home

vdownloader_setup.exe

Corafacesu

Criteria Quality (Alpha Criteria Ltd.)

The application vdownloader_setup.exe, “Corafacesu Setup ” by Criteria Quality (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.capitalsharetours.com and multiple other hosts.
Publisher:
Criteria Quality (Alpha Criteria Ltd.)  (signed and verified)

Product:
Corafacesu

Description:
Corafacesu Setup

Version:
3.4.3.3

MD5:
b855a6b0d9f44a7b677c220f018c54a9

SHA-1:
48b46bd56dd74ac021bb646b91b565a82791889a

SHA-256:
38f10725de79e550eecf08d4646cdc1e003269906d60559260e6c81f4f4cb10f

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/26/2024 2:02:00 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC.Installer (M)
16.7.13.15

File size:
1.2 MB (1,257,040 bytes)

Product version:
2.0

Copyright:
Installer Lite

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\vdownloader_setup.exe

Digital Signature
Signed by:
Criteria Quality (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/31/2015 4:14:57 PM

Valid to:
8/3/2016 7:13:33 PM

Subject:
CN=Criteria Quality (Alpha Criteria Ltd.), O=Criteria Quality (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11216B914C61A8F4896BFAF26489B9954D2A

File PE Metadata
Compilation timestamp:
6/20/1992 3:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:CQbN0+QROc2aeWwc0CinyF2Zd5cnr+Fk6xcJ4MkdvuICc:CUtQOE0FOkd5q+FnxbdvuIn

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.2917

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file vdownloader_setup.exe has been seen being distributed by the following 46 URLs.

http://www.capitalsharetours.com/h0v 4YiRKhGSTKUjdMMcMnQEj9hPWGVDai4XhfrO0gdjFSb46tgGoPMI5ZfHOwEGB8JI8U4RKCOPNal3IMbjUsI_l6GFTyV6jHUUzVO03IBlHjfqynTdDV2VY0GNNob0PjtRHGpvkY9Xy0Lo 1bNmsBuYcm_TkLjYP sN6Ic3ZDr KUBcX_x2ERsnXqieSyyiE8k5S46-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H

http://www.capitalsharetours.com/DianhylMtbMRP8I4aBSbiOyMLCr1tVIPRE6LuN7e1qN6G7nHbfo0kozlFdw7uBjGP4rm0wCERMi7faws9rD2gbG1s8duZiCFCwe5HaXWDchZK1 mKuSNxN5FumbjpPLceOH40pz17fEvSdrLjQUdywy6HBLLQzysWzULW0a8QtWhnaPkdCBvzAh_ 97dRnp1jlFZP4Gu-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H

http://www.capitalsharetours.com/HSScFn7MCX77E857hSpMr _v4bSNl4OwlXMOUtxSbRq_69NGIT2IXqxQVUACZNrcBIgLc5XyT3uEpb3AyQhkVUL_Eoj3EzleFMHMizCQD2WMlNOYkZuH2CvPGUgiwcfLqPKOPX2DiDOS_bWp 3 wLsoNBeoOEDx0lVzFvdrgyctjkcngu30=-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H-e

http://www.capitalsharetours.com/NYRObdNQroc_Bvp2WiO5Krw p1wpu7Fxsm8S01iTYBwgSvamGyhz8 MlnEQ6rZT tuFIxwCv5JAvXVYlrScj3ltpKAcbb9QjyBgXPtxzCF tfsdULFsYZNY_3NdvgcFtMdAWs87jQcLsOE1PiWL71Rbjr3DL_nHbP_E2_p3h15Sqhdv8Mgxch5QQ2weZ3cYFehK8fnFy-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H

http://www.capitalsharetours.com/LMOlXRfduXady2McYc7YM0zR2MHw07HiC3t6J1IV9C9t63dFban6Q_jAe_5xHkOYJlwV1nl_9NQBqJMSaljjAz4txhICNETJAZgmRJ2H_s7NDJZ8n_uYijJr ToLCIpONnEKnFiRYFM2aIXLT4kOaBwPJqn1225no _Wd4Z4It0uLSi9 Cl18_B8iv_VVDEKurK_DjSV-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H

http://www.capitalsharetours.com/PhK1CMOGkSErgY5vrE9RtYN8oyvEwnd2NbqXmrwUvtnK3ruLoWECssN9zggifBbJkU4xmGk7w5y4Cj19uSSb52_3z478k49fyyowBt9uNtBe2h9lJLuQzg_8IWKmWrzeeRU7t56mj9qAynriTiLl0b6DD8nFRhKYtKF4Quht9M67FLc_ZU4=-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H-e

http://www.capitalsharetours.com/z3vQKFB5himWIWsUBsSbyPvKFAxdMfNQAtohCS52DpMxv2jCYFIPyX111cjaDhLZMdgyVNg1AwbpTXnr2zNtywpTOMwCq_n2GZKwTBAod8idtBbPdcVoGcVJ1ko1RmTJxI1K Z5PMrIScVTSCY5hl3XygzNqfjHsEbnEqhVVZe7NF54hNzs=-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H-e

http://www.capitalsharetours.com/31y_QjEbCCiTQkf0UCQhJrue36geemCQXtCxLAHWNCT1Mji5pMk ccctzPgSqy5FcpzIrtsGDNqUoMARqpPkxOuXfK7L1qQFGwR7q0N_BNn0oB1F Z8MvAVrBYMUCl09OfVucLMS56qotxBdvSRrgupEraQbqp697OorVnUU2i4Q9pg06NFsoRMsBvCP9gp0gJBUdenX-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H

http://www.capitalsharetours.com/iTD0fYoBerjd0GTuUe5hRbDzkx8D4qf0Xx0POCOo6JuD CMlEX40lhgebGL0nNUIzcJZrD2HFIBoO3B31Q4LQZlcxwxAHwLRjj6lTwG2pY06IZ9qY_r24kqIJZv7cg lyLx8hYgi6bxPbJMCCBT2wzQrfY3mZrpSzM7W87LrwhU2Oqi8RU0=-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H-e

http://www.capitalsharetours.com/W7tsonFQIRTsyc4 oJWBtJ7tGpFqMo2kbj4YMFVCFSnXhmpjFFv0ENCpYBW f_q9K 3SRM 3lLykkYR VpnavvwZ9Eejs6dNbHnp1jFnwnn2R t__5huilSIpRiqVYUCoAhdWWFxzd qvK3IOYeDj5E_jNgcCkTidF6fGTMFKJOeB6D8DhK3aDYvOcuDErGsd33zFu2-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H

http://www.capitalsharetours.com/0UFUrHYHMWw5KmPkdP0RG9LRJllDsqlOy_gu7PJ2izHpPyKjxMXGYvGrXDE7QFBfoUTXW3BJlOOwgkF0FfdSm2JwvU4zXmG1B8WEBbl6YU5352AfKrPx5XsR8L8qunhrMixgBC0dHujE1ImF69yAIlnb33L3se1AiGqZdW_jYQrD1Rfez0ug0T_rcXJIOtfv6y_kq00D-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H

http://www.capitalsharetours.com/J60CE2AGQNg Cz0hbNdh12UYO4_U78BTInK0FfEmC_6zOIZKKYKVkqtJcVkxQVcGaayd3 0inSAbWneJQ0YLkaQtI8imE67tXMlBgOnsYIGoSp1sHmL5OAfs0IYeiGMzvD5CxXMivJBQhDz3SF2LnpO46q FVxxbu 2ydmYJqFSTULi4aud9xeVZNumiw7qHYQiN2oQ-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H

http://www.capitalsharetours.com/w9OgXD5QlWVuLmQSjvRzFqM1fHEPBIwNES4 zS2LxtshpB1KawOd_vvzAPh5zYb5wcVSDCn9zoFgEgJ_51e4TKBDeqKvWmQCc6Jk9Q2Nany6VdtsgGyWqrwkPrxfY6TBSMOWepRUeo7zh0nz1ILCbciqPVn4tljgdEgn6SMQbkLDOWTgsv5LpHKUZ5Bi4CVNoC6b5YiR-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H

http://www.capitalsharetours.com/AWbw zD_BhVD3kKXWQiGbhnyMqpoBo38de6zIx0U0QyV14xBrPjOQalT1iW7czyv5f_6dq_EnUXkmwsMhhi0QNStjoUUFgK1I2BTzrTYDedp2tO3p_AxElf4ePGb3wlrHEYKg3k6kIUAqKySSjNlq98HLT0ccTpry8wKDpu4 xuCLrxyDuY=-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H-e

http://www.capitalsharetours.com/OjfCCK08hwJO0ZudS6ajUUf14IMUERgfOsTMffbU7i1Sty9ZlgxG2l42pYCo48wn8 QqsUWLaD84 UiQaQo7hCVI9uRdVuFKIDbZzlI2m2AyZkz6rSMlsDQtV4IQ0b7_t21oVsRX8t 3mc2nWo8nCVNZn1tDVy12601KHeZR7ZOhv5vgoQtkLtYIRS_uEtpsb4DaT40N-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H

http://www.capitalsharetours.com/MOH27urmsb1O6MWgkqatfPsXGydLAmSpdE7Xvn1DoqWUwxe1Ay3ABWYwaXw3M3YMuGU_VwFrnOc5FlZfZDOrq4Aqls7qoh BL_980Gg_UkebHnbgDEdHgSPihLt88yyXVpDGFf5Xi1nUzEzeNsBD3uIPNO0vYAyD2ESd31ZBJImNB0u5TwY=-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H-e

http://www.capitalsharetours.com/MearSZG6F5Fgyqe0kN7rZCUZvLnQAsB6mefb7j97H3w3E8OuMVlwYKzOgFtOscmdoU2woabSOqjqqXYuj6yWflXcRBO67VWlmg62HGSwzTFGVeyhNVN_1zRDkOegsX6kWSTyO8hqXxui4wJrMSTMwu9T9m5nRslJuSLXbkASg_jeTzq_7zk=-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H-e

http://www.capitalsharetours.com/MhSYy6TIY9yIM73cJze8v_5hKdEYxHM6ZeB4931GeyUzTB_ViCoEN8fjA07iycvbSFVKuBRXIDlI1yuEpSBxUthTdDQ6wPsexkUOGrJHIQh1rF6L EjfkKX1JP44K typN7slA8ly9ajrBn3Bz WmRJ7xKWHrvU1cuzOjBHYx0RtyKOH2mOwkJp92Yg0XLl9JA8cvUnZ-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H

http://www.capitalsharetours.com/IDHAiiszvYfN AVef0iUTf R4tcGhVg9NVzwav9ZY1WViyKEgsEKBzxHP8h1GpxnQL6H7SulMw77YMbabQy54zIbcCvNopXd1iYbLAXXCfrjWw6hXcG_6U4B4udAuQcD6rbr6ZQcNTbn7k0xwWBkHLf 6_JuIjpPWQuDgUakrU7_uyLkbSSIIV2DB9s8yRufK5TParFX-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H

http://www.capitalsharetours.com/AR56yQP 9qVacRwUsoNqBZmIclTaAgiHMp_sLUmBMwIyhTXoy652fZKOzt5KiCc1EpqKty2ELtMzwfiQLyNM_5uxieXI9_JVqFSL01aw8q53OURbXPs2kcMzgQpEdWezcAjc CUwOcD0ZB475j qlQvVVRwHjheXyoxHWbuBdRyG8xNeT5hmpe6OzjUmY_mk7JJc3Zu3-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H

http://www.capitalsharetours.com/SA6bma4YjwjZHDm8dHRwN1gQWSHMq_hjxd7_EQQUcwCOQHe1iunOXQjOeaQguGCynjBYneY6AYQPoY8g0btWO2kwmfIJyYDqazLE4rMZ0jlVItCSH1LmYSUWxF 9aHDERuc4UYNZ7IvBcwHwDfm2T_9w0ir27oz4pIizRdxZK5UCPHa3oWz27KQOdrbAdyreWDWvrqW5-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H

http://www.capitalsharetours.com/PDvYLRwoqZizFpwMYNTtl8GK9lPdItls4IAaboQL3ifcweyKj0mGT2IjhsTjr 9UPg6DhKV16xLADJ3Enjauaho8n61 BleOI75pugEmdreXR3iWeivSPjQbRNy0yKa2SvvZ33yQAyK3xv8iUm5G0N7dPuzPJV7VG_QnpbGgQIksSMYXrlRuHxuXkSd50mOfFzvgQptJ-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H

http://www.capitalsharetours.com/1gGBM4Sy_t vzPORgXZOA atI8RaHkP9OrKjhMSBnYkI6s1XTuZrFP Laef7ipOekFsBSlAKh0WBFylwuBTp1EZRDG_ErR8u6wxUOLGgXthVhlUPL07jkR Vniep9b6HYUIkSQqAwhDozFywM_gpdU8rZOoYYShBe6OgtwZNGBFK3XB6NK9xBQ1F4 mZatBsZKECa3I2-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H

http://www.capitalsharetours.com/8xANLliLeVsp0jqV_oJ_tV guf6O5oJNeivWSeMaQyLsVia5iLKYdF0ghdDhD1lov2ZwSDcNLV5RZB2c_b jjouF8x nCt85_18gREBLrQxEm49U1AE MWF8R7dofHzDBc qGr34mhnX mRb7_vZm_QPzkz3Fo8zMq072pvxTK4Ny2LAjPg=-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H-e

http://www.capitalsharetours.com/IDUjWXBvas2HwttGcZEh9BqZH4M4rEBRrVaFhaQQYc2It8cuaMr5Hn6uNpTlav8q5gb6dqTVeex_WqapgX2uG8B5tXsEljZhHxpZ6RmjSEajgweKH9B335dEPe9ELtWl l_lKiYb 6_hrjd79Ov30DQ7zz_3snYqHUrzltaFn6h13M9uZXa7rxKfV84pc L8icNMwvWi-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H

http://www.capitalsharetours.com/2qUxyAcHwkqMg6sYTCQdb0cAphWgqWZFZMmUS4p530m8feyB7cdvp8ujrzxMjG8NTXQt 2yy99EQzSXrqrqAnZZ3stU749V5ksVXYW6idFlCuZVt7Dkb6brrbgG4nTPnkb8pmescgOZBXZYNCDS7YdSbZe4h4tLkEXnByRhZttmStOAowcQ=-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H-e

http://www.capitalsharetours.com/lk7LB9_YwloE8Ovit5kJAZ_vSPgneBsIYE9TIo7oHm7sbNCBk1Ycv5LcBnwF4JidHM9GEPbFo1rRYCQ0ADfInPkKfyJI568rSw0gE5nJ5uhkZeaNN 0kA81VWkWkcJYshD9r I_tDgbA57GP5xZm5eksBYWliQxbFP4BqQ4vdAp3V57n6L4mO8X7RExzKBMC1pZuIF6h-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H

http://www.capitalsharetours.com/NjasgqgP2yro3XrnG4QlKERuicqBTmktNNccnyYQOOecW0vazlCakMia4stkC71WpTmeu2sdzsb4IKvEF1aWCdTcfZe_HE0Gxw5kylb2TG7mkGracad4H92huu ppvGk M9ps25nFhb_HRM6Vxwf24HbLY7X4uOu7t9nBrHKQlputy1JDr2TGYVtHnrcAAj5sKG8p6mR-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H

http://www.capitalsharetours.com/eNfpYiRgU33091HyVEzEnLxWNG9FWEh9jJ4sysoV8foR4lqQvY6FEOBRBe9DBj_fjxtWMoiWD8VOCE0t34DAO81YWSuT_V9BC55cAQhwhlHT15gIwkX3dZ1bpz7fgSK900mDgAKXrNB3DffNMuRgGdzg8Cl2Q1DbW NeqeDs6UYP8LaajK8=-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H-e

http://www.capitalsharetours.com/2p191vYzfziLNeXRxlpDhWyMCNvB3rzyJqoM19Uhcr8RaZBLx3m0_wU9_XDu5bsXmpzHGO7dW61zPoSWG4QYEB Xqij5EIASz3IbNXJqJIFmR9wiB3NHZD8dXUx3amGfRPNu33dnvzo_F_JdVS9z3IAMwMBWqi WRaG7mZYWcfN8IaizlAd1vzJITUh SMSICIW6BZ6g-Gy0AAATqZLEpSWg2od1Us2dgAw6cAgoCW AesA3EjVfoZDJFpfOBto0H

Latest 30 of 46 download URLs

Remove vdownloader_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.