home

utorrent installer.exe

Application Installer

Criteria Quality (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application utorrent installer.exe, “Application Installer Setup ” by Criteria Quality (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Installer   (signed by Criteria Quality (Fried Cookie Ltd.))

Product:
Application Installer

Description:
Application Installer Setup

MD5:
bc994377a50d67227ae2ff46b0b8cb07

SHA-1:
5d39950da2ab32c74232db16feb289e01d032339

SHA-256:
4402df6d017c9b84f33d765fdd84ce5bf7052bc338abc6f94a32ff1bca5aca28

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/29/2024 3:34:42 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.1.26.3

File size:
969.4 KB (992,656 bytes)

Product version:
1.2.7

Copyright:
Internet

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\utorrent installer.exe

Digital Signature
Signed by:
Criteria Quality (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 3:21:34 PM

Valid to:
6/29/2016 4:39:55 PM

Subject:
CN=Criteria Quality (Fried Cookie Ltd.), O=Criteria Quality (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11216ABCF20419312093F809F0E003C850D7

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:1N7LKXirSl5g5MYuHz9GNh6zCaWM4UEIBtot+k2G:1R2XirSXXYuT9GrMDE6Rk2G

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file utorrent installer.exe has been seen being distributed by the following 10 URLs.

http://www.giftbestsafe.com/c?x=Pb2UMhxsZUAmZzbYfi36suHAf141VvfaPCxvd170b0U=&c=zLT7ByPN5H8rJ5qzl/duXd4XZ7CGcglc6YcGLiPm4MNCRUgfIPB7j65eHz6P25sY/sAA hrXG4KIcglNkQjdOFaboB11zTKTzInD8NTwrJSW0Q6tE6IsPlXL1/t26fxc&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.vaultranchbyte.com/c?x=u8KT6ciMPDF9ZLwc6wNm977cM2I tMi6zXLZ2/RGRig=&c=QNKtH4TDKHoWJ66q4nxlN27gThLp2S2l1KpTAx43WsTbb2vRmi gShwFPOXgz8p6PfOZJlcIXcHLi3tW1UisqHk tckCE4biJaTMmT1L84RbvKQnITcZGAUdeiu9Xb1G&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.tourworldmeta.com/c?x=iuGu/z3o9mC2T1lh1n6WX bAf56ZthYnsNx8rcfWPmk=&c=ctoyGq8FZsYrrkv98w5ofAK6LT5Pil7Eo76DH56l2rcqzXmrevZUJSUh ssFLXiWsH7wikEeB7pdi z9U7n6v3cLtdEfwj7ST4sh9AcsWXRqTpouwWwYFlP8Cbs1Wemk&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.tourworldmeta.com/c?x=zQAhQeuVP5yAqO372JKiaN/7kv8ipo4XaDN4Z0WreZk=&c=Q4qmNnqYRd5zOyAxzSYPKh9TgLk8ioAh95AkZWRYdSdZOIqA0FjLj3CwIG25CXvYq o0wWSPC3BYKsZXTn6c8/t3nmMwyqJqTBdoY0wG6eYDM/UINr76OqdHkQWFClbs&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.tourworldmeta.com/c?x=mYFHOE/baAvO/Gd2cSueuxe4Ga5O/evuM7zDHGJKNCQ=&c=FuwSg4vjoswXtXqChfi3VAMVSvF/woSVZ6sPrg0h1xbOX D/l7qY8ypaQDSSfBjDNjtRc5Gv/XsVh3OGrdvMAKMQF7eQCbpmPDAe5g9KbTp4MvkhPc43IQqaia3/3Ew6&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.tourworldmeta.com/c?x=tt/zwdseCnw8D0ff7A24TGM0kUyxzWuiqsD9blLGilo=&c=HUxtT4IL/OoxWJkefHHcf/Fgkrv1WLjWNLNFz42wIEqZgU5VFMcEG5YLJFa1YTaYtrMDmJwfAqDZ71MOGv5rGjBWRh1E1vNcuCwJX0n31FmQ/AoOuWqFAg6t7ADNGcpX&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.filestomes.com/c?x=osZCw1VsBB8cJZN05wFTbKPOaYLmpHPAFMVv9S0u8Jw=&c=Pr327hJ oAn64TC9PRdmoscILUYBheAmEpe0J/fDasxymAtz3AUP5C0WBOTClPi96RYV4adDi31hUnFMIKczXdeB/fp0JL2r46VnAjAzA6xQw4GWW4RUqPf0 2Mr7ndv&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.tourworldmeta.com/c?x=xw5Ia5U5OqDLFjGRuH22mq6kGhQ8g11890bLhRLgzZc=&c=/fNXyFRbbF3S0ZC/19rqbC4M GBJ2N/zz eEW2Gol7T8zCFVuS7rhCly3NiD741iF8nbeW8OWHnR40xCz f0tYupwNukqp7KH5Dtyb19Ge2 zmFLCYuyf5fM16FEiz l&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.giftbestsafe.com/c?x=ZQhUaQonLdTBR4dDpeYEQKQeq7EJTr3dik1tPxuB4 k=&c=w6JhIpuvpmRKgJ4YkzRQJeggMrX06n2eM64yXzmeJbpQGEFnfXi/30ByuY0zerbSAnHdHPGcrqNh7UjxO4uBAsD4bIXMY9UGzWaNo4MM2rSJ 3vLYWQwrqsljYVtgIpu&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.giftbestsafe.com/c?x=OYXPvdBT84trmKQ18fiapMf7nRgwNcrNW5GShtiuA8I=&c=2F38cNcIGIy9FWUl/Sac5UFvL77YYEAxYNwvg Cbo/y3yPWmd DpkshI BdanyzrhB8KZPwrLTBo7XPz7qpKJB0V9yK8BT2ID3TlnhYlPjpwk8bg92TD4yxnHnkYYV2x&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

Remove utorrent installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.