» total-commander-12316-dp.exe
Overview
Analysis
File Details
Downloads (11)

total-commander-12316-dp.exe

Bab

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application total-commander-12316-dp.exe, “Bab Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.

File name:

Publisher:

Mode Beta (Fried Cookie Ltd) (signed and verified)

Product:

Bab

Description:

Bab Setup

Version:

1.6.2.1

MD5:

9122e1381f28ad991ea2292af01f684c

SHA-1:

5e306ab04bc9165b106e1f3b34896a3718f74e71

SHA-256:

e9b131c8e3d05a535e473ba7683da63202c5e2719dc35b983bba21806306e9a7

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

11/15/2024 10:57:46 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.FC.Installer (M)

16.5.6.6

File size:

951.2 KB (974,072 bytes)

Product version:

1.5.2

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\total-commander-12316-dp.exe

Digital Signature

Signed by:

Mode Beta (Fried Cookie Ltd)

Authority:

GlobalSign nv-sa

Valid from:

12/16/2015 1:37:06 PM

Valid to:

7/7/2016 5:06:18 PM

Subject:

CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata

Compilation timestamp:

6/19/1992 11:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:8vp7y5I5PpEla6JVWwIar2hfWz21GkqfQT7L7/bpoQOGZ/u:Yx8culbVzIaKhc2gkqfQTz99Z/u

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file total-commander-12316-dp.exe has been seen being distributed by the following 11 URLs.

http://www.sendnowtown.com/WVl6OTRQVFp3T1ZCT01qVkhiR2RCU2xKMU1VaFdUSGh2TkdNNFltMVhKVEpHUlZGMlp6WkhOV3AyV1UxSFFWRTRVU1V6UkNaalBWbFRKVEpHWWpkd1VHZGFlbEJrYmpSR1NuTlBiRWcxVW1WelJqUTJZekYwYXpOTk56RkxWeVV5UW10dUpUSkdjU1V5UWxoYVRtTmFjMnMxZVRORE0wZzBXV1J3YkhaM1RrMUZUV2cyYm5od2RsVjZWeVV5UW1waWRISjFORVpYVG5scGNWQnpja0ZFTVU4bE1rWlFjVnB6TlZwNlZ6bHBVbThsTWtKUGIybEtlRFp4WkcxRmJqRndXVkV3VUdWNlQwOW9hWEZ6ZHpaQlNXeHJaWGxUTVVacmEwVjNKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlablJ2ZEdGc1kyMWtNaTV6TXk1aGJXRjZiMjVoZDNNdVkyOXRKVEptZEdOdFpEZzFNbUY0TmpRdVpYaGxKbVJ2ZDI1c2IyRmtRWE05Vkc5MFlXd3RRMjl0YldGdVpHVnlMVEV5TXpFMkxXUndMbVY0WlE9PQ==

http://www.bundletourtown.com/WVl6OTRQVzFGTWxCSFRqSkxkRVpLU1ZsNWNUa3pNMnBaVGtoQmNsZEZSRGhITkV0aFpGaGtKVEpDZERGMVJXWm9UU1V6UkNaalBXaGFKVEpDZWpaVmVXdE5ObFF3UzNCc1QyaEtkVk5OYnlVeVFpVXlRbkE1UjJwSmFFSkllblZLSlRKQ2NVaEdSSE4zZURaQ1UzRnJTMWxCUmtwWWJqUlNVRXRXYUZsWlEwUnpRV1YxT0d4MVMxVmlWV3htYjFkNGRHaGpOREJuVGtSNE9ESTFTVGhPU0ROT01UZGhkREV6ZGtadVoyUmFURmgySlRKQ1FucElORU5xTkZkUlluQjZha1J3YzNwb1NVMUlVSGh1ZW1oT01VNVVlbEkzUm1jbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbWRHOTBZV3hqYldReUxuTXpMbUZ0WVhwdmJtRjNjeTVqYjIwbE1tWjBZMjFrT0RVeVlYZzJOQzVsZUdVbVpHOTNibXh2WVdSQmN6MVViM1JoYkMxRGIyMXRZVzVrWlhJdE1USXpNVFl0WkhBdVpYaGw=

http://www.dlchuckledl.com/WVl6OTRQVXBMWkVSc1NFRkpkVnBwYzAxUFVGTlhaRWgxUkVveloxRnpkMlp3T1dkMlVVcHNkMDFDWldWdE4wRWxNMFFtWXoxclNHUmplV0kyT1NVeVFqSTVka3g1UlRSUGFITmhaVUZaYnprNFVpVXlRalJYZFhwUFpuUXhkbU41ZUd4VmVETktORzlvYkNVeVJqTkJTak5hUmpsNFJIaE9keVV5UW1kQmQwa3hNVVJLYWpadEpUSkNjMFkwVmtGbWJGVkRaelF6UkZkSVJXVkZiV3M0T1VGRVoxbzJiRmxGWm1vek5EbDNVMUYzYVVvM1EwVjFhMmdsTWtac1dtdHBRa2gzWTJSQlpVZE5jM0ptZDFock0xQXpUSGN6VFdjbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbWRHOTBZV3hqYldReUxuTXpMbUZ0WVhwdmJtRjNjeTVqYjIwbE1tWjBZMjFrT0RVeVlYZzJOQzVsZUdVbVpHOTNibXh2WVdSQmN6MVViM1JoYkMxRGIyMXRZVzVrWlhJdE1USXpNVFl0WkhBdVpYaGw=

http://www.headheartvault.com/WVl6OTRQV05WWTJSS1lXY3piblZJT0haQmRHMU1iR3hYTWt0UVNtOWpUV2x2UjJ4cU0xVnBXSGQwWjJseE4wVWxNMFFtWXoxd1JqSmtPWGN6SlRKR1MyUlBkM1JWVXlVeVFrdDFUakZSVW5KbllrTnRTSGhQYWxwNWVVNW5URlZyV1d3d0pUSkdWRTVqU1drbE1rWjFUbmR0SlRKR2RVWkhjR1JIUWxOak9HOXpWRmt3VDJSR1dFUjBWMEpLWjFCaGVuSlhTSGROZVdkTlFsRlViV1VsTWtKbVVFTjRiWE56ZDBoRVZYbFVOV3QyVm5GNE9IZFdUbm9sTWtaUVIyaERZMFpJZGs5TWNHRXlRakV6VUVRME1FUTFWa3BUVG1kalVTVXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWjBiM1JoYkdOdFpESXVjek11WVcxaGVtOXVZWGR6TG1OdmJTVXlablJqYldRNE5USmhlRFkwTG1WNFpTWmtiM2R1Ykc5aFpFRnpQVlJ2ZEdGc0xVTnZiVzFoYm1SbGNpMHhNak14Tmkxa2NDNWxlR1U9

http://www.vaultsgrabstock.com/WVl6OTRQVmcyYlUxblQwWnlkMHhJV0ZSc0pUSkdkRTFVY1cxeUpUSkdKVEpHUlRjM1UzZGFSSGh3UmxWMmNEbGFTMkZ1Y1hjbE0wUW1ZejAzVFV4UmJqazFOMlZSV2lVeVFtTXlibU5sTWpkVmRqRWxNa1kyYTJKMlRFZDBWRzA0VlVkdkpUSkNNME5rYm5BeVQwMWhkM1ozU0dRbE1rSTBWekpEV0hOdVozTmllRkpJY0U5clJXbHJlVzR4SlRKR2FUbG1NQ1V5UWxWeVlucFJheVV5UW01Uk5IWkRSVVJsTTNsbkpUSkdhV3hHUkdJbE1rSXhUVnBsZW1SYVNXRklWMlJwVjBwS2RHMTNKVEpDVUc0MGNYUjRUVlFsTWtJeFJVWnhZWFZOVUdkdWNHZFpiVXhuSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm5SdmRHRnNZMjFrTWk1ek15NWhiV0Y2YjI1aGQzTXVZMjl0SlRKbWRHTnRaRGcxTW1GNE5qUXVaWGhsSm1SdmQyNXNiMkZrUVhNOVZHOTBZV3d0UTI5dGJXRnVaR1Z5TFRFeU16RTJMV1J3TG1WNFpRPT0=

http://www.nowapplicationsranch.com/WVl6OTRQVWNsTWtKbE1qbFdVR2htZWlVeVFrODNkaVV5UW5KNkpUSkNURGhWT1RSVGMydFpZakJrUlhwblJVcHFVR1JTTWpod1VTVXpSQ1pqUFhkWGRFeEhjRlF6ZEVSeFZtMUhhRU5VYWtVeGRVNWxlVFpwVkRCTldVdG9ZVGxFWWtNbE1rWXlSRTlEYW1KaGRtNXBjMGxMYkRKWVRUTnVWMDVIU0VaMllYUTVObTF3WXlVeVFqaFZWWEZRWnpFeUpUSkdUa1U1VmtJelVrSmlNV041WWxoVFduUm1NMlJWYzBscFdFTnBWSE5ZTUhSemJURWxNa1kyV0hKaGVERldZVGRJUnpCbWIyTnhjMVprYVRaTU5YTnBaMWxTVlVaMGVIRlJKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlablJ2ZEdGc1kyMWtNaTV6TXk1aGJXRjZiMjVoZDNNdVkyOXRKVEptZEdOdFpEZzFNbUY0TmpRdVpYaGxKbVJ2ZDI1c2IyRmtRWE05Vkc5MFlXd3RRMjl0YldGdVpHVnlMVEV5TXpFMkxXUndMbVY0WlE9PQ==

http://www.sendnowtown.com/WVl6OTRQVkphZEZOdFRrVnlSVEF3Y1VGdFpYaDZVMHhLUjNZbE1rWnhkSEJLZWtsdVRVRWxNa1oxWjJOSVZIWlZaRnBSSlRORUptTTlaa1p0TWlVeVFtUkpNMkZFUTNwbVdrRnpVME5GVGxKVVlVWk1SMUp0U21oRmFWTnVObmRGVFVsbmRYbHhVVEZ5VDJVeVJtSk9VbGd5UVVKaFVIRlVja3hGUVdvMGQwNGxNa1pKY1NVeVJqWXhVV2RXTUZNM2NXVm5hR3B3ZVdwdlRUZERhSGwzT0RoMmRrRm5VMk1sTWtKMFN6ZFNPV1l3TVcxWGVsSjJTbFlsTWtaV1ZtdzRUVTlaYkdGMVdXZHdXbWxLWTB4TU5GRTRNMkZKVm5ST2R5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWjBiM1JoYkdOdFpESXVjek11WVcxaGVtOXVZWGR6TG1OdmJTVXlablJqYldRNE5USmhlRFkwTG1WNFpTWmtiM2R1Ykc5aFpFRnpQVlJ2ZEdGc0xVTnZiVzFoYm1SbGNpMHhNak14Tmkxa2NDNWxlR1U9

http://www.dlchuckledl.com/WVl6OTRQV2hPTjA1aFEzbzBKVEpDTmpGWE9UaHhUalpNUzFoVmJXTjRaVFU0UTNwMVNtMDJWREJyUTBvemRFMWpOQ1V6UkNaalBUSnFkblkySlRKQ01YTkRZMWxoWVV0TmNURXhjMmxKYmtGdWMzWkNRV1V5SlRKQ1FVVmhhbkpMVVZGNWJHWkxKVEpDUmxkUE5EbG1Xa05ZUW1OeVUwUWxNa0o1UmpKb1NsaGpjV2wzYm01YVVtRnhWMWhPYm10UmVIaExXVXhaZUVweFVGUm1TVWhIZVRWT1kySXdTMWQzYUVoek0xQTBOQ1V5Umt3eWNFUm5NVkoxWTNSeFVqRktielZhZUdGWldqbFVNa3BhZFd0dFNFUXpPR2xOU0hjbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbWRHOTBZV3hqYldReUxuTXpMbUZ0WVhwdmJtRjNjeTVqYjIwbE1tWjBZMjFrT0RVeVlYZzJOQzVsZUdVbVpHOTNibXh2WVdSQmN6MVViM1JoYkMxRGIyMXRZVzVrWlhJdE1USXpNVFl0WkhBdVpYaGw=

http://www.bundlebesthost.com/WVl6OTRQU1V5UW5CUE1rbG5aRkF6UVRNNVRHa2xNa0puZFc0MWFGQm9WellsTWtJbE1rSTVlRGhFV1dFM05FSlBlVlJuZDJvbE1rWkJKVE5FSm1NOVpuVjJkSG8xZVVJNVoyRnVObmhVUkRaTllrWXhjVE01ZEcxaVNFNVZjbUpEUW5nMFVpVXlRbUZOV0ZOclIzWnllbVEwYURkdVZqaFplRFZyZHpkcmFESkhjMVJ5UTFFeFZFeEpNMWx4Y3pNMGRFSndVV2s1WjFWWVpHdG5KVEpHVDFSSVZXdEhZbW8yWmpaQmF6bHhSWGRJZEZCU2RsaEdZVmhvZFZoblZHSmtja2MwVlU1d1MyOUxOMUpaYTIxRFJ6UTRPRlJSTVRoMVVTVXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWjBiM1JoYkdOdFpESXVjek11WVcxaGVtOXVZWGR6TG1OdmJTVXlablJqYldRNE5USmhlRFkwTG1WNFpTWmtiM2R1Ykc5aFpFRnpQVlJ2ZEdGc0xVTnZiVzFoYm1SbGNpMHhNak14Tmkxa2NDNWxlR1U9

http://www.dlchuckledl.com/c?x=wZvVlHVxsNTSIhRtbkyQu7C9g0YxLCKFZ1w26/ideZA=&c=PDRzeLeW/fjlBSnh6gnyj 6AI8ADuuNa4la6AOlHasMYJ9ob8HbBUczZ hZ2KM0yQMCMkKHvMPaF8Vk5d9Q14mIK9NgIf8W8ZvcStzbEXig LMWlWE42vF81TJIqWdPwmak3SdBlEoFI keG12ICrizxnLmDHR/Drzzk/7roWlU=&e=0&fallback_url=http://.../tcmd852ax64.exe&downloadAs=Total-Commander-12316-dp.exe

http://www.bundlebesthost.com/c?x=dBXjmvfLiFiXBbXhBZIr3A0nkasKv/E3cNBLHrRFvik=&c=vv6vTsuzMEf0DgKDVFu16dx/NmNDNauc9 /4U/y8Fa9d64R3geZQNA78xNo2u0GvzqZO X4S80pHUjCPASu3Hv0aGWyaS8t/bp2nlXYx0OOFZ2vRu7O/Tg1V7JhLHB1bf570NV5YI0hhfqooimWPbZd7yBCrjuTPs6wJguJs4JA=&e=0&fallback_url=http://.../tcmd852ax64.exe&downloadAs=Total-Commander-12316-dp.exe

Remove total-commander-12316-dp.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.