home

winrar-12398-dp.exe

Lite

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application winrar-12398-dp.exe, “Lite Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The installer is marketed through download protals and search ads as WinRAR archiver but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Mode Beta (Fried Cookie Ltd)  (signed and verified)

Product:
Lite

Description:
Lite Setup

Version:
5.3.5.2

MD5:
b72111600ec515af4e5895834dbc3017

SHA-1:
0a70531a66e72b687a4a8d75344ebcdefde41d69

SHA-256:
6b159234381ef7874fe348dd070db0b302c49e9ae6d37dd4ddaedd8edd19dfba

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/25/2024 5:50:38 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.2.5.1

File size:
941.7 KB (964,344 bytes)

Product version:
2.8

Copyright:
program

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\winrar-12398-dp.exe

Digital Signature
Signed by:
Mode Beta (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 2:37:06 PM

Valid to:
7/7/2016 6:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:E7wo69LPa5MW6cJuZdBNxZw6MU9n9xPaVgySsDizQO:EMpLPgGM6MU9zCVjREQO

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file winrar-12398-dp.exe has been seen being distributed by the following 12 URLs.

http://www.contentsendclean.com/c?x=BSR1uFqPu31HvpJIHJH6AfIsla2AJfCnp2Przrp RM8=&c=EzgbwPQQEFmE p iybPcD L4ZTO8jmOwbNGJ6IKpxod fAk6KSS0GRnVHmChaaqtRXchShCfjDumkgR3fqJkMWS3NOgJ FXDzbIq kFQpUTkgO Y4RQDt8 i2gvw9GBS&fallback_url=http://www.rarlab.com/.../winrar-x64-531.exe&downloadAs=WinRAR-12398-dp.exe

http://www.repositoryvaultsclear.com/c?x=UcKTFDrKJbvOnqOYMfGKpukWW5l8nYQvkOsgHiqrKBU=&c=Ssj0UjoqjfH0DO1UMTHZr9cArhILRdswgTzIsPu9w Eiyh0Fi1YwAg8aC05vmeCaYEBaW4IpV3lZqZyuq/mgKXOwyX197l0DmKfrRCLPtCSOQL/IkkrcTZHUPf0f128L&fallback_url=http://www.rarlab.com/.../winrar-x64-531.exe&downloadAs=WinRAR-12398-dp.exe

http://www.stockbundlevaults.com/c?x=ms0cRmrtSX5l1TD8dhDd3riowqeLerMcfVLnP5x5xFE=&c=s7fUtISXNVNKBwaBWLzvTkaW3XZ01ZAWZiqhXNPhIcWyqPwlw6c/0Dy3ZC5E0T5ad2ydLsSaL/rjKU t4JQqf0rO2Q655gGv76/oUE5leu99kGSHy/xRjG1pJlKLzHoi&fallback_url=http://www.rarlab.com/.../winrar-x64-531.exe&downloadAs=WinRAR-12398-dp.exe

http://www.bitsranchtag.com/c?x=rnGRUi l3LkzTue11x9X5ua6yF5Avn5/YguOzWZpYoE=&c=fR/I1VpoZzkVMpD69NjQvFSFcQpyGTaXtBbyX8Cj2Rj0aw1JxU/PfsU3gBOUy9loBHuDiWMOO4Kk/ucVZnH9sjDxPmtNp/JrAUM7PFVupxEG2edFWszMjlQQCx8vWKGL&fallback_url=http://www.rarlab.com/.../winrar-x64-531.exe&downloadAs=WinRAR-12398-dp.exe

http://www.repositoryvaultsclear.com/c?x=iotkcxPy3A7psE/qjCi7I/482Nec1H/goX6ZiKZB1R0=&c=lI98RutM765rpXSUSUVelNo0f9fkUt433F9xZ08WUE1 0vxo50R8kjgagPa4C7gFLGrhP/KpL BD gC6YhCt40DcbV6qEB/RLZ1OPAKBwcmeTfHSaZS2NOLqwHzRVCTT&fallback_url=http://www.rarlab.com/.../winrar-x64-531.exe&downloadAs=WinRAR-12398-dp.exe

http://www.grabbundlesapplication.com/c?x=xh8s FgdsNqyjOScMPmE5AgIrXIiBr2wHLvo/Nqsj2w=&c=WoZ1aejMN648UF0RLOgH0kWVfzqc3Cec47boFAVzm4 G4ntiOAcOYzc4oB/MM2CEHgjlDJPFW5QvK0rH9SDGaEsLRulle2bmvh2thKCRyuqlWwbggS6dELVTpnX0kgXg&fallback_url=http://www.rarlab.com/.../winrar-x64-531.exe&downloadAs=WinRAR-12398-dp.exe

http://www.bitsranchtag.com/c?x=UIg3BoGUjScdcZX3xe8hjidbJwloM3S8bza7i7LF yY=&c=SM56Zae50vfJCd1GcgmH6MSmthpY6RDKE7toSwYiINaBlMzVgliRkx3 YpQ xht4Iz/H5/Od2uTAuGMcQjMEVun6BIN/mViqwo3guenDr2FrM2y/kybepNrmqm8 oRyv&fallback_url=http://www.rarlab.com/.../winrar-x64-531.exe&downloadAs=WinRAR-12398-dp.exe

http://www.repositoryvaultsclear.com/c?x=SkZI1qwA96VVNBoRWTPx0lKA5/rUdtO/mvd7Rva3V78=&c=OKXl8CeLk1rMsI0rtXdbDRaxOKFnPTY8eEQnqe/Cxda/ZnN6rIiFvZW2Z0HAiG4CCtT/1ujEK1Oc8PPO5K kHLniLAtb2sf49wO0ueP/VkCDJSy7g8OGwuOq6IyklQ01&fallback_url=http://www.rarlab.com/.../winrar-x64-531.exe&downloadAs=WinRAR-12398-dp.exe

http://www.contentsendclean.com/c?x=X1J1OJwTVw/38ksVzwCfH28XgPxHzSF9P92SG3eXv2c=&c=5qT58jXIQ3foJU DKab7bN2oGw0704etGm3dLZdRiQX/4pmL01yX83kgtlxRjnIomMGF2eyXCfkKaIlxEDMBlPHGR7dRkAqB6MLr1B8PkZDrFMi2HGmpM0G8WUDa840d&fallback_url=http://www.rarlab.com/.../winrar-x64-531.exe&downloadAs=WinRAR-12398-dp.exe

http://www.stockbundlevaults.com/c?x= wEBFTr5PG2 RQgVgHdQ m8iF2JagWLiW CBxWJE8ck=&c=a C8 jp4w2t7r7LTYvQ/afRgi6r78H NwSvEtCp5dzX9e5EvQYHKg7NLA 9OstZ2C2Vyt/B850IUArjFqqSH451E9QWQ o/SU1UubVUJg4cwBnw ArT/ c97RcAEZuM&fallback_url=http://www.rarlab.com/.../winrar-x64-531.exe&downloadAs=WinRAR-12398-dp.exe

http://www.contentsendclean.com/c?x=tQhVJVUrdbhwMFtPX/SHnrJonDTAVdRgFrqaiFdrHzM=&c=Hl QqaqwHMl/2RpC pn8RpeiErNG0A5SS3aWulPdvjCAIKnejow4BFinLTEOTJV9MqQ1crUNCG8u/wxHPKrTPIDj43ufbFm4e/m6EtEdpdYKcVVkw1GFLOHm7Lq00vPg&fallback_url=http://www.rarlab.com/.../winrar-x64-531.exe&downloadAs=WinRAR-12398-dp.exe

http://www.grabbundlesapplication.com/c?x=hJeUnkqVeCECM2dd8LijB9i46NuFNBME4mZ0N0zrWOw=&c=9WMmkeREW013ojuE0N69oq7B7phwQQV9Eh Rn0jvjm5vRMpgaMUbPuzeRLgdijlrNVeGJKfTFUGkErwJnt0uoqVnQy7CjamM 94qT2fhAFNI7tOpVdKRZznQz4Bmhzf3&fallback_url=http://www.rarlab.com/.../winrar-x64-531.exe&downloadAs=WinRAR-12398-dp.exe

Remove winrar-12398-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.