNkdWJHOWhaRUZ6UFZSdmNpMUNjbTkzYzJWeUxVSjFibVJzWlMwek5ETXhNaTFrY0M1bGVHVT0=

http://www.grabappsdownloads.com/c?x=TBRVaY0jnE2xxT8hYUmg71ssrjs9EE93o FEBXjNcYY=&c=rbBkfjy 2TxlUtASlk6ENQ604E8q0Au nnMTwRFrb6O8erBISnod Clx7R BbhfmDUZUg 12FrbQYULXqM5L6kblb VHktzUfYIQK8Q7qGoJSzjmQu MKzqonGatAevIortooBlPnJrzmLj5Ty2q qO96tcDHuqc0Giku/gCzfQ=&e=0&fallback_url=https://www.torproject.org/dist/torbrowser/.../torbrowser-install-6.0.1_pl.exe&downloadAs=Tor-Browser-Bundle-34312-dp.exe

http://www.deliveryheartconecpt.com/WVl6OTRQWFZ1ZDI1TmMwbE9WRzUxY2pKWmJrNTRhRGxrUmpWeU5HZEtSMVY1SlRKR0pUSkNWRFp1WVZKd1REQXhSaVV5UWxFbE0wUW1ZejFXVW5oRVVrUnFVVFpZUXpKUVNXdGFSRTVFU1hFMFRDVXlSa3hXWW01MlZESXlTWFp1YUNVeVFqVjBWbnBuTVVwUkpUSkdaMXBDZWtsVlZHUXhaalZ5WmxkWFJHVlBlR0ZhVERCblprVjNOazV1TW1Oa2VGTXpjVmxuTkdaMWFXNTVKVEpHT1d4NmVIazNWbXAwUjFWSGEzVkRSamt3VkRGR01WcGhlbVIyWm13bE1rSTBSRXRZYVhKT0pUSkNNa05SZWxsUmEyVTJkVkZ0ZDJGTVJFcDVTWGNsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3Y3lVellTVXlaaVV5Wm5kM2R5NTBiM0p3Y205cVpXTjBMbTl5WnlVeVptUnBjM1FsTW1aMGIzSmljbTkzYzJWeUpUSm1OaTR3TGpFbE1tWjBiM0ppY205M2MyVnlMV2x1YzNSaGJHd3ROaTR3TGpGZmNHd3VaWGhsSm1SdmQyNXNiMkZrUVhNOVZHOXlMVUp5YjNkelpYSXRRblZ1Wkd4bExUTTBNekV5TFdSd0xtVjRaUT09

http://www.worlddlstock.com/WVl6OTRQV1ZaVkhKQ2EyeE1iSEpsZW5KSFMwa2xNa0pWWVNVeVFrZHdiRVY2VWxsdVYzSjZSMmhZVDI0MlEzTndjbEJqSlRORUptTTlWekpLYmtaSEpUSkdZMVJuYUhWVGJXUmpVVFJMWVdreFkyWmhVRXROU0ZoaFRuaHVaMU5TU21FemJERlRXRGRUU1RkWWNISjFKVEpDZEZaTFpVTmpOVzlPTm5WbVVuaGpjRVkxUTBWVGVVTk5lRWxZTjI1Tk1UQkpiMGh0Tm5Fd2JUQXlNa2RYU0NVeVFuQkJhSFpHUkVzemJXRlpVREVsTWtKeE1URXlTRkVsTWtZbE1rWk1lbWw2ZEVkUlJqSlBla2R4TmxablZsazBUMDFKUlZwR1NWVkJKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjSE1sTTJFbE1tWWxNbVozZDNjdWRHOXljSEp2YW1WamRDNXZjbWNsTW1aa2FYTjBKVEptZEc5eVluSnZkM05sY2lVeVpqWXVNQzR4SlRKbWRHOXlZbkp2ZDNObGNpMXBibk4wWVd4c0xUWXVNQzR4WDNCc0xtVjRaU1prYjNkdWJHOWhaRUZ6UFZSdmNpMUNjbTkzYzJWeUxVSjFibVJzWlMwek5ETXhNaTFrY0M1bGVHVT0=

http://www.deliveryheartconecpt.com/WVl6OTRQVVJoZFZOMlNWaFhiVk5wZFdVMmJXMHdNVUpYV2tGVWFHODVUM3BWUVZwaVNGcENRMU50T1ZNbE1rWTNieVV6UkNaalBXdFZiVWR2ZUVaNFMyWkZSRkZaU0ZKc2VVOWtlbXdsTWtKaFowRjJKVEpHUlZGSUpUSkdlR2hYYVRjNU5VbGlaR3AxY2pKVWFGRmFObEZKVDBwdFpIaEVKVEpDUlhwbVUwZE1TQ1V5UWlVeVJrUkxPVmROTkZaeWQzVm5OV3hGYUhkTVdreG1jSGgwSlRKR1NuQTRSWGhzTVZKRFkwVm5Tazk0V1cxeWNFeFBhR1ZpVW05b2RUQjVaa2hrSlRKR1pXb3diMUJIWVNVeVJqSmxWR3QwTkdKTlMxWk5jMGhwVVNVelJDVXpSQ1psUFRBbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhCekpUTmhKVEptSlRKbWQzZDNMblJ2Y25CeWIycGxZM1F1YjNKbkpUSm1aR2x6ZENVeVpuUnZjbUp5YjNkelpYSWxNbVkyTGpBdU1TVXlablJ2Y21KeWIzZHpaWEl0YVc1emRHRnNiQzAyTGpBdU1WOXdiQzVsZUdVbVpHOTNibXh2WVdSQmN6MVViM0l0UW5KdmQzTmxjaTFDZFc1a2JHVXRNelF6TVRJdFpIQXVaWGhs

http://www.vaultschuckleapplication.com/c?x=S Xcz7eOQGD0ha4BmQKFR6D7R6IoKSukw7fe2F8hjCA=&c=5nzeUuC2ixeQJSdx8lVQug4QQG7YeM jKVkRU2IRGMka5xMHCr4LVwuH1NMdBA6PSC0Ga0nCHXYAmyA 6cJ2/1VyDxjrk5H1OqoEPDtYowKx5ujzdTWuKjd82YnKL0MCG9JP5LwUhcfOW7IOKJBZ86w1E4EnkK b1ovFWQfxeH0=&e=0&fallback_url=https://www.torproject.org/dist/torbrowser/.../torbrowser-install-6.0.1_pl.exe&downloadAs=Tor-Browser-Bundle-34312-dp.exe

http://www.vaultschuckleapplication.com/WVl6OTRQV3QzTWxSRlRXUkhRa2R0SlRKR2FsTklRMmN6VEd0WFQzaEdjRkkwUzJ3d01GQlJaVFpvYUVkRlpETnNXU1V6UkNaalBYWkhaRGxhVDFWbU1GcDJTbmxXVTJSTmRYcEdkVmxCYTB0SE1rRnlRMHN4TlVzNVUwMDRkMW9sTWtaV01WVlFUbHA1YkhrM0pUSkdUbUpPVVRKSk4yMW1Temt4WlVNbE1rWnZaQ1V5UWpNMGFWcGhUa2szYUZOTlRFMTVhbEZaU0dSSVVsSnljMVV6Y25sME9IWkJVVTVrTkVWMVFVbExPVVJzUnpkcFkzSlVZMjlzZWpWNVIwVnNjRkJxTTJ4a1MwSXpZVFZSZGxOTE5GWTBZVTFuSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0hNbE0yRWxNbVlsTW1aM2QzY3VkRzl5Y0hKdmFtVmpkQzV2Y21jbE1tWmthWE4wSlRKbWRHOXlZbkp2ZDNObGNpVXlaall1TUM0eEpUSm1kRzl5WW5KdmQzTmxjaTFwYm5OMFlXeHNMVFl1TUM0eFgzQnNMbVY0WlNaa2IzZHViRzloWkVGelBWUnZjaTFDY205M2MyVnlMVUoxYm1Sc1pTMHpORE14TWkxa2NDNWxlR1U9

http://www.deliveryheartconecpt.com/WVl6OTRQVmRaVlROdGFscFJkU1V5UmpreVdXZG5lbVJxT1ZaeGFscHlRVzEyY2taM1VHcFFKVEpHTTFORk0ycGFabnBWSlRORUptTTllV1ZYY0dFMmFVeE1SWFFsTWtJeFVESlBiRGxLVDJGMGQwSjJKVEpHYURaNlJFeE5SMHh1TURSdldWTkxNakpwVGtzM2IxazBaM0ZDTWpCeWIyWnZjM2RPVlZOaWRVNVZaWE0wYURkMFFtTjBSaVV5UmtkM2JEWXhjM1ZtYWs5TVpXMTBiV0p6Y3pRd2VYRjBhMlZMVkZwNE1WcExhbHBTTkVWa2VrbDZlV1JKT0RkeGFrVndZa3BhT1hCamVsWklhMVpFUkhOM1ExbFJTRzVCSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0hNbE0yRWxNbVlsTW1aM2QzY3VkRzl5Y0hKdmFtVmpkQzV2Y21jbE1tWmthWE4wSlRKbWRHOXlZbkp2ZDNObGNpVXlaall1TUM0eEpUSm1kRzl5WW5KdmQzTmxjaTFwYm5OMFlXeHNMVFl1TUM0eFgzQnNMbVY0WlNaa2IzZHViRzloWkVGelBWUnZjaTFDY205M2MyVnlMVUoxYm1Sc1pTMHpORE14TWkxa2NDNWxlR1U9

http://www.headcycleuniverse.com/WVl6OTRQVk14UVU4eUpUSkdSVzRsTWtKcE1rTTVSRkp6ZVdWR2FHRjFZa1puV0ZKa01rcFhha00yUzNrbE1rSTVkMlZFY2pRbE0wUW1ZejFTZVRaRGVHTkhjakZMVDFKelIzUTBWWGcyY25KUmFHRkpNbGxXY1V4TVVtODBPV3BqTjAxSEpUSkdOeVV5Um5saFdsQjFkbEF4VGtaSFlUbDZZeVV5UWpCNmFFUkNjVnBLUlVjeFVEWnpkbGR2VTNaWU9GRlNjMkUyTURWbGIxRm1WbmROWVZReGRHbENiMFpoUlVrbE1rSklTbWhwWkNVeVFuVmFlRnBIVjJKUmJFTnhNVlZ5SlRKQ1FURldhM0JzWlZGVFMxZElaeVV5UmtrbE1rWXdWSE5qUkdGQkpUTkVKVE5FSm1VOU1DWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNITWxNMkVsTW1ZbE1tWjNkM2N1ZEc5eWNISnZhbVZqZEM1dmNtY2xNbVprYVhOMEpUSm1kRzl5WW5KdmQzTmxjaVV5WmpZdU1DNHhKVEptZEc5eVluSnZkM05sY2kxcGJuTjBZV3hzTFRZdU1DNHhYM0JzTG1WNFpTWmtiM2R1Ykc5aFpFRnpQVlJ2Y2kxQ2NtOTNjMlZ5TFVKMWJtUnNaUzB6TkRNeE1pMWtjQzVsZUdVPQ==

http://www.tagtowerscapital.com/WVl6OTRQV05TZVRZNVlWSWxNa1k0Ym5oYVlsbEJKVEpDV0hBNVMzbGhiVEJ3VEVOQldHaFhZMWx2WmtVNFpWYzFOVXhGSlRORUptTTlhMUJvYmsxU1dsbzNPRkJ6YVhscWNVdElVRlpCVDJOaFZYUkZiRFJHV0ZKSmJVUktSa3BPZUZaSVpsSnlhVGxNZUZKcVZWZ3laekpHVGtab2JqaFZhRVpvVm5jMFkxcFpObUYxTTB0c2RUQkpPWFF4Y1RodWVsTkpja2x4YlVsYWVtcFVUMFYzTUhSa1pFMW9XWE54YUV0RGFGUmxRV1F6TVNVeVFuQnFTVVZQV0hCTU1IcHJkSFUxVmpsMk1sVnpWMGxsTTJGM1lrRWxNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndjeVV6WVNVeVppVXlabmQzZHk1MGIzSndjbTlxWldOMExtOXlaeVV5Wm1ScGMzUWxNbVowYjNKaWNtOTNjMlZ5SlRKbU5pNHdMakVsTW1aMGIzSmljbTkzYzJWeUxXbHVjM1JoYkd3dE5pNHdMakZmY0d3dVpYaGxKbVJ2ZDI1c2IyRmtRWE05Vkc5eUxVSnliM2R6WlhJdFFuVnVaR3hsTFRNME16RXlMV1J3TG1WNFpRPT0=

Remove tor-browser-bundle-34312-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.