home

windows-movie-maker-2012-16-4-3522-0110-32-bits.exe

Installer

Bumpy Apps (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application windows-movie-maker-2012-16-4-3522-0110-32-bits.exe, “Installer Setup ” by Bumpy Apps (Fried Cookie) has been detected as adware by 8 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Baixaki  (signed by Bumpy Apps (Fried Cookie Ltd.))

Product:
Installer

Description:
Installer Setup

Version:
1.0.13.30550

MD5:
7f91f8596893ebe32b9875625371d02f

SHA-1:
5c90336db360f91be9f86336a7259e93a046ce9a

SHA-256:
8aca60ce927540f69505221c276efe518ee670481dc13d2812e6be4bbe8c1383

Scanner detections:
8 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/15/2024 10:45:03 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
ADWARE/InstallCore.Gen4
7.11.204.248

Comodo Security
Application.Win32.InstallCore.DL
20829

ESET NOD32
Win32/InstallCore.UQ (variant)
9.11067

G Data
Win32.Application.InstallCore.DI
15.10.24

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
15.10.30.16

Sophos
Generic PUA FM
4.98

Trend Micro House Call
Suspicious_GEN.F47V1229
7.2.303

VIPRE Antivirus
InstallCore
36940

File size:
679.6 KB (695,912 bytes)

Product version:
1.5

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\windows-movie-maker-2012-16-4-3522-0110-32-bits.exe

Digital Signature
Signed by:
Bumpy Apps (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/10/2014 2:14:20 PM

Valid to:
12/11/2015 2:14:20 PM

Subject:
CN=Bumpy Apps (Fried Cookie Ltd.), O=Bumpy Apps (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121B000FF2DA5043B97A16823C79402FCDC

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:oaopbhpAM3XI6da76QikQ7TE5gflVCo5jOptDbBY5IIAwfMC7DCgj/5BsqBDryKJ:oaoNhn3XNa7HCYgLbItDdYu8MjgL5Bpb

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file windows-movie-maker-2012-16-4-3522-0110-32-bits.exe has been seen being distributed by the following 2 URLs.

http://d.baixakifiles2.com/?ic_user_id=9289&data=OqvQm6rp9rjmNFteQWkIrUuNYvUrSpnmCRt95o/iadT0MFCRaYx8PUn88FMruz4aYYkoJVQ15heBnhz8xBCTpb IH8kV9ob/ECt5Wf/APCrW585ohEMToDOoDPVDda4pGHYzRB849ZIJ1fNB09VQvK/4A0FaGOd zhkXE/QDPsMcN8zwTQVsB1QoZb075Duh7nB2ntqjGfRdI3 jU1FNaLyia5Nk2pz7i6 Be9ptRJzV2/0X7vHNLZ81stOo9nGtJRwosNV uEFrvbPYxaeJMLIRYPyRfj1P/vAglrESw11RN1l6jrjBw4hv9WfGIECHEcTZIqzQU4ucz9dS6K7vqp0py4xIPvVYq4O3JPD4e6tOqGL2FcN8fWvB7LG hYf8llpx8lsTGGiHtO8lke9EPMUM hK99rzl1ExJ3NyYHO0BYAomE0ICkBCz7PuPQw1PoEpuPGeCFYp7/q7ffriV4YKY91rijiWVd JLfZvKM1spolXMYkwPHLPB7D8USo1xTEmddHgdp73tBsi7xcQXzLa0EFCBobPMEB6l49umUaAIUAZtT/e4yOBRlg62v1ExkH/YKKCTQels3NGHBg9x5IH1mswwIc0XPpK8VIHkGzkty1sjf8DqtLxLe0bg1V3qC1EBjAkOKDj5RzqwkrT1cJThI5DlVj5tlNP2txORK4EyOHUcEQ iORKgQCgH6nnU2htkc4SaxV9VMsiH5niNZEN4gqDG J3UwxQpoW6sn2fMprDegiyFOVKzLhC8uG/GQBnxsIqhcfN2xS5XWuuRyiXBfzPYPrbxRqvP4YUNh3jcBLIxwQznWuLXK48SviOVGg==&key=ph RoE3Efe59GQX0IWYkzyxRAp jrYD2DjiFuMqO/lq7syoJ7gjaS7XF/.../q517tpUrnQ

http://d.baixakifiles2.com/?ic_user_id=9289&data=RRV0qjDc4jpj/lePoDD1ObeSSr4cZjjgL v5mV0iI/GA u3867Ztzx5f9197WgvsuUUDCAoIIGa2LUdaoDqIeORkquljG3w5ajt72oHsyjRLv1XQtZ6bTLgwto9l1FYkSl2yi8GkhX8NkXJBDdfi6dQ16SaFKNMfR4C2wNEQI/uBjT8FFPzyifrDBWxoAQr6SsiRZebV0Odvf8KxF464Gu 7wNGS0Y0dXZOAMh6K/ElXMNoSApYdusjg7 WXPt/A8OvnhI73QQ0w2wB2/zqIrrLaxaRaD2gTq5Gpa4UL/kJ3B5/E/KML60ajMKXOQN3Zmq6LrkGv5Dn1Hyu1pPo91kMzPxbJblOG5UCklwbF3v AHpYIzFiO5jYmifXa/nLLjcPOsZoq0cxfGHHdouUoB8m9GY 1G8EXtbD3vyaWwqMjmoRif5wn3QgohBXc3czwNmEdfc0oVWqUFf4GeSb7uaFGg6p7yj/K7Plk2u0Qcw n1er0XYLay4cQvrmMAZ4V3eDpqhyIv3ePM4bjGXvR29bf1fDev7cTjFsY6Dk6Gm4teKUGCNkunDaKl B/WvwVX9LneRGglNd6yrjKOlBpyP5rkfQTXCkWQHS3HCUHcrS iLxzQVnPMar8NQquLNgUMQXnmgmp7h7iA69VNzrtsZyPCL4p52WaGJGXQVuT77uIz6Ak8QbH1eV/dXR47qsi rC2dbnPtYJxXfc8zLSHw74M5/.../5C muHCroRKE0s7gO6XH9OzM7v9toFq6I40jaw6iEm2jN3z2D4U6bY4t6VujJpUbl6xe6pss8Bi3zQYtyig19QZN

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.