» winamp-12928-dp.exe
Overview
Analysis
File Details
Downloads (10)

winamp-12928-dp.exe

Ranahobam

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application winamp-12928-dp.exe, “Ranahobam Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.

File name:

winamp-12928-dp.exe

Publisher:

Mode Beta (Fried Cookie Ltd) (signed and verified)

Product:

Ranahobam

Description:

Ranahobam Setup

MD5:

ca603ddf2296ad52b82d1a80ca16512a

SHA-1:

2340822eb408e7ce681849136f14dd25cba9f235

SHA-256:

0a40f418851700bf1b76c63143b8032fbf13761e0de168e0308e0503429f79c3

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

12/24/2024 5:19:46 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.FC.Installer (M)

16.4.13.18

File size:

960 KB (983,072 bytes)

Product version:

5.4

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\downloads\winamp-12928-dp.exe

Digital Signature

Signed by:

Mode Beta (Fried Cookie Ltd)

Authority:

GlobalSign nv-sa

Valid from:

12/16/2015 2:37:06 PM

Valid to:

7/7/2016 6:06:18 PM

Subject:

CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:wtM/LmFsZCYqKPXPHmteaG4s1y4DUy9FYz5StZgPMC:waT1ZCYv/mtZ4/9FYz5SDwMC

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file winamp-12928-dp.exe has been seen being distributed by the following 10 URLs.

http://www.newfilesdl.com/WVl6OTRQVTlXZGpkUWNURlpOV0kzVEVOVlkycFVaVGcwZDFoNVJWTmFVRE0xV0ZwU2RXOTFiSGw0TW5KV2RtTWxNMFFtWXoxelZERnZRa3gxUkhBM00xb2xNa1pSWVhWM1pVTlFhVlFsTWtaQlJIQWxNa1pGU0ZOdmJTVXlRbFZhTmpNNVVWQTFWMGxuWkRKVlIySnlURVJsYjBWdVZHTm9WbTlUYW05V1VtWjNOemd5VEZaR1ZEbDFjbEkzU0dreU1uVmtkWGRKZDBGMWNsZFdZMkpHU0dJemFXMXVXazU1YUV0WkpUSkNNWGhhTUZGSU5YTkRUWEZ3UW1KRFkxQXdObGRqUkVWWVFUaFNWV3B5VDNwcmMwOWxaVFIzSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm5OMGIzSmhaMlV1Wkc5aWNtVndjbTluY21GdGVTNXdiQ1V5Wm0xMWJIUnBiV1ZrYVdFbE1tWjNhVzVoYlhBMU5qWTJYMloxYkd4ZmNHd3RjR3d1WlhobEptUnZkMjVzYjJGa1FYTTlWMmx1WVcxd0xURXlPVEk0TFdSd0xtVjRaUT09

http://www.downloadguardpresent.com/WVl6OTRQVmxKV0U5S2NIUklWV1JUZUZGTWNqRndNazVJZVVORGVFNUpXRTFTSlRKR1oyeEhOakJXY1ZwQ2NVVjBVU1V6UkNaalBYZFZWM05oSlRKQ1EwTkhlazVpVWpjNU9FSkxkV3hMYkVSNFkwVjVhVmh4YTBnMWVYcERSbXMxU1dSMk9VMUtVMDFRT0NVeVFrSk9TWFJRT1VGNE1GbHBlVzFOU2twR01ESm5aVVJZZHpOUWFYbDBPRXN6U1ZWSVNqQjBSelZVYTBaWmJHUmhhMXBPTkhaVFowbDBla1ZHWkNVeVFsWnlSM1ZSSlRKR1NFeEdObkoxZDBJeVlsRndTVTlDVTFOa1FuVklUbE5WZWpkWFZ6aDJiMHhCSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm5OMGIzSmhaMlV1Wkc5aWNtVndjbTluY21GdGVTNXdiQ1V5Wm0xMWJIUnBiV1ZrYVdFbE1tWjNhVzVoYlhBMU5qWTJYMloxYkd4ZmNHd3RjR3d1WlhobEptUnZkMjVzYjJGa1FYTTlWMmx1WVcxd0xURXlPVEk0TFdSd0xtVjRaUT09

http://www.presentvaultsbyte.com/WVl6OTRQVXh4U1NVeVFuRnVaV1ZGUTA1MVQwSlphMVpuUzA1RVlYZHBTMVZNUWtJd1ozQkNkRU0zY2twVVdURklkeVV6UkNaalBXcFFNV2R4TVVNd1RsZDBZVzgyY2s1bmVXSjNkMjFIWlhGRWRVNDJNelJsUzBKclpHeEJSMGsxU1U1eWFscDFRbmxUZEhaVVREZFRlazFXY2xVNFRqVlJWRWhUTUVOeGVHbEtPVE4wTlZKcFptOU5ORFF5U2xvMlZpVXlSbmxXWlVWWFZrNTBlak5yV2sxd1JqaHpVMFZGYTBWYU16SlZaQ1V5UWtWYVRDVXlSbGRXYms0MmVUWlhURGRsTVU5RWVuWlFRMlJtY0NVeVJrb2xNa0pPV2xFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbWMzUnZjbUZuWlM1a2IySnlaWEJ5YjJkeVlXMTVMbkJzSlRKbWJYVnNkR2x0WldScFlTVXlabmRwYm1GdGNEVTJOalpmWm5Wc2JGOXdiQzF3YkM1bGVHVW1aRzkzYm14dllXUkJjejFYYVc1aGJYQXRNVEk1TWpndFpIQXVaWGhs

http://www.towertoursworld.com/WVl6OTRQVEpEYlhoRGRUUTJlR1ZWV2xReGN6aHdjREV6U2t0S2RWcDNkakp5V200NFlTVXlSbk5aT1RKWE9YTjNjeVV6UkNaalBVcGhjMlpaTTFoTVpuWnJVMEYyTXpBelYyOWFkblZJWkhaRVNsQnlPWE4yYlc1eVRXODNhSE01ZFdad2FqTnViMUp1TTJSUU4yUXpKVEpDZFdoMFRqVlFVMGd4Wkd0U2FXdFJTRkZ0ZEZoT1dETldiMHRMTUc5NVJHOHpiV1YzV0ZBNUpUSkNRVVYxYkd3MlMxWldKVEpHZUdOSlNWSXlXRTFyVkZGNUpUSkdOMWhYUkdwelRtTkRPRFZQTlU5d2MydHdkMDgwY25Sb2NraEhPVFYzSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm5OMGIzSmhaMlV1Wkc5aWNtVndjbTluY21GdGVTNXdiQ1V5Wm0xMWJIUnBiV1ZrYVdFbE1tWjNhVzVoYlhBMU5qWTJYMloxYkd4ZmNHd3RjR3d1WlhobEptUnZkMjVzYjJGa1FYTTlWMmx1WVcxd0xURXlPVEk0TFdSd0xtVjRaUT09

http://www.presentvaultsbyte.com/WVl6OTRQV2hJTkU4emRXOVZKVEpDWkZKaFpsTk1NMU5hZDJ4NGVEbEJTVGcxUWtWNFkzTnhVbkZRU0VoS2QwMUJZeVV6UkNaalBXNUVOM0VsTWtabFVuRldOalJTT1hOd09EVlVSVXN3UmxOMWFFRnpPRmRwZVdWbWFrUk5RMXBYTjFwRkpUSkdWV1YwY25wNlpFZEdkWEU1TVhwTFIwRTBiazUxU0ZrbE1rWXlhVTFNY0V0Tk5XSkhabXRwVEV4T1VIZEtSMWxzYjFkblVFaHNTVWxqYlZwVVZYZFlkMFJ1VmxSSWVWTTJablJhVUhGWWRFcHhiRTVwYkZOMFMydHRibkU1WW5oaGVIZHNWVTFOU3poS1prd3dVU1V6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVp6ZEc5eVlXZGxMbVJ2WW5KbGNISnZaM0poYlhrdWNHd2xNbVp0ZFd4MGFXMWxaR2xoSlRKbWQybHVZVzF3TlRZMk5sOW1kV3hzWDNCc0xYQnNMbVY0WlNaa2IzZHViRzloWkVGelBWZHBibUZ0Y0MweE1qa3lPQzFrY0M1bGVHVT0=

http://www.towertoursworld.com/WVl6OTRQWFZ4VDJOVFFUZGtKVEpDWmtOUmVYVlJaVEZ0Wm1aVk9YcGFabGhSZEZKRGR6VjJTa2Q2YldRNWNuSTVTU1V6UkNaalBXUXdPVWhQVjJkc1ZVNUZha2hqYjNkVU5UTlRKVEpDYzNoRmVFZHdjRVpyZDNCM1VWZzNlazltY1VWd1UwMWlRa1p4TWlVeVJrWlJKVEpDUzA1U1QyMW1jRGxpZW1kVlNUUlhOazVIZEVFMlZFMHhhWEJoVFVrNFJsWmpaM28xUjBWRE1GVklZa1VsTWtaNGNuWnBXVWRFY0VJM2FqRnBObWd6TXpGV1RqSkVRV2NsTWtacWRscHlSVVJzZVZONmQzQk5VemxxSlRKQ1V6QnhUakJrWmtJbE1rSjNKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabk4wYjNKaFoyVXVaRzlpY21Wd2NtOW5jbUZ0ZVM1d2JDVXlabTExYkhScGJXVmthV0VsTW1aM2FXNWhiWEExTmpZMlgyWjFiR3hmY0d3dGNHd3VaWGhsSm1SdmQyNXNiMkZrUVhNOVYybHVZVzF3TFRFeU9USTRMV1J3TG1WNFpRPT0=

http://www.downloadguardpresent.com/WVl6OTRQVTlXTUdZd2JXVkxOM1JtVG5GUFpFTTNjM05sWlVNM1VrWWxNa0pLZFhSSmJXVTFiVXRqT1VSVGNVbG9aeVV6UkNaalBVVndSR05xVEhBbE1rWjNVV2RzT1hFM1FrSTFkRWxpY0U1MFRXTnhkV2sxTkRCRFZGWjVaMncyZVZodlZXRndOakJvWmxZMWJuVkNNSGhaY21sVU5WVk9WR3BWU2tsSE5YYzRlbVJ4ZFhrek1FRjFRM1ZUY1RkM1VUWlZiREl3Ym1kc1YyOHdXV0pxVVRSR09HdFFNR3ROYTFGYVpTVXlRazQyVW1OV1pteDJSM0JJT0U4eVNGSjFaMmczVkRkdU9VZFRXRWxYVUVGQkpUSkdkeVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVp6ZEc5eVlXZGxMbVJ2WW5KbGNISnZaM0poYlhrdWNHd2xNbVp0ZFd4MGFXMWxaR2xoSlRKbWQybHVZVzF3TlRZMk5sOW1kV3hzWDNCc0xYQnNMbVY0WlNaa2IzZHViRzloWkVGelBWZHBibUZ0Y0MweE1qa3lPQzFrY0M1bGVHVT0=

http://www.towertoursworld.com/WVl6OTRQVmxqUjNaaGJtbHVTVmx0TjJ0MVp6ZHhkRFJ2TTJablRsQnlhRlJCVGpkTVdXdE1abEIzVm5GelJIY2xNMFFtWXoxdlNqSm1UM1JGTVUxdVUxcEZibkJXU25KMVNtNDJUbXREVlU5TVdFdG9NVWRVY1ZOMFRreHpkVXRqWVd0dU5GVndRMGM0TlVNMFprSlBXVGwxVTFoTU5rbFZiemx1U2tjeVMwSlhhak01ZEdoR05HeHBaWGx1TTNnME4ycExNazVuYm5CRGNrNW9RMXBMUnpoeGJVZE1SRWRpZFdKQ1dXcEtNVzl0UkZVeWRGSXhjMnhJYldReVR6VXpVbkJFY0drbE1rSmFaa1oyZHlVelJDVXpSQ1psUFRBbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0yRWxNbVlsTW1aemRHOXlZV2RsTG1SdlluSmxjSEp2WjNKaGJYa3VjR3dsTW1adGRXeDBhVzFsWkdsaEpUSm1kMmx1WVcxd05UWTJObDltZFd4c1gzQnNMWEJzTG1WNFpTWmtiM2R1Ykc5aFpFRnpQVmRwYm1GdGNDMHhNamt5T0Mxa2NDNWxlR1U9

http://www.towertoursworld.com/WVl6OTRQV0VsTWtKdlVsUWxNa0p4WjBaYWFTVXlSaVV5UW10WlJrTldVRzlpTmtwV1FUVmxSSFEzTm1NMU56WmljV3hvTmtZemJ5VXpSQ1pqUFdOS2F6RWxNa1o2SlRKR1ZreDBNWFpyU0cxRGNUZ3lWMlF4WjBRMlIyVldVMm9sTWtabWJVTjRkSFY2UW01VVVTVXlRa0YwV21kamJXaHJOSHBNWTNab1FYRnNlRzlYTkVRd1drNXdXVUU0ZFc5UFJWWkdVRmR3Y1drMVIwcFdhV2xQYmtjbE1rWkVlV1pVTlRSR05uaHZUbk5OUmxBM2RUUnFVWFpCU1ZBbE1rWkVRV3RQUzBwVk0wVTRkbmxZY2tWRVdGRWxNa0pCUlVKMVZWWkZNSHBJV1VwbkpUTkVKVE5FSm1VOU1DWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpZU1V5WmlVeVpuTjBiM0poWjJVdVpHOWljbVZ3Y205bmNtRnRlUzV3YkNVeVptMTFiSFJwYldWa2FXRWxNbVozYVc1aGJYQTFOalkyWDJaMWJHeGZjR3d0Y0d3dVpYaGxKbVJ2ZDI1c2IyRmtRWE05VjJsdVlXMXdMVEV5T1RJNExXUndMbVY0WlE9PQ==

http://www.towertoursworld.com/WVl6OTRQV2RVYXpkc1dUQkhWRTQwZVhaUFMzZHlUMGsyUnpkeU5UZHpkRzVZWjNSeFZGSnpUV2xGWWtoMFVITWxNMFFtWXoxQ2QyaDFTMUU1TUcxemFXbExRM2hoTWlVeVJtVllNR0k0WkhWVFIwVTRSMVJtV25CbU0zRlBRMng1WjBSS1Vtc3pTVzlqVEVoME1qWm1jalIyVUNVeVFtTnBTeVV5Um05Vk1sUkxkR1F5T1U1NVRrSndiVTUwYlRKb05XMDFRbXBNWlU0bE1rWXlSMGdsTWtZd1IyeGtRazFzY21sUWJpVXlSazVCTm5rM01HSmpaRzlLZGtneVozTlhWR0kyWTNNelVHNDVRbEJGZG5aa2RqRkhVbGN4UVZFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbWMzUnZjbUZuWlM1a2IySnlaWEJ5YjJkeVlXMTVMbkJzSlRKbWJYVnNkR2x0WldScFlTVXlabmRwYm1GdGNEVTJOalpmWm5Wc2JGOXdiQzF3YkM1bGVHVW1aRzkzYm14dllXUkJjejFYYVc1aGJYQXRNVEk1TWpndFpIQXVaWGhs

Remove winamp-12928-dp.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.