» winamp-12928-dp.exe
Overview
Analysis
File Details
Downloads (12)

winamp-12928-dp.exe

Bab

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application winamp-12928-dp.exe, “Bab Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.

File name:

winamp-12928-dp.exe

Publisher:

Mode Beta (Fried Cookie Ltd) (signed and verified)

Product:

Bab

Description:

Bab Setup

Version:

1.6.2.1

MD5:

57b6c3b0a8812234758700511b05fa09

SHA-1:

8591828215f0ec13d4e90454bb0703398c26a771

SHA-256:

c4eba790f8603295d7c0d07981d5a7988eec443bc5289111680ea4245bdcf128

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

11/15/2024 9:30:25 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.FC.Installer (M)

16.5.5.5

File size:

951.2 KB (974,072 bytes)

Product version:

1.5.2

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\downloads\winamp-12928-dp.exe

Digital Signature

Signed by:

Mode Beta (Fried Cookie Ltd)

Authority:

GlobalSign nv-sa

Valid from:

12/16/2015 2:37:06 PM

Valid to:

7/7/2016 6:06:18 PM

Subject:

CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:pvp7y5I5PpEla6JVWwIar2hfWz21GkqfQT7L7/bpoQOGZ/u:9x8culbVzIaKhc2gkqfQTz99Z/u

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file winamp-12928-dp.exe has been seen being distributed by the following 12 URLs.

http://www.headheartvault.com/WVl6OTRQVE4yTTBGTk5IY3pielJKY1ZwemNVUkRObHA1Y2paeU1teHVPRTlyYmlVeVJuSkxTemxUU0ZaVGRXZGtaeVV6UkNaalBXUktOVlV6SlRKQ05ETXlhRGw2WVRNbE1rSlljR3gxUVZrd2FGWnZZbGh0VUVZeGFXbHdVRFJ6ZVVodU9UaGphbFY1SlRKR1ptZGtXR2s1YWtWMVJ6Vm5iMHR5WjFaamNtSlphVnBsYm1obk4xcDBkRXBhV0ZOclQxWTRXVFkxVDB4bU5rWkdhVEpGUkV4c1kzTmFkbFEyVmtjM1ptRXlSbWc0VkVzMmVISlVjbWhPWldJeVZGaEpVVEpZWVc1U1pFdzJZV1JNWkZVMGVIVm1keVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVp6ZEc5eVlXZGxMbVJ2WW5KbGNISnZaM0poYlhrdWNHd2xNbVp0ZFd4MGFXMWxaR2xoSlRKbWQybHVZVzF3TlRZMk5sOW1kV3hzWDNCc0xYQnNMbVY0WlNaa2IzZHViRzloWkVGelBWZHBibUZ0Y0MweE1qa3lPQzFrY0M1bGVHVT0=

http://www.tournowsend.com/WVl6OTRQVWR0VFd3M016UkxVR2RSWTFoc0pUSkdOM2xhWm1VMWEyRjZORkJqVnpscFZtOWthMkZ0ZGxaRFluQlpWU1V6UkNaalBVeHBiR2h6VVdoMFkwMDVXamxpVUhSNE1EUkxVRkkxT0NVeVFqUk1NRFJrWVNVeVJraDJUQ1V5Um5Fd2NERkNKVEpHYVdGNlJ6bEtTVEZYWVhsRU9XSllOR3RqUWpaaU56aHNaRkJrUnlVeVJrRnZUV0Z0WTBaak5XNXJXVlZzUlRFd2JEWnVURTlNZEdnM1pqUTVUMFpPTVRWclJrcDFTR1pKZG1WT1dHbE9jemcwY0VaTk4xbG1VRlJ6TjJSSk1FNXBWa2RYUzJaM2NUTlpNQ1V5UWpSMVp5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWnpkRzl5WVdkbExtUnZZbkpsY0hKdlozSmhiWGt1Y0d3bE1tWnRkV3gwYVcxbFpHbGhKVEptZDJsdVlXMXdOVFkyTmw5bWRXeHNYM0JzTFhCc0xtVjRaU1prYjNkdWJHOWhaRUZ6UFZkcGJtRnRjQzB4TWpreU9DMWtjQzVsZUdVPQ==

http://www.vaultsgrabstock.com/WVl6OTRQVXBzSlRKQ09URmxVa0U1YVhNMlp6QlFabXczUTFKVVFrdEhZVFpoVVdReU9EQkljakJaWlV0WU4yWkxieVV6UkNaalBXbG5kSFppVGsxTWNrbFNieVV5UmpoMU5YWldjSFpLVDJ0UmFEUmpiMGxWZW5oc1FrSTNSbEp5SlRKQ1RWUjBNRmxOZDJkalIxZElRelp2ZEhKMmQzRkVaMkpWYlcxelYzRTNNR0ZDYWtsUlpWRk9VelkwWjFKM01WSlhaV2QwWXpWdVNrUjRkRWxFZW5admR6QnpiR3BRT0dsT1JqRndka00wYlRocGQzSTBTRE4yT0ZwamNFZHZjMmhOUlhwb1kxQkdTWGRHYTJ4dlkyY2xNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5oSlRKbUpUSm1jM1J2Y21GblpTNWtiMkp5WlhCeWIyZHlZVzE1TG5Cc0pUSm1iWFZzZEdsdFpXUnBZU1V5Wm5kcGJtRnRjRFUyTmpaZlpuVnNiRjl3YkMxd2JDNWxlR1VtWkc5M2JteHZZV1JCY3oxWGFXNWhiWEF0TVRJNU1qZ3RaSEF1WlhobA==

http://www.sendtodaychuckle.com/WVl6OTRQVXREWTBveWJETllZM3B5SlRKQ05EazJkbGRrTUhVbE1rSlNPSFZ1WXpWTlkyODNjR1JtZDFsR1lrdDFOa2MwSlRORUptTTljMGhrU21Wa2VUTk5WeVV5UWxRbE1rSlNjaVV5UW1SbmNYWjRObmQwY0U5VGVrWlpabUZ3TlVoNlUyaDZPRXBGUlRaSmRWcEZlWEpPUzBsd2FHRlFlRkozYm5KdVZtNUhTbEZ2UWtGdmFqZEJkbUppZEhBbE1rWnNUV1JvVDJSNFdrVllTM051UzNKQ2JFeFdWV2wwTm5sbFJGUndkV0Z4TUROaE5uVnhXVThsTWtaaFpFczVaVUpRVTI5TmNHWTNXSHByTW05Uk5uTTJUR0ZwZWxoMVVTVXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWnpkRzl5WVdkbExtUnZZbkpsY0hKdlozSmhiWGt1Y0d3bE1tWnRkV3gwYVcxbFpHbGhKVEptZDJsdVlXMXdOVFkyTmw5bWRXeHNYM0JzTFhCc0xtVjRaU1prYjNkdWJHOWhaRUZ6UFZkcGJtRnRjQzB4TWpreU9DMWtjQzVsZUdVPQ==

http://www.townbitsquick.com/WVl6OTRQWFZNWWxNbE1rWjRXbUZEY1U4eWRVTmxTblphUm5kb2NtTmxURU1sTWtKb1VrZExhVWhGVWpGclpFUjNSems0SlRORUptTTlUamRYV1VaWVQzYzBjbGdsTWtadk1Vd3hhSFpVY1d4S1ExWjVZMjFzYWtsaVpXY3dWV2gwWW5SQk0xVjFhU1V5UW5GMFpGSk9lSE5yTVV4T2RqRnNlRW95UkZaS01HaHphRGxSWW5nM1lUVkJNbHBxYjFWemRXNWpkM0pDTjBwQmFGQnNlV1pxVG13bE1rWmhjV2xhVjFoWWVIbDBiMm96TldRMlUyUnBOV1JVYzNkNVZERTNZVkJoSlRKR1NUaFJaa0UwY1U0elltZFZkM055SlRKR1p5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWnpkRzl5WVdkbExtUnZZbkpsY0hKdlozSmhiWGt1Y0d3bE1tWnRkV3gwYVcxbFpHbGhKVEptZDJsdVlXMXdOVFkyTmw5bWRXeHNYM0JzTFhCc0xtVjRaU1prYjNkdWJHOWhaRUZ6UFZkcGJtRnRjQzB4TWpreU9DMWtjQzVsZUdVPQ==

http://www.chucklebestapp.com/WVl6OTRQV1JCTUdKVmVtOU5WSE5tUTBoVE5sWlROeVV5Um10QlNWcEJURWxOYkhWNlRuSm5jbmtsTWtaS2JqUktVVXhCSlRORUptTTllbXBrTm01aE9ERkNWMUZQY0hrbE1rWlVWME41Y0ZoNFVVMUJPSGhWWjJobVlUUkxZMUZXWmtwMWMwSXpkMjlwUjA0MGIwdERhalZ0VVROWVJuWmxRMFJNWXpSaWRHNW9aRlJ6VFRRM1QyWmxiMUphVUZKdGVFVnhhMUF4Um1VMmNEVkxkMnhtVVhoNWVUaEdlazEyWlRGa1FWbE9hbEZrTVRnNU1UUldRV2xHUlVKcFZXOHdUekJETTFGUVoybGFkMHRFTm01U2FrRWxNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5oSlRKbUpUSm1jM1J2Y21GblpTNWtiMkp5WlhCeWIyZHlZVzE1TG5Cc0pUSm1iWFZzZEdsdFpXUnBZU1V5Wm5kcGJtRnRjRFUyTmpaZlpuVnNiRjl3YkMxd2JDNWxlR1VtWkc5M2JteHZZV1JCY3oxWGFXNWhiWEF0TVRJNU1qZ3RaSEF1WlhobA==

http://www.chucklebestapp.com/WVl6OTRQVTA1VlRsMlVrcFNKVEpHTm1WVWR6aElSM29sTWtKNlpFUTJTMmx5ZFRST2VVVmtNV2hRU1ZGVGJXZDJOVE4zSlRORUptTTlkRXBuVlU1blVqRjFTMnBNWlRsNlVYcDVNSEpYY1dGc05uZFdSRGR5VGtSdVpEbGtWVU00VVVkeVpraHZRMW8yWjFOaFRrazRaRms1UkZaaGMwcHNRa1kzYm1OQ1pGcFpWMjV3V25kYWFVTklSV2RZUVVOTU5XdzFOWGxIYUhRNVIwSkxUV2xyUkdORVFuZEdiV2hYWlhSd1kwSkNRbVZZVUhnd1IwSXlUR3BGUkVvMU1YTjNkM2d4TW5kbFl6bHZkRzF3VTFGM0pUTkVKVE5FSm1VOU1DWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpZU1V5WmlVeVpuTjBiM0poWjJVdVpHOWljbVZ3Y205bmNtRnRlUzV3YkNVeVptMTFiSFJwYldWa2FXRWxNbVozYVc1aGJYQTFOalkyWDJaMWJHeGZjR3d0Y0d3dVpYaGxKbVJ2ZDI1c2IyRmtRWE05VjJsdVlXMXdMVEV5T1RJNExXUndMbVY0WlE9PQ==

http://www.nowapplicationsranch.com/WVl6OTRQWHBSTVZCaGNuZENTMUVsTWtJNVVsaDVUa0p4Tm1wNVJXd3dVaVV5UW5aMkpUSkdKVEpDWm5NeFJWRTBRVXNsTWtaR09XUTBKVE5FSm1NOWNGUnFNa2xtSlRKR05FbzBRa3REUmpRbE1rWXdUMjlhZEVSclJ6WkVWREJrU2s5clZEWk5TMEZhYVVwU1ZVbHZSRlZKTTBWaGQwNWhXbkJwU0hwVE5USkthVVpvVEVGMmFHNDBkMlpxVm01YVdWbERjVWxGYVdOSkpUSkNKVEpDYWt4Q1UwaDZVMng1TW10c2RqSmtZVVozU1hGUGFtTnZlbU5PWTBveFdVMWFlaVV5UWsxVFJFbFBibGxFYkhaUloyeFVXakZJYUhocU1XOURPRFl4WnlVelJDVXpSQ1psUFRBbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0yRWxNbVlsTW1aemRHOXlZV2RsTG1SdlluSmxjSEp2WjNKaGJYa3VjR3dsTW1adGRXeDBhVzFsWkdsaEpUSm1kMmx1WVcxd05UWTJObDltZFd4c1gzQnNMWEJzTG1WNFpTWmtiM2R1Ykc5aFpFRnpQVmRwYm1GdGNDMHhNamt5T0Mxa2NDNWxlR1U9

http://www.packagesoftwaretowers.com/WVl6OTRQV0p6T0c1emFtOHdibnA1YjA5aFIxbzNiR1ZhYWlVeVJqSlJVVmhpVWtoRmRUVlNjbXB2T0c5cmRqRldNQ1V6UkNaalBVZHpVa3N4Vm5KU1MxUnJSRWxXU1dFMVdHMUpWVzVJTUZVbE1rSmxja0Y1UXpSdU56SlBKVEpDZURaQlJ6VXdTMUpyVFZCWk56UTFSR1ZyUVNVeVFrOXJRbkp0SlRKQ2QwWnNTME16V21ab2NGTkhWazFJVTJSTEpUSkdjSFZUU2psVFQyUjVKVEpDUVhBMWVVc3lWbHB1YzBsMU5ERnpSVVJWTUhGWmNEQkVRVzlJT0ROVlZVaENUWHB6UTJOa1lYZHFiWEpDTUcxbWFITjBjak5JSlRKR1FrSjNKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabk4wYjNKaFoyVXVaRzlpY21Wd2NtOW5jbUZ0ZVM1d2JDVXlabTExYkhScGJXVmthV0VsTW1aM2FXNWhiWEExTmpZMlgyWjFiR3hmY0d3dGNHd3VaWGhsSm1SdmQyNXNiMkZrUVhNOVYybHVZVzF3TFRFeU9USTRMV1J3TG1WNFpRPT0=

http://www.tournowsend.com/WVl6OTRQWGQzVWpBMFZXZFBRa0pUWVhKUVF6WkhXbk5aVWxkck4ySlhjREkyUjJWTU9HOVdOSFJHT1RGb2IzTWxNMFFtWXoxeFVIaDFla2RXT1U0NU5FNXFjMHhWSlRKQ01uSkVZbVJSTVZGU1RFNTFka1ZzSlRKQ09YRnBXV2RDVEVsQk1FdzBUVEJqYjJadU1XZEVSWGxvZG5CRUpUSkNWbEI0VlU1b2NuY2xNa0ppY1c1VGRWUTVWMEpZV0ZreVZHUmFSMDFrVVNVeVJrNUNOQ1V5UWtoRWJucFFNMnh3UkdwU2VsTmtWVFpIVkZoRU1YaFdOazVHSlRKR1MxbHRiREZ4VEVOMFZsTmlVRmhSVTNoUVFtWlFhbW81TVhkeWR5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWnpkRzl5WVdkbExtUnZZbkpsY0hKdlozSmhiWGt1Y0d3bE1tWnRkV3gwYVcxbFpHbGhKVEptZDJsdVlXMXdOVFkyTmw5bWRXeHNYM0JzTFhCc0xtVjRaU1prYjNkdWJHOWhaRUZ6UFZkcGJtRnRjQzB4TWpreU9DMWtjQzVsZUdVPQ==

http://www.dlchuckledl.com/WVl6OTRQV2sxTUU5Q1REbGxXazh6ZWxJeFpHdDFRbkJFVjJOT1pUWkpWbGhsWjB0TldrbGtPV0lsTWtaaWFqaDJjeVV6UkNaalBYTjNRMHdsTWtZelR5VXlSbkJMYUZSM2FuUlFWVWtsTWtKSmNWbHlaRlp3TnpFbE1rSTBObVpxWTFGblNHdHNOR1ZYWkVOWGFXZHZaelJHVUVwT1pYQnpZVFZWZEZWNWREbGhTVVJ2T0hCSU5VTkxkRTlaYTI5Mk5rdDFRVU5ESlRKR1lqRlZlbmwyYUVwU1RtVTBkekZOT1NVeVJrSkdNM3BZWjBkcGFEbFVkM1ppYVROT05rWkJXR1E1ZEdkamJqTm1jRWRGZHpGNlZUWWxNa0kyUzJsMFJuVm5KVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabk4wYjNKaFoyVXVaRzlpY21Wd2NtOW5jbUZ0ZVM1d2JDVXlabTExYkhScGJXVmthV0VsTW1aM2FXNWhiWEExTmpZMlgyWjFiR3hmY0d3dGNHd3VaWGhsSm1SdmQyNXNiMkZrUVhNOVYybHVZVzF3TFRFeU9USTRMV1J3TG1WNFpRPT0=

http://www.nowapplicationsranch.com/WVl6OTRQVXQwYVRFM2RHMWlNR1ZJWVNVeVFqZHlVVXRyWldwWmNYSk5ibkYzVVdKYU4yOVlkVEZSTnpoeVNXUTBOQ1V6UkNaalBXWjRlSFpDVUdWR01WQm9hRnA1TVdWRWEyTldkSFJzVWtRd05sSktSV3BMV21kelp6aFpXSGtsTWtKTVQxRWxNa0lsTWtJelV6TTBhVlI0TTFsVFRXRmFTVlpxVG1abVVuTjVRemRPYVZkSlQxbHhORGw1VW5sM1dWVmljVWxVVVZkVlRuaHdKVEpHU1ZkcVp6SnBObkZOVW1Vd2J6WnNPRFZTTlVoVGVFdHdhMUZFUkRSMU4yUnpPRWRaUTJsWmFGcDRNVzlZUzJaU1UzQldjVkZuSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm5OMGIzSmhaMlV1Wkc5aWNtVndjbTluY21GdGVTNXdiQ1V5Wm0xMWJIUnBiV1ZrYVdFbE1tWjNhVzVoYlhBMU5qWTJYMloxYkd4ZmNHd3RjR3d1WlhobEptUnZkMjVzYjJGa1FYTTlWMmx1WVcxd0xURXlPVEk0TFdSd0xtVjRaUT09

Remove winamp-12928-dp.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.