home

whos_your_daddy.exe

Gulaboda

Morava Group

The application whos_your_daddy.exe, “Gulaboda Setup ” by Morava Group has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.appscleanflash.com and multiple other hosts.
Publisher:
Morava Group  (signed and verified)

Product:
Gulaboda

Description:
Gulaboda Setup

MD5:
33b4ed7ff21425bc37fb8d2b03d65ff7

SHA-1:
f63e4d7ab28ad074e290646a831fa2dbfe7b73a8

SHA-256:
470cdd0e62352ce28e48226ff66f5d2c50b5eeca69ed0b464f6046cdb2ec12d9

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/6/2024 6:26:06 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.MoravaGr.Installer (M)
16.4.12.22

File size:
990.9 KB (1,014,672 bytes)

Product version:
2.0

Copyright:
Installer Web Program

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\whos_your_daddy.exe

Digital Signature
Signed by:
Morava Group

Authority:
GlobalSign nv-sa

Valid from:
3/7/2016 3:28:01 AM

Valid to:
3/8/2017 3:28:01 AM

Subject:
CN=Morava Group, O=Morava Group, L=Towson, C=US

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121A83F14C1C6D435814D1A4B9EC949DB5C

File PE Metadata
Compilation timestamp:
2/24/2012 2:19:59 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
24576:kBQ+zq5wopK/3Oja75ZvJ4POZEJw/slrDXb0:k2iqeopK/3OeEOZE+KrDg

Entry address:
0x39E3

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, D8, 91, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B8, 80, 40, 00, 55, FF, 15, C0, 82, 40, 00, 6A, 08, A3, B8, 2E, 47, 00, E8, 37, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, D0, 2D, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 1C, 93, 40, 00, FF, 15, 84, 81, 40, 00, 68, 04, 93, 40, 00, 68, C0, AD, 46, 00, E8, 19, 27, 00, 00, FF, 15, B4, 80, 40, 00, 50, BF, A0, 30, 4C, 00, 57, E8, 07, 27, 00, 00...
 
[+]

Entropy:
7.9629

Packer / compiler:
Nullsoft install system v2.x

Code size:
28 KB (28,672 bytes)

The file whos_your_daddy.exe has been seen being distributed by the following 36 URLs.

http://www.appscleanflash.com/c?x=ijJfZeMeGv4oWQbc7ifGxw7 Izt06tzmpqh1pztr3I0=&c=0801Lyagyk6mUQGMv3WeVNohqf/hCJbLIS8XoleGGhwHMqbJhf5jgyPfkPilgSeddlxvuWPyuIuyjSq7wYn1jWy7/JcJIp5LaNmmo1i6EP/u8 Ap/.../JHCUm3qjet I5kPZkRtetQexsbuOibxYw=&e=0&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=rficbb weN1gpCIO3TQpLjUzZSX6CSLh1f5IRve2eOc=&c=/.../RwRl8QKfuRoIQTLWmDJf6tePXzB&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=bl8w 6RqtaIOBhCaR6dPHlQX6bC0eNS6UDIFdy1PCpY=&c=fvlkhQttiNb07D5Vn9cYelOiKZn5S3wQByIYkLYV3ZYLDAP PLXkzuykL29WoX9V05 GwrvTx06ZLcIBBcpBdoJif4l1s66s9PrbsEQ61vcizsanGyQKuaFNYd9FTWxdrQvRkZcpzfDy34XKpomsDBz5oPP EPMRagzXFST7AV0=&e=0&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=i2cdhL Fhn03X6v/tOz5sgvoN7Y8WqJyL/qj3m QA3U=&c=jD4qwbPLrDaX 96sLO/kGuezqtNc T3HDQW84g6O5MYSlHnSg1qS0nHQbr5DYNnvE/.../IqzpqJgq5jH7sW87sLCQa05a49D5WhrHW5&e=0&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=YNUfCeh8shCDC8K/DSyWpI1/.../7PWEMvR2s9SH7yVcyLY40=&e=0&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/.../owv8XjHoZscjtbEKT7DIcWz4uesZBHZmI9JblkuHLDoRCRW&e=0&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=NEt1G5ERYtlFkxz1/q0Dchq5O9w7T0JAIW1RA1f/aKk=&c=mlJ GZb/d/.../1HvLCWVH7tPkt MSObYNYy6opsFORw8AGpuEyKHASpzCXhqZvw q1Ck=&e=0&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=pbpOO2S7TrBf/Nr2EE B7/.../5jQkEwNxwpsEL8YlkAfWft4eOUG0 cZ5MHTjjzLejFwTP550WNT56uwJRAkhxdpsArGa8UMxe4I6MEPK7viWWlvazrqJvbs6PPpQidSkkuU0EEVTIP8JYj2MBDaG vPpvGihUeWH7oPfobgx0ZMybrnGTBRo9Gz7Zaok3Se90n4R&e=0&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/.../tSzeB4StdrlWnZsWSR2 H8gAEX QHp6qCtjlyFSTKGDSWse7QRmjCt7bAlwzbiXuNhaeB4ePlfLujYGDfoKaTCLYlJHUmKajwlBDMuQzLwjmePv90Izo8WsXQvDFPp1D48FCJ83blykE470BC9kJjibiA&e=0&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=p vsR/k9OvcLAv00TwIp5jecQ/.../Feq vM9TUh7Qa00SUj1tWT6fMrAXfQnJMLvm4HoWjLxQw4eqxR4Wln8cIOzDWatj0Lzf6FFjPDSdtvgQsYWj5zCv1zobI=&e=0&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=YiNeeHC hH kKVsjdP5ot/.../Vd8399bEfXGv0eyGA9xtiSuY0pujs1Rm7XDo 2lDEByyp0hkEmmLwp1fWvnfAB60y3IvaqtcyuXsvahJBM6faOnxJXSjzIL9qV&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=8TehEXzXo26gR3vtaHr7PYkNLorqG mClNqFa7Rh8OA=&c=qP/rIsg02A5Eb05vubddTxa5uiM20Tcz2ZkE6bLi4GrtsDiEyg8xrLSirWMm8Pi4mBmTPWDPmL9F5PUl3Gei7fBOMDlbGOoI lwS0B2c94sN8Wci1Q/.../ZVQLEltLANLKJbRttM=&e=0&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=BV0h5NyzlCm0urYUIQDCfRTLOR9SejIxoh/HFA/jjp8=&c=kxaHnIJxBtdYc9hEP29F33JxSraIWXh6Hfhes6st0byXNSPKKHXBa5guMxZg4tikMORFL4lu6hD1by/.../usikAzdZxnNvY9OSDcQ00RUM3XzqiTNQaJVun7sBdQ=&e=0&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=5nu pbFNzjF20T ppykfE6ShQ3KoucGHYsqwc/Pnn k=&c=obsKHpLzSAGrZ 2BSdS1AxHho4pgPSBRoKevdeH8mhA1UGLXC8dxUMSmO6ymiKKim8 Z0BCmZcHTolRk9HVcMQNoWbaQxeBWsLYGEbpMSAWMHfmUMLQ5n0jGSkpUyEOqlJZq/.../6Arhs7LlFV8bcYtQNaTIQMj3rmVzPXLQ=&e=0&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=cx6Sf6Ia4P njtYgNo39WPHOo0L3pIB0yXWPZA7TdwQ=&c=lX6Lut5OAuMH5h egtKZTL7pjY84dN6 HkkWcp6rpO7Fr12e7gJbwPJR8oGThSZdD066OFeD19q2CjpJMdRNTAnz1S3HwYwW5ygGOSCoiu/.../gfg7SS3qNw5bp1DNEm25NuflRazoQil9kduHuD&e=0&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=7HwWckgk3ZFloGCWrmQCCMy2v3CbM/eS5cseCrw/.../n3CQOLoG95ebXkkNw9RLUSbr49CfuwS0fUSjEtEU11GEN&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=92e9EER2t/QMESJQgd2AzLxzlD3F5T1sE59unpi9qA0=&c=h6BhX1fB7i9QPcdyVZAM1nkp00qXn49YbBQ8YZ5tZ7mrG/aGtC1JijPxiQqQQSdldAJlGhwkyTPrMxzoCnSyO6weX11nv7MnK4PJJJai/bfBQKumVUdzku8XRUeAKgd30VChNsicLGyjl hz/.../wQJ1LR9xPkL7OTVvVkNM3j69dL&e=0&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=2xFKv0wYSQjLu19Y0hm0aXOY1mW9ovivG8iUi7k6rKo=&c=XphLHKJ9XoGR8kSlBhjeil2qtLgmhwNp/7CqS3WFQSrVM7iMDYb5P2ImzI9noVlV8LqPErEqpoJLudJszNHP22dxOA/.../O1j4ozcZxGUgL4f&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/.../GWV H5bcb4OS2u4oJGoONrhkp6EBpkgU8m9YRHTv2Darrrm7UD2yUEEXzZx2pSj0mDyRUsYwZctOAUMtBdMmhuHLBy5MDyXuE347OyUIJWstO2gn&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=U/n897h4rLZmJ6uW6W0Fl2xcabMcDhiVImpl9TL22UU=&c=faij3ogyyt9TUqvzkkWf7fyCCAs6NeyvI5T1x65nfAbvyTsBCkhywvsLFkd cQu2VAzx5Y6ZyGD6CQYdsgDRAgPKZyhBmro5hcXr3P6XyWpc31JHrV7cVm2MkcEGqCzUy8VCGj/.../l6X3imt9JmHkS1ctuDeivBxHPSUB9xyhHpju0ZdRVHn Xm1jtRl&e=0&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/.../lW9nzgYMrETuMNEmjV8566Dc ReKpYv1U7zhIUu9zzdDqRW6KT4zXWU8iA1nJnWO3HIHchC8&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=HvZhw0/MTxeIoKtFyVp9SGtK8frAnuTbWQCDrjk9CnM=&c=6e7iUghQGTw/uUyzVGNRneXOduZlNHyDnzG9UPG7YVOx/.../pTqLaGcs13ErhwbdBhSQtgBxEXR3pH9zGEdsXg6dOuUSUmbpqh4NBZKi5pXTvJaO3ipFiy4=&e=0&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=CgD QVI6rPzvtmJDhY9OlqH3GL58lUbm3 CeyROQnJA=&c=FBIEcYekGt6Hvr3NErlJ01RHimDDdgy9IdJwh2G5mzbYUFBubtthqOZ6jQmgZlm1uqO4xhHe0UbdYw7ShuqDISirMpeovHv5Qw5yZaomWveZA9A2fgTmkxIYY6MgPIvjf3/Dm/.../uA1hZunwaRHOQk=&e=0&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=7QO8Nw8zXHPySLAbndQv8U9wJ50TZN9X2ebexfxMhFk=&c=Aqq1bXqqKAlXbkfUamDIBdgRvq1Chg0QFO6uRlLTCdQH69RVE7CdVEiq1 oh 7yufR/.../YE1I 7mZAg64K60g7 ZpMDOrbDWgxPclvL8xHWNvl5r1gIGkEzp9ccB29FMAr&e=0&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=4t49 24O7giFox0tjWFgJDi3Qc7Shvz VUT M2nOhvo=&c=MmliS1RE 7BF2Imcnbq5hsFJfDlmZhUzGnR/.../wadjWU0GCvNmx8GUaj0mgAPg5K8JH84Kt8x5qWhwbYN8LXuvOGlqMc0BxomTjleFOlmUIRo43Gb7NXuKgrv&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=NySyeyojmGrb9gWZ78aZ2lCnC9KVY0IbkNUe0sao yM=&c=P1P12TncgCvaEifA8joRjwKtF4OBekUXh7ideIOzK1c/gQ/ctItwTXBDDUxGuB6mzTwV7nZk1sj9Y8BH8nmDMgFlmA/vxR2PBZPheshFBU/bTA8Rq2ejlPxv4hUX0K Z4JmUc3uwMcJNdXCSVtw6BnxsIWHoDbP2Am6vJtJ1DQA/2/.../SVbpC&e=0&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=ZkDOeS4UNTHSdR20Sc881EIdkS/.../zeTAdwici8VZ 9M7yik04bTnktb2trvu&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=SphyVO/dQ5N8EH3i3hZPohQFd50X2QbBYiHaW4fQRrA=&c=knLrt3QVy3r8Ag0uyN/IGU/Tg1 oFMTR4nktiEwM5AE5xbYJCuSzRGKI2u4Vt9/MOqaBnGeErVbmNvhf69KL/.../t9cgnT2PWPrgMXkOLbc9YsMkgTu7cO60T6YQc3TFQ5&e=0&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=BfNpK6NhLaYXC9kpPcVRXP0h3i/0NTVfQGatiLXIZqY=&c=Xz1gvebO/.../Hhw gn5xm&e=0&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=ghn M69HvPjqL0PczmDClhTiBwtyvScl8cz SGFgEnw=&c=JQdC3mjULdGHCdNqEuEtNRkPtNyx6nuhKki9B0DQF1U6K wy/qRDfKyxSb5J/6vTpjouLztrUtB2L/Gh/.../FCQY L3Uy1li9ZAI46TxZtO1asVtZ4lR9ctf5uk ro4DaqN&e=0&downloadAs=whos_your_daddy.exe&fallback_url=Fallback URL

Latest 30 of 36 download URLs

Remove whos_your_daddy.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.