» total-commander-12316-dp.exe
Overview
Analysis
File Details
Downloads (13)

total-commander-12316-dp.exe

Bab

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application total-commander-12316-dp.exe, “Bab Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.

File name:

Publisher:

Mode Beta (Fried Cookie Ltd) (signed and verified)

Product:

Bab

Description:

Bab Setup

Version:

1.6.2.1

MD5:

98ca117b9bac33995d418c769893e32f

SHA-1:

eae20446992a6d872b56db0005b238b25a8181c2

SHA-256:

013134aaaf78c569b05a218cb074d0c76194ffa91db72260cea516375ceab5d4

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

11/15/2024 9:45:51 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.FC.Installer (M)

16.5.8.0

File size:

951.2 KB (974,072 bytes)

Product version:

1.5.2

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\downloads\total-commander-12316-dp.exe

Digital Signature

Signed by:

Mode Beta (Fried Cookie Ltd)

Authority:

GlobalSign nv-sa

Valid from:

12/16/2015 2:37:06 PM

Valid to:

7/7/2016 6:06:18 PM

Subject:

CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:Dvp7y5I5PpEla6JVWwIar2hfWz21GkqfQT7L7/bpoQOGZ/u:bx8culbVzIaKhc2gkqfQTz99Z/u

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file total-commander-12316-dp.exe has been seen being distributed by the following 13 URLs.

http://www.dlchuckledl.com/c?x=3TMMNEr2htSbCepRDIDFC1Z0krv39tvN6bCW7DG1O5o=&c=wFtwtSB701C6ZMdscvHC8qxB0gFPlkmibKIjNefke52mqXyf/MTrto2XLR2T6Eq76nGEKQG7z7rQAn/OlvWJcBmE4790dnNn3rD Tj6vkZ3JmrFUurUuplVkKIzigKdJL/kH0Q39Gx eAsbLtM6FyCbsKSlTb02TwU8GShJOCao=&e=0&fallback_url=http://.../tcmd852ax64.exe&downloadAs=Total-Commander-12316-dp.exe

http://www.chucklebestapp.com/WVl6OTRQVkJDVVZNM09IUlVkRVZqWjNWeVptRTJNV3dsTWtaUlpWTlZkRmhvVHpOaWFXaDVXVEZSVmpSS1RFNHpRU1V6UkNaalBYRlFaMkppTlhOUVlUTTBSMmRDV0RkV09YUnhiMHRPYWt0aGNpVXlRa2R4TkVwTFQxTk5ibTVwWVNVeVJsUkdaazFYVjFoMVEzVnBha3BqZURZMFdUaHJjM04xYVRReVRHaFJTVzFuY3pBbE1rSlhVM1l3TW5wa1NIWnNlVGg2ZDJaSE4zZEpTVFZyZWxZMlNVdzVTbU5LVTFwNmVqSTVhME5YT0VaMGQzcDBVV1Z3VEhoeGVqaFZWbGxqTUU1TWFERmphRzFSUjNwWWFYWkJkeVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVowYjNSaGJHTnRaREl1Y3pNdVlXMWhlbTl1WVhkekxtTnZiU1V5Wm5SamJXUTROVEpoZURZMExtVjRaU1prYjNkdWJHOWhaRUZ6UFZSdmRHRnNMVU52YlcxaGJtUmxjaTB4TWpNeE5pMWtjQzVsZUdVPQ==

http://www.vaultsgrabstock.com/WVl6OTRQWFozVUd0NWJ5VXlSbnByWm14UFRWZFBOMVIzZGpWTWJIWk9OU1V5UW5oMVJuRlBTWElsTWtZeWR6bDVNa0ZPU2xrbE0wUW1ZejFCVjJvMVNGWnlRMGhQWkd0Sk9HRmFXbE54UW1SekpUSkNkSGxqTnpWdFlsZHJNMWxDYkdWUVV6bHhaM1Z4U1daeVdrd3laWGxWT1hFNFNtRlRWSFpHUm1sSE4zVjVkMjFZWVRONlZHRlJiVkpPU21odlZXSXhlbFJDUVdKWFZqWnRiRnBIYTBORGJtRWxNa1kzVVZaRkpUSkdOR0pOZGlVeVJtSTVOa05CYXpCSU5tTmlabmxsV1hacVVESjBjbHBqV0RCTlRYQk1hbk5RZFVSVmR5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWjBiM1JoYkdOdFpESXVjek11WVcxaGVtOXVZWGR6TG1OdmJTVXlablJqYldRNE5USmhlRFkwTG1WNFpTWmtiM2R1Ykc5aFpFRnpQVlJ2ZEdGc0xVTnZiVzFoYm1SbGNpMHhNak14Tmkxa2NDNWxlR1U9

http://www.sendnowtown.com/WVl6OTRQV2N3UWpKTFpHbHNKVEpHZG1GcFlXY3hVWGcxWkRWbVJTVXlSblpPYzJNeFFuaERWa0V5ZW1KQ1VrTnZhelJGSlRORUptTTlOMFJ1V1RWbmFFSXpiRVFsTWtKbVJYWlBKVEpHYVU1VWVXZ2xNa1o2YTJOSVZUTk5SblZDUkVKcFJrTklTbGh2TlcwbE1rWlpNbFJpT1hsVFMwcGxXaVV5UW1OcFNqVXlZV3RpUkdsdWRWRkpVSGh2TkdOU01WZDVNM2R5SlRKQ09FMTZlVlZOTTJSWVIwbFlWMkprTVhWalozQnRNbHBFYTFKcldrNWtaWFZGYWxoNGJuVmFhMlF5YUhnNE4yZzBWaloyVTJKaGFqZHlKVEpHZWpnd1JXcHVibWNsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptZEc5MFlXeGpiV1F5TG5NekxtRnRZWHB2Ym1GM2N5NWpiMjBsTW1aMFkyMWtPRFV5WVhnMk5DNWxlR1VtWkc5M2JteHZZV1JCY3oxVWIzUmhiQzFEYjIxdFlXNWtaWEl0TVRJek1UWXRaSEF1WlhobA==

http://www.chucklebestapp.com/WVl6OTRQWGRpVG01WlR6SkljMW9sTWtaclpqUXliMjhsTWtKRVpVNXpVbEoyTm5sSk5YVlpTblJTSlRKQ2VVeFBRVkpQVjFrbE0wUW1ZejFsZW1zeFltVkRRbmhOSlRKR1FsVWxNa0pWVDJGUk1UZzFRbU5qSlRKR1ozUktWSE5HUTJocGEwOUtRa2N6YkhKb2JYRk5ZU1V5UW1KUGQxa3pNV3RKTkZwS05YRndjRUZUY0RkaGVVVXpTMjVaVEVOT1dYZHhXRzluVm5OT1NHSnVjSGtsTWtZelFWSkNkMVZNVkhWMlpqWkdUMk5EU1d4eE0zVm1lSEJwVURBNFZVYzNOMmRDVDJob05FWnNaak5yYWtaYVJtTkhkVnByZG1VeE1EWkJKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlablJ2ZEdGc1kyMWtNaTV6TXk1aGJXRjZiMjVoZDNNdVkyOXRKVEptZEdOdFpEZzFNbUY0TmpRdVpYaGxKbVJ2ZDI1c2IyRmtRWE05Vkc5MFlXd3RRMjl0YldGdVpHVnlMVEV5TXpFMkxXUndMbVY0WlE9PQ==

http://www.bundlebesthost.com/WVl6OTRQVllsTWtKYWIwdzFXRWhESlRKR2VFdDJKVEpHYTNsYVRVdzBjbmxqUTJoU1pIbExhSE54SlRKQ1VIWlhTa3BSZEdFbE1rSnZKVE5FSm1NOWNUSnJZbTF3TmxKUFF6QjZWREo0U0ZCc1NraGpVVGhSTUdoUEpUSkNkMjRsTWtaemJrRnFjVWhGVUdsRWRXNXVSV2x6SlRKQ2NIZEpibEZhZFhJeGRqRkpabGt5U0Roak1XMTBabXhuYTBVMk9GSlpNM013ZVRORVpscHBObXhaYUV0VWQycG1PRk13VFRkb1RWWlNXRFp0ZDBGQlNEVjFTbkZzVXpCaGExTmtkRFF5WVU5NFdWSnNRM2RrWXpSdVNrMUZSR0Z0YmxsVWRXeFJKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlablJ2ZEdGc1kyMWtNaTV6TXk1aGJXRjZiMjVoZDNNdVkyOXRKVEptZEdOdFpEZzFNbUY0TmpRdVpYaGxKbVJ2ZDI1c2IyRmtRWE05Vkc5MFlXd3RRMjl0YldGdVpHVnlMVEV5TXpFMkxXUndMbVY0WlE9PQ==

http://www.dlchuckledl.com/WVl6OTRQVGhKWTFBMU9XVjJVRmR5Umt0MlpYbHpVamRSUVU5V2VVOTRWMGd5TXpNbE1rWjVVVFpuV2xSM2EwbGtZeVV6UkNaalBYRnFkMnRsVjAxbVNXdDJjVWRNZW0wd1N5VXlSakJ2Vm0xemNVTk1hR3hSUmswbE1rSkljbWwwVTNaVWMyUlpKVEpHWW5acmVGVjRiU1V5UmxWTmRUSm5WVXMyWW5aeVdXUTVNVXczVTFsT2JuVWxNa1pwV0d0aGJXTlJTVEVsTWtKT1EwcEdVSFptZUdNd1VGa3hZM0UwZFZOUmEzRnNNRFp5TVdSUGRFaGtWVTB6SlRKR0pUSkdkRTB6TUc1RGFGQktWalptYUhkdE5XbGljbWRMY0hKMlRWRlphWGNsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptZEc5MFlXeGpiV1F5TG5NekxtRnRZWHB2Ym1GM2N5NWpiMjBsTW1aMFkyMWtPRFV5WVhnMk5DNWxlR1VtWkc5M2JteHZZV1JCY3oxVWIzUmhiQzFEYjIxdFlXNWtaWEl0TVRJek1UWXRaSEF1WlhobA==

http://www.dlchuckledl.com/WVl6OTRQVGxtYzA5WUpUSkdUV2cyUlZOU1dqaGtKVEpHU25WalZURjVVbkZ4UVVwV1lWRmxkM2x0ZUVWUVowMXVXVGwzSlRORUptTTliSFlsTWtaUFdFdExRV0ZLTTFoaFJFUjZTV00xV1RkSmRXaEJiVzh5T0VOQmQxUkNNM1ZDZFdJNFowbFlNM1pxTWxBbE1rWlFZMnh1ZG5walZVbERRMFJuWkZaNGVYRlBaR0YzVTFSNVVYVTRWRlJaV0doaFl5VXlSamg1UzIxTFNWSTBXREZEWVNVeVJtNUZNMjFCUzBkNmExZFZSelppTlhnM2FFeGlRMVZPVm1zMWRuQjVlbGh4SlRKR2FHbFFTWHB5YUhwRmFtMHhWRWxSUlVGMVFTVXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWjBiM1JoYkdOdFpESXVjek11WVcxaGVtOXVZWGR6TG1OdmJTVXlablJqYldRNE5USmhlRFkwTG1WNFpTWmtiM2R1Ykc5aFpFRnpQVlJ2ZEdGc0xVTnZiVzFoYm1SbGNpMHhNak14Tmkxa2NDNWxlR1U9

http://www.headheartvault.com/WVl6OTRQV0pEU1c5cE1VVTJZMGh3YWlVeVFrTk9lak5RY0ZKS09WWlNjSEJQYWtKM2NDVXlRa0psVDFKVWRHOXFlV2cwSlRORUptTTlaRTExU2xWUFRsazFhMDFQTURWNldsWlNaREJKZHpWYVpqWjRValJsVjFnMU1ISXplVlZ0YlVSdFl6bE9TM0UzVTFCME1YVlljVmhhVVRnNE1uZHNja0VsTWtKU2VGbzNKVEpDU2s5TFpWcE5UblZ3SlRKR2JVcFZObGR2TnpkRldGaFFObEFsTWtaVVVXTktNbTF1VEVSVFNFOTNZM001WmtWRFZtNVFZbmx3VkZsblltbENUbk5CUTNaNFNWWjFVVmN3Y0U4d2VVbFllVEZQVGtFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbWRHOTBZV3hqYldReUxuTXpMbUZ0WVhwdmJtRjNjeTVqYjIwbE1tWjBZMjFrT0RVeVlYZzJOQzVsZUdVbVpHOTNibXh2WVdSQmN6MVViM1JoYkMxRGIyMXRZVzVrWlhJdE1USXpNVFl0WkhBdVpYaGw=

http://www.tournowsend.com/WVl6OTRQVVo0Y1hWblpIWmxkM00zTWxCNmIxZGFXSEU0ZVZBd1pVNGxNa0phVjFSTmJIVnNNbXBtU1VwNmNVSklSU1V6UkNaalBXVm9ZMmd6U3pVeU9IRm1SVWhzYm01VVptRlFRV2xVWlVVeU9XTjRSV2x3YmtOYWFtSmxSMnRRZEZjNVVFWllabEJ6Um14dk5XcG1Xa0pUYldKak1VdGpjRmcxVlRjNFZtVmhhbGR0WnpkUGJWWmtURmd5U0ZodFpUWlpTVlJTTlhGUVJUaGhXbFF5TUROWVVHbElka3RDU1c4d1FWVmpSbnBUUWpWTlRsSlBSbGRSUmsxV1NYQm1hRmRtUmpoMFZ6TlFhVnB0ZHlVelJDVXpSQ1psUFRBbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0yRWxNbVlsTW1aMGIzUmhiR050WkRJdWN6TXVZVzFoZW05dVlYZHpMbU52YlNVeVpuUmpiV1E0TlRKaGVEWTBMbVY0WlNaa2IzZHViRzloWkVGelBWUnZkR0ZzTFVOdmJXMWhibVJsY2kweE1qTXhOaTFrY0M1bGVHVT0=

http://www.packagesoftwaretowers.com/WVl6OTRQVVZQTlhnMFp6aHFOR2hhYmxFME4waDRSU1V5Um1Wb1pUa2xNa1pzU1hSVmVGQmxSallsTWtKa2RETjFTVkJ0TVZrbE0wUW1ZejFRWTI5MWVuaEtheVV5UW5wcVRuSjZTamxtVjBacFMyWTFRalpFUm1GQlRGWkVPVGxsYlZkdmVEaG5RekJWY0VOeWVYWlFXbU0zSlRKQ2NWQmFja0psVlZnMk4zaGlaWFJSTjFFNE9UY3hkVGc0U0hwemRuVnlXa1JTVnpKQmJYWkNZV05rVmlVeVJqbHVlVmtsTWtaR1ZYWkRPWFJyU0ZWaVJsUXdURmh3YVVoUk1tODRhV1Z5U0ZSM01HVktUbGszYTB0Q1JGUkpkVE40VldwTFp5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWjBiM1JoYkdOdFpESXVjek11WVcxaGVtOXVZWGR6TG1OdmJTVXlablJqYldRNE5USmhlRFkwTG1WNFpTWmtiM2R1Ykc5aFpFRnpQVlJ2ZEdGc0xVTnZiVzFoYm1SbGNpMHhNak14Tmkxa2NDNWxlR1U9

http://www.sendtodaychuckle.com/WVl6OTRQWGhhTjBObldHb3dkVTVwUVdSWWVXZEZVWFJ5WkV3bE1rSXpXbWxhYlhjMlNtdG5hemxKUTFkUmJsWlpjeVV6UkNaalBUWlNUbU0xTW1odlUwOTRhVGhqWVVoamJYRkZOVTVGTjBSWE4yaHZUbFZ0VG0wNFRHSlZUR0pDUkRCRlUyVm9TMFp2WWt4Q1FuQnZVM3BNU1VSclpVeEpRbEptTmxveUpUSkdUMmxRVmxKc056ZDRUM1pWWVNVeVJucFdZMU4yTW0xV1RuUmFNVzlMYVU0bE1rSk5RVlJ2ZFdaV1FUbGhTMVZIUW01WWMxQjJiakpDUm0wNFlqRk9NbkZPZVRkT2JYZHRhVWhCUjBVNVlXdGtkeVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVowYjNSaGJHTnRaREl1Y3pNdVlXMWhlbTl1WVhkekxtTnZiU1V5Wm5SamJXUTROVEpoZURZMExtVjRaU1prYjNkdWJHOWhaRUZ6UFZSdmRHRnNMVU52YlcxaGJtUmxjaTB4TWpNeE5pMWtjQzVsZUdVPQ==

http://www.bundlebesthost.com/WVl6OTRQVXRvSlRKQ1pIbEthbXhEVUVGVk5rdEZaVzV1Tm01c1RsVk5jakZyVUVObE5Fa2xNa0p3YkU1YU0yOHhNa2RqSlRORUptTTlTMkpEVkhkT2NVUmxURmc0VjIxSllrTTFUekZTVGsxdlpVdG1NRFpGUWxGc1ZYTnNSazlCUTIwMGRHbEJSRzQxYnlVeVFtWkxlVW8zUVU1Q1NsaDFVR3BDTUVKRFEzcFJabEV6V1VWUGNrOU9ZMDAyYzA1RlFYWkJhSHBtZGpWbldtMWtja2N4V21kNlIxWXhiM2xtU2poV1NsWlVkRVphVW1aaUpUSkdRbEJIYW1oNk1tRXpKVEpDVEV0WVIyaFJXRFUxVUhoWlZUaHljRlZuSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm5SdmRHRnNZMjFrTWk1ek15NWhiV0Y2YjI1aGQzTXVZMjl0SlRKbWRHTnRaRGcxTW1GNE5qUXVaWGhsSm1SdmQyNXNiMkZrUVhNOVZHOTBZV3d0UTI5dGJXRnVaR1Z5TFRFeU16RTJMV1J3TG1WNFpRPT0=

Remove total-commander-12316-dp.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.