» utorrent installer.exe
Overview
Analysis
File Details
Downloads (10)

utorrent installer.exe

Application Installer

Criteria Quality (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application utorrent installer.exe, “Application Installer Setup ” by Criteria Quality (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.

File name:

Publisher:

Installer (signed by Criteria Quality (Fried Cookie Ltd.))

Product:

Application Installer

Description:

Application Installer Setup

MD5:

bc994377a50d67227ae2ff46b0b8cb07

SHA-1:

5d39950da2ab32c74232db16feb289e01d032339

SHA-256:

4402df6d017c9b84f33d765fdd84ce5bf7052bc338abc6f94a32ff1bca5aca28

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

11/5/2024 7:25:41 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.Installer.Installer (M)

16.1.26.3

File size:

969.4 KB (992,656 bytes)

Product version:

1.2.7

Internet

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\utorrent installer.exe

Digital Signature

Signed by:

Criteria Quality (Fried Cookie Ltd.)

Authority:

GlobalSign nv-sa

Valid from:

12/16/2015 3:21:34 PM

Valid to:

6/29/2016 4:39:55 PM

Subject:

CN=Criteria Quality (Fried Cookie Ltd.), O=Criteria Quality (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

11216ABCF20419312093F809F0E003C850D7

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:1N7LKXirSl5g5MYuHz9GNh6zCaWM4UEIBtot+k2G:1R2XirSXXYuT9GrMDE6Rk2G

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file utorrent installer.exe has been seen being distributed by the following 10 URLs.

http://www.giftbestsafe.com/c?x=Pb2UMhxsZUAmZzbYfi36suHAf141VvfaPCxvd170b0U=&c=zLT7ByPN5H8rJ5qzl/duXd4XZ7CGcglc6YcGLiPm4MNCRUgfIPB7j65eHz6P25sY/sAA hrXG4KIcglNkQjdOFaboB11zTKTzInD8NTwrJSW0Q6tE6IsPlXL1/t26fxc&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.vaultranchbyte.com/c?x=u8KT6ciMPDF9ZLwc6wNm977cM2I tMi6zXLZ2/RGRig=&c=QNKtH4TDKHoWJ66q4nxlN27gThLp2S2l1KpTAx43WsTbb2vRmi gShwFPOXgz8p6PfOZJlcIXcHLi3tW1UisqHk tckCE4biJaTMmT1L84RbvKQnITcZGAUdeiu9Xb1G&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.tourworldmeta.com/c?x=iuGu/z3o9mC2T1lh1n6WX bAf56ZthYnsNx8rcfWPmk=&c=ctoyGq8FZsYrrkv98w5ofAK6LT5Pil7Eo76DH56l2rcqzXmrevZUJSUh ssFLXiWsH7wikEeB7pdi z9U7n6v3cLtdEfwj7ST4sh9AcsWXRqTpouwWwYFlP8Cbs1Wemk&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.tourworldmeta.com/c?x=zQAhQeuVP5yAqO372JKiaN/7kv8ipo4XaDN4Z0WreZk=&c=Q4qmNnqYRd5zOyAxzSYPKh9TgLk8ioAh95AkZWRYdSdZOIqA0FjLj3CwIG25CXvYq o0wWSPC3BYKsZXTn6c8/t3nmMwyqJqTBdoY0wG6eYDM/UINr76OqdHkQWFClbs&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.tourworldmeta.com/c?x=mYFHOE/baAvO/Gd2cSueuxe4Ga5O/evuM7zDHGJKNCQ=&c=FuwSg4vjoswXtXqChfi3VAMVSvF/woSVZ6sPrg0h1xbOX D/l7qY8ypaQDSSfBjDNjtRc5Gv/XsVh3OGrdvMAKMQF7eQCbpmPDAe5g9KbTp4MvkhPc43IQqaia3/3Ew6&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.tourworldmeta.com/c?x=tt/zwdseCnw8D0ff7A24TGM0kUyxzWuiqsD9blLGilo=&c=HUxtT4IL/OoxWJkefHHcf/Fgkrv1WLjWNLNFz42wIEqZgU5VFMcEG5YLJFa1YTaYtrMDmJwfAqDZ71MOGv5rGjBWRh1E1vNcuCwJX0n31FmQ/AoOuWqFAg6t7ADNGcpX&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.filestomes.com/c?x=osZCw1VsBB8cJZN05wFTbKPOaYLmpHPAFMVv9S0u8Jw=&c=Pr327hJ oAn64TC9PRdmoscILUYBheAmEpe0J/fDasxymAtz3AUP5C0WBOTClPi96RYV4adDi31hUnFMIKczXdeB/fp0JL2r46VnAjAzA6xQw4GWW4RUqPf0 2Mr7ndv&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.tourworldmeta.com/c?x=xw5Ia5U5OqDLFjGRuH22mq6kGhQ8g11890bLhRLgzZc=&c=/fNXyFRbbF3S0ZC/19rqbC4M GBJ2N/zz eEW2Gol7T8zCFVuS7rhCly3NiD741iF8nbeW8OWHnR40xCz f0tYupwNukqp7KH5Dtyb19Ge2 zmFLCYuyf5fM16FEiz l&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.giftbestsafe.com/c?x=ZQhUaQonLdTBR4dDpeYEQKQeq7EJTr3dik1tPxuB4 k=&c=w6JhIpuvpmRKgJ4YkzRQJeggMrX06n2eM64yXzmeJbpQGEFnfXi/30ByuY0zerbSAnHdHPGcrqNh7UjxO4uBAsD4bIXMY9UGzWaNo4MM2rSJ 3vLYWQwrqsljYVtgIpu&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.giftbestsafe.com/c?x=OYXPvdBT84trmKQ18fiapMf7nRgwNcrNW5GShtiuA8I=&c=2F38cNcIGIy9FWUl/Sac5UFvL77YYEAxYNwvg Cbo/y3yPWmd DpkshI BdanyzrhB8KZPwrLTBo7XPz7qpKJB0V9yK8BT2ID3TlnhYlPjpwk8bg92TD4yxnHnkYYV2x&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

Remove utorrent installer.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.