home

uc-browser.exe

Nebehicag

SetupSpeedy (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application uc-browser.exe, “Nebehicag Setup ” by SetupSpeedy (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Torunehona   (signed by SetupSpeedy (Fried Cookie Ltd))

Product:
Nebehicag

Description:
Nebehicag Setup

Version:
3.8.4.2

MD5:
e5db64080801152cf65f44c92725c3ce

SHA-1:
a70e3c32813abb86f182086b1ca2ff7946920f4d

SHA-256:
f3c89d0ae55e590b3406fecde8aad48b44a06e5ef35d042cd867069ca0722586

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/5/2024 11:45:07 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.3.24.6

File size:
1 MB (1,054,424 bytes)

Product version:
5.8

Copyright:
App program

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\uc-browser.exe

Digital Signature
Signed by:
SetupSpeedy (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 6:39:36 PM

Valid to:
6/8/2016 8:42:50 PM

Subject:
CN=SetupSpeedy (Fried Cookie Ltd), O=SetupSpeedy (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121EF8B655959B1CFE34F05FAFC8D598305

File PE Metadata
Compilation timestamp:
6/20/1992 3:52:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:CXtopjG3wazqXUCSrInz06ER9jTn/4x/L:C9OjGbg7SEz06EnjTwxj

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9062

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file uc-browser.exe has been seen being distributed by the following 21 URLs.

http://www.clearmeganew.com/WVl6OTRQVTFyVDFaVk9GSmxKVEpDVFZCMlFqQjNkbk0zVFRWREpUSkdNaVV5UmpWSGJXeHFiMXBUYkZkeVFWQlFTMlV3Vm1NbE0wUW1ZejFGT1ROSWNGRjBabFp4SlRKR0pUSkdaeVV5UmpKaFNXRlVVWGRhZUUwMFVFUlZjakJ1VkdWVFNub2xNa1kzWjBGRGRucGxSMnRMY0daSWJrWmtaSE5ZTlZCV01qRldPRU5ZWnpnME9GaHJlbFZJTm01RFRVZGpXRU53UW0xT2JHUnRhRkJSTWtwUmVsVk1TR0pOWTJwSVZYcHdKVEpHTTNodGQyeFJTSGwzZHpac1VtZDZkbThsTWtabWNFVlFiME4zZGpkd1JuZGthbmRPVGlVeVFuZE5aRU50VVNVelJDVXpSQ1psUFRBbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhCekpUTkJKVEpHSlRKR2MyVmpkWEpsTG1sdWJtUnNMbU52YlNVeVJsVlRKVEpHZFdNdFluSnZkM05sY2k1bGVHVWxNMFp6ZENVelJIQmFla1kxVFRkVlRIcEdUbXRxWTJGNU15MUJXVkVsTWpabEpUTkVNVFExT1RJNE9Ua3hPQ1prYjNkdWJHOWhaRUZ6UFhWakxXSnliM2R6WlhJdVpYaGw=

http://www.clearmeganew.com/WVl6OTRQVzV4VDBORlVFODFka1l3V1ZNd1lWUlNkVk5GVWtKNWJ6bGxSSGhoVkNVeVFrbG9OMVkzVkhWUmMyUjBSU1V6UkNaalBWaDNVVmhNZW5kclJHTlJhbkYwTjFwd2NYVTFNalpuVUNVeVFqSlFhbU01VWpocmEyTlRXa0o1ZEd4cVRHOVhTbkJ4VEVwR1RtaFZXbFo2Ym1sMFFYcHpVV3hCVGs1cU1WQmxiV05UVmtaamRtSWxNa0o1VUU5d1QyWjBSaVV5UW10dGVYaHZZa0l3TlVsaE1XRnhiR3htVW05bFRGVm9TR1ZFYkhOMk9WRlVhbFEyTlZNM1RrWjFSRmhCUlZCU2QwWjVWVVJsUm1sak1pVXlSalpSSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0hNbE0wRWxNa1lsTWtaelpXTjFjbVV1YVc1dVpHd3VZMjl0SlRKR1ZWTWxNa1oxWXkxaWNtOTNjMlZ5TG1WNFpTVXpSbk4wSlRORWJtdHFjRjlGWVVKd01GbGhkMHhGTFZFMlpGTnFRU1V5Tm1VbE0wUXhORFU0T0RJNU5UQTBKbVJ2ZDI1c2IyRmtRWE05ZFdNdFluSnZkM05sY2k1bGVHVT0=

http://www.clearmeganew.com/WVl6OTRQWEpSUldGaVRuRnNhbmhyTm0xaFFrbFFWRFpDT1VORmIzWjRUWFpOZFRoTGJGb3hZM3BYUVdVbE1rWWxNa1pCSlRORUptTTlSRFIxUlZKVWMwa3lUV05TVDJoa2QzSk9lVFJVZEdGdWRqaHBjVFF6Y21weFVtNTZVRVZwV1hSWmFrbFNjbkZTWjFNemJtcFpObU4xZEhseVVqZG1hVzVCZVRKMVlsYzNUVzFWVGpNMU1pVXlSak5QVkV3NGFqZDNUV050VEhKRVJIQTVTV05zYWt0SGNFOXRhMDFRTmtwek1XTnpUVVUxVm5ZMmNYaEJjMlJ1TkdScGFYTmlRa3RHVm14blZqRjNjVGwwV0ZCSVIxRWxNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndjeVV6UVNVeVJpVXlSbk5sWTNWeVpTNXBibTVrYkM1amIyMGxNa1pWVXlVeVJuVmpMV0p5YjNkelpYSXVaWGhsSlROR2MzUWxNMFJvZFVSVmQxSkZNbWQ1Wm1aeWREbHNPRWRhZWt0QkpUSTJaU1V6UkRFME5Ua3dNalU1TXpZbVpHOTNibXh2WVdSQmN6MTFZeTFpY205M2MyVnlMbVY0WlE9PQ==

http://www.clearmeganew.com/c?x=eKc4cZxv a5I 4wyiOwTJ2vXFRDP2SMiy08q4v/HrHg=&c=WYzoQ8kifQjKn4kBvGpKOohH8KIWQmkpxDD48znRG8YHwQDDgw0p tDQJV9hqJlZqnUJ8MBxhcTmKX0oKbPU1ZFAushVU7HfzdXM7trpOxyx qQiwnwWIWJRa3uMlSnbv S3LVH0fAXL/D6LnfqWyx3TkU6/G0F mKkhEcm83dk=&e=0&fallback_url=https://secure.inndl.com/.../uc-browser.exe

http://www.clearmeganew.com/c?x=jWhtWIafb2yMsSVcjB VLeWsaqIcttXe0ZQeyu06EpQ=&c=wuS1SXJ0Cz7v74Zx 9zCkqTskCp/fn4CeEnalNKKXWf2UqAbHVXmajnCAp8HRFn9kOJP2slUL7Om0QRJjQCcsyCSfJzoV9i kHoCofIzYx0JkdmfOYppAIXBNm9IixO2dn1yhX03BELspEPz4DbdB9IWrymKaQiZRpugR7bt67g=&e=0&fallback_url=https://secure.inndl.com/.../uc-browser.exe

http://www.clearmeganew.com/c?x=SiyoGYefvrYrdebJrqeEg410CMWDiVGNzOy8VMxwiBI=&c=Plj/NZ94S1Q2SAeZhgjUsAauGCifsAmxT20N4jc7BKzfw86awlM3YQxbbkzwZkhWKjq6u1Wsl14MOkLv33JYqqIvfqnlagr0O1rD2Y2YcHSHhSzwWQjk2R2EeTjl0PS/&fallback_url=https://secure.inndl.com/.../uc-browser.exe

http://www.clearmeganew.com/c?x=aAObm22tT2MgCBGgcb4qnQQu9el/rTSUCYiIW47mxrw=&c=ZARXPXAGO6UQ2FAKtBbgTdMaQf/aLpyEcVPpQDqKJDx9MccVbRtXuBD/7QK7tn4f9AaLkPurM6GOEstVs0tvD7EZusfi4p7tyD6LntIbC7xkIgnhMshcb5bi2eWOgybkb2VV97thjul2/2ieAVSzaleecRucSUfkSZKX0nOlaLg=&e=0&fallback_url=https://secure.inndl.com/.../uc-browser.exe

http://www.clearmeganew.com/c?x=6VLxYGGgUPNmeu80x8ciVwFt7FGC2vG57tpC2Qi66Jo=&c=svc/sgaDLZSDH23eI1QbYNioWUoIbt2sP srUBuLWmm5oI/djhA4H7JMhzCBrM51WwLYIiqJ1THL3zqcU5x0FLx63mskpJwnjzjfne6IvWFP85fTCgHhgPCmXe1lcBJUcPmrcJdbW1YHHH1l34LCIVw55T6drs/gCatUWcEPhm0=&e=0&fallback_url=https://secure.inndl.com/.../uc-browser.exe

http://www.clearmeganew.com/c?x=pOWUeM1hRiQCY4PD3mS6S1m0D/OI5lRWRMvueXwfeSQ=&c=xu3ZVgPBKgBHThmnPqfZYT0Uutv7rtgPelN7NrJ6Wz/JEn7guqtdXQBZ3BIYCW2zzyKeU1cSdh 0uIsK46lusK6FU9VF3srnMefpbPDNPCo9bzMMYMYMpVvW30XMk6G7&fallback_url=https://secure.inndl.com/.../uc-browser.exe

http://www.clearmeganew.com/c?x=6mc0fXYPblhOc3/Kuy0tUDSjgSkwAevBV8mzNzDOoDk=&c=prCbvKB0e86kFQLeDOttoRGJdK0k4Te1ZW8etoBI/UVh6VFIBk/KKi4ANNaba9mDMY7/CK5gDwk9zyY3AHWq8B5OTVvfxmNl5nrA8LNVz2I1emkNDXOSyMaHOu2ACu/tfcHjvgMcDHHRCZO JMuW5fav0KVRROzgmRoMR8L t4Q=&e=0&fallback_url=https://secure.inndl.com/.../uc-browser.exe

http://www.clearmeganew.com/c?x=M4SUVvDH4JuhXnwciUq36oyzA7e0jpk765j1oYfGY U=&c=AgnrbxGEIYdnlJg3cF WOAgxryZMq65qbxVdW1uH2LthCETFQBD/KLxG DP0RzxzJ7UWJYWfs8xArEwm9Te0FQdx wvHZCT3q53ppt5VTWik IPZZQotj33EG2dw 7D/&fallback_url=https://secure.inndl.com/.../uc-browser.exe

http://www.clearmeganew.com/WVl6OTRQV0Y0V25odFJHTlRSVTVpVFVkd1N6ZGxOMmRDYlVSdWJFVndXa0pDUkZGTGRVZDFRVEZXVTB0Q1IxVWxNMFFtWXoxbVpXbHpWR0l5Y1UxMk5qbEZTbmhMVURkdWIxVWxNa0pMZG5wQ09UWndRMjhsTWtadk1rMDBja1ZZT1VwaldrdzFSVXREVlVwclJVdHhPRmRFVUhRbE1rSmlVa014Um05SVZFRlNXVU13ZFZORE1XeE5OakZxTVVKdVdHTjZlbU5XYjNSMmVXTldWR0Y1VkdGTlQzSXpjVGRwTlRaWUpUSkNibkpTTUdsTlVTVXlSalZHYTBoQ1FteFlOek5DTm5SdVJFUmxVQ1V5UW1SS2Qyc3hURGw2ZFhjbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd2N5VXpRU1V5UmlVeVJuTmxZM1Z5WlM1cGJtNWtiQzVqYjIwbE1rWlZVeVV5Um5WakxXSnliM2R6WlhJdVpYaGxKVE5HYzNRbE0wUjNhMUU0YzBWc2FHa3plRWR4V0RsWGN5MVNSRmRCSlRJMlpTVXpSREUwTlRnNU5ERXdPRGttWkc5M2JteHZZV1JCY3oxMVl5MWljbTkzYzJWeUxtVjRaUT09

http://www.clearmeganew.com/WVl6OTRQVVpxWWxGUk1GQWxNa0pYTXpkaVVrUndValJoU1UwNVpEQlhSaVV5Um5wWE1WSmxNazF3TjJkcWVVcEdXV0Z6SlRORUptTTlTVTVDSlRKQ2FuZFdOakpHTldOM1JHNXlVeVV5UW5WR056RkpOMnRKVEhGWWRUWjFaMko1ZW5ObmJURnJVVlpGYW14NFN5VXlRaVV5UW1OWFNXWlZjRk54ZG1wNVdraHphMlZxVGxaVk5rSldXSE5rYkhkcVF5VXlRazlOVWxaaFQzTmpSVzlpYzB0MGFuVmtSVkUxVWxSbGNubHViVFJJUTFFMFZqSlBaSFJQSlRKQ2FqY3hiekJIY0ZGV1drbGpUazkwYlRaaFNYQnBkVXBHVldoU1FtdEJKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjSE1sTTBFbE1rWWxNa1p6WldOMWNtVXVhVzV1Wkd3dVkyOXRKVEpHVlZNbE1rWjFZeTFpY205M2MyVnlMbVY0WlNVelJuTjBKVE5FWVROaE1HY3dZVlJCUlROR2ExOTZkRFJNVUhvM1p5VXlObVVsTTBReE5EVTVNVGN4TmpFNEptUnZkMjVzYjJGa1FYTTlkV010WW5KdmQzTmxjaTVsZUdVPQ==

http://www.clearmeganew.com/c?x=eBLTieIdZ2Gip V7yyPq0IkGVxuroZJx5BMpicPpRB8=&c=xqgLvB0ZI9uZNGWzaYA VjA6IsO 8oON3FhepNhPr6p9magX7amZe8GRmWZtCq7Xat2s0jBN epHM59xkgU0hd8wznUY VG4bHZyLyAWBCM1ogYh42/7xKnXXyGMfhp4X1tuOQ/VXTFbjks/pNfgHQ2cZQ6BSEze9ZYA8srtfRs=&e=0&fallback_url=https://secure.inndl.com/.../uc-browser.exe

http://www.clearmeganew.com/c?x=0dVBygCndEnlajFSjJxsxkxmX7GjDHSM7ZSmLNnlalI=&c=UnwO5Ol/vAuuN4HD1NXA77sg6w3G7pcZyHfK26uO/H iZQv/nQ0iu7IAEVmfl5GiU7KUNq9n/Quzs4DwHtyMOZK6O5lM9j25FzaqqE7FEBpUIDPCvDmvw5CSOygeTOLRqxQw40j1ymqkSiPDawaSEfCERZoChvh0ggQedq6qwPE=&e=0&fallback_url=https://secure.inndl.com/.../uc-browser.exe

http://www.clearmeganew.com/WVl6OTRQV3MyZEZKMVpWQkZTVFV5VDNWSlV6RnZSMHhJZFhOUWRHRlBaMkY0TWtWTmRqRmthbmRsZDNoS1RHTWxNMFFtWXoxMVJDVXlRbWxYU1RkNU0xVllVbTFVZGxkc2EzbG9VVlkwVmlVeVJuWldVVUpoZUZCcVUyVTFlV1oxV0daNFJqazFaRFVsTWtKVFlpVXlSazRsTWtKR2MzZzVNRWhYYUdZMEpUSkdiM1V5UXlVeVJuVjVWR1k1UkdkVU5XaE5KVEpHVVZsNE9UUndXa1Z6VTA5Q2VrOVRNakJJU1VoTGFGSlRaSEZPZVZaWWEwMDJURWxNVlVVNVFYZEVSR0kxU21STWJHdEpXa0ZEZVU1NE9YWndaRTk0SlRKR1dXVWxNa0k1WnlVelJDVXpSQ1psUFRBbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhCekpUTkJKVEpHSlRKR2MyVmpkWEpsTG1sdWJtUnNMbU52YlNVeVJsVlRKVEpHZFdNdFluSnZkM05sY2k1bGVHVWxNMFp6ZENVelJFeEVRWFk0T1VsVlpqQnFVMWRoUmt4aU4xTlphbWNsTWpabEpUTkVNVFExT0RrMU1UQTFOaVprYjNkdWJHOWhaRUZ6UFhWakxXSnliM2R6WlhJdVpYaGw=

http://www.clearmeganew.com/WVl6OTRQVXgyVFZneGRuZFhXa2hGVTFsS09HUmxOMFZYWVdOc2RISnhhRGw0ZVhONE1tUm9SM2xIVUVaVmNra2xNMFFtWXoxSFltRk5RVVk0ZDBKaWVYaENXSE5RVTNkelJYY2xNa0pzYURGWE9XOVRWMjVNWmt3eWFYbFZWMU0zSlRKR1NHVlNVWHB6YnlVeVJuSnBSMDlVWkhoMlZVUm9iRk14WmxvNFRVeGFNemxKTTNKT2MweHZTVFZoVm5SS00ybzBjVlJJVUZGb09GTjBhMFF3TTJ0d01uQlJSMWhDWVhvbE1rWmhlSEppVVhGSmJFNW9NR0pMYmpreVVGcDVVVUpQYXpOaFNtOW1Xblp6TVhZd2EySnFVU1V6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEJ6SlROQkpUSkdKVEpHYzJWamRYSmxMbWx1Ym1Sc0xtTnZiU1V5UmxWVEpUSkdkV010WW5KdmQzTmxjaTVsZUdVbE0wWnpkQ1V6UkdGRlFXbFlaVVJqVldjNU56ZFdYMnBaVW5OelpWRWxNalpsSlRORU1UUTFPRGd5TWpZeU9TWmtiM2R1Ykc5aFpFRnpQWFZqTFdKeWIzZHpaWEl1WlhobA==

http://www.clearmeganew.com/WVl6OTRQVTlFU1dWT1oyY3hSWEp0WnpVNEpUSkdabEF5TUU5MFdFZDVSVFZ5VUZWa1dFcGtUWHBCZG10cU5FVXpjeVV6UkNaalBYQlJkMU1sTWtaSWRHeFpiMGREUVdaRk4zRmFaazVpVEhOclpGSlFRamRzVlRoNmJsRmFPRWRYU1NVeVFteExWREJuWjNJM2JDVXlSa1J6WmxOd1RFZDNSalp6ZDFjbE1rSnNKVEpHVW01RE5EZ2xNa1k1Vm1aM1QweHNUMlJ5VEdSS1pHNUtORkZIUVdWdGJHeE5ibWRJUVU1eVNrcFlOVVZzUkcxSVNGaHJaSFJxWjBWVGVFcHJha1F5TTNkNllYbENKVEpHUzJNNFlXMTNhbG95YTNsQ2RIZEJKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjSE1sTTBFbE1rWWxNa1p6WldOMWNtVXVhVzV1Wkd3dVkyOXRKVEpHVlZNbE1rWjFZeTFpY205M2MyVnlMbVY0WlNVelJuTjBKVE5FZUdsR0xXTXhOM0JGVlVseVFtSlJNMkpXT0dvMlVTVXlObVVsTTBReE5EVTROemN5T1RVMEptUnZkMjVzYjJGa1FYTTlkV010WW5KdmQzTmxjaTVsZUdVPQ==

http://www.clearmeganew.com/c?x=2dva0BUGUqqrPsi9SF6h8C8ggwVwxoPIPiaVUiobrVE=&c=b2CFB0DIZDQHcxcryJ3KsjSGQQ73jS7oQuK/8QCwzAJc4gQwDLqLilGhMdtCf1nj1Sc4KcM w1/is1WAvJpVgndGf03pFoasZYRSAwU86Pqc59dI4lEG2ThqA4EWfhUmPM5h0mmjQuLK3xlUgyRO6yUJOh2le7 lyQE8W1zfxi0=&e=0&fallback_url=https://secure.inndl.com/.../uc-browser.exe

http://www.clearmeganew.com/c?x=p9MhdGQKohlysGIcHxmy63Fnl/ya9Brpm1eY6BmfU6M=&c=tZZVqbWhn2adrMIqpUGQ6DXxh7JHcG8ZE8F6E9GtSD1hadXqPEbjF267xjdcesToG2X8dO9vecNBWhqxNZkeqNxFHaVshys1S5QiTbFZ8hiH2OYbOZOeL64eK/6aaUzlM0xVzm4Ad5Ec0Qw2X0j17aSb8Rvt DA7qaodpPRbE/g=&e=0&fallback_url=https://secure.inndl.com/.../uc-browser.exe

http://www.clearmeganew.com/c?x=wQqWE7ZV ZGU0OVA3iAs7xVpsJYCUbcjHXj9JaScPM0=&c=yInkQlk9iZtLP yHgaIJfZSCRtL5ToB1GlFuUcMdCO2qrpAZ5irHhE1v/ikNl79c5TwtGwczcdUzbwC9m8LNCTlgS1JPV2lhDDee9Kpce0r/nGO/1rRAoI/boXMjPWXYsMjJCGAN0 R3ycGdtuz6CWqzn6kzeQZAhphmzonKPpQ=&e=0&fallback_url=https://secure.inndl.com/.../uc-browser.exe

Remove uc-browser.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.