home

winrar-12398-dp.exe

Lite

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application winrar-12398-dp.exe, “Lite Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The installer is marketed through download protals and search ads as WinRAR archiver but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Mode Beta (Fried Cookie Ltd)  (signed and verified)

Product:
Lite

Description:
Lite Setup

MD5:
d2cdafd0e98f616149be88be29d58136

SHA-1:
4a066c4529093116f4e8552974d0fb2abc94ca95

SHA-256:
67eb7a3c13013513c276af4b621cb3b5c3fcf8708398e38e58931472ad4349a4

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/26/2024 5:02:34 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.2.16.3

File size:
944.3 KB (966,936 bytes)

Product version:
4.2.2

Copyright:
Application

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\winrar-12398-dp.exe

Digital Signature
Signed by:
Mode Beta (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 2:37:06 PM

Valid to:
7/7/2016 6:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:uTtBYvtCO6iNum4dvHgNoW+iN6jEvZJCblnxIGX:uBWvL2HgJ+iNFRJwIGX

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file winrar-12398-dp.exe has been seen being distributed by the following 13 URLs.

http://www.contentheadtowers.com/c?x=3mKdYay6oEB9mYumRTdKrFykVdmc6wtoGtCQhnw2poI=&c=CMIUsnsPHn5MW6Sg9YU0yvWp8G5kEw/WrL0x4rlpildmLImUVZK1x1bmkjXyMIa6Brjc r2M/cCWGXaar4zXOMTnIqo2ab0Y92ONJn87MKPNUbchZfQ9cjS5B3YVOHvO&fallback_url=http://www.rarlab.com/.../winrar-x64-531pl.exe&downloadAs=WinRAR-12398-dp.exe

http://www.bodytowerfun.com/c?x=XTBp43 fatQNBebYIj7X EPkba0bny1xs pGZN10nRI=&c=j8NKRXeWWyRkWoKAdHLk3GawMaMj6rD0n5pI2FBneGvHqdaDN2QQiv5pj60 EHBIoJ3/i2wIi4x2cXwF27Slck Kpb240Ol/r/SLuKQpEdLnPxQIKZseBZYcbnZ4EVTu&fallback_url=http://www.rarlab.com/.../winrar-x64-531pl.exe&downloadAs=WinRAR-12398-dp.exe

http://www.tagbinariesconcepts.com/c?x=MrMEVuqCM0Q69c1sN0Mm6BR0OQPN4CzkKxC28oQMZZg=&c=pLjcQ7LYOCailaXGLA5BDTC0IpPSBVuGCYFPNXlvPBGSoNzqbxf5NV Mjsoq6bJPmjxcl6q30bFa5bsLGNX7NU4Oeuzl3h5mtONj2pgRczz9og6BpGpcGPjoXXVXNPf3&fallback_url=http://www.rarlab.com/.../winrar-x64-531pl.exe&downloadAs=WinRAR-12398-dp.exe

http://www.contentdlapplication.com/c?x=lgDcwJB4NNdM7f99Fs9YUTq4jQs3YLUsrxfKSBZxUu0=&c=Us3EK4AJmf9BOmp1hI9jf8Xwm9lRSMh3pG3FYKdc1eIVTvFHHYAJPGUiPH86Ll 6SvfPGw9jAbuLO8wFWIjcene9WPOAXbIf4XYflX55do7iDTNP1pqSzf8CdVFZjR4q&fallback_url=http://www.rarlab.com/.../winrar-x64-531pl.exe&downloadAs=WinRAR-12398-dp.exe

http://www.laboratorysenddl.com/c?x=jdiaZqSMmmapwxmE7k6WRiAyiyiko2L6NYB5xk8g0/A=&c=oRnDk3wzFqq2762CwmJ26cGBpC1zPfKgykcaiaXbLykLicfix0GtHPPJAxBZAnwxRgijX3oJ uSPH89eXBo2SNqfGKeo/Qe oNqg3FV/ZgBRyASwGfWjY57EI9jqvIdT&fallback_url=http://www.rarlab.com/.../winrar-x64-531pl.exe&downloadAs=WinRAR-12398-dp.exe

http://www.stockcentralcycle.com/c?x=P5Qy1/3GqDicpR7n6kEmduLv4zOJZ zmoN/Lt4x628M=&c=a4cznWlNAl5G/bmZqpGZH0Z04jKUOHicHKU4PktYj0kdEJ p142UdgZeRz164rKWMVnydEV72/U2BJBorVMEG2mR8fiO5oWdikbAsI4PlpVrdbnbduIbLBtQ4YlflY 0&fallback_url=http://www.rarlab.com/.../winrar-x64-531pl.exe&downloadAs=WinRAR-12398-dp.exe

http://www.safedownloadfile.com/c?x=l0HCAe2VPvRTaT2gLP/3szWcrYq PEJ91jPjZroOGcg=&c=M9 co/m61sj0E1WKxE5ybPS7jTfzZLmV9mbPDCX9ZNSR/udKkl/1R/7Z5NOblgJLxCCCE6Lf6D0o7ZoI4TZtYAviJv q8dKjz72kD8VOrzvnwoBn9cDGM7jN8sGqAHCW&fallback_url=http://www.rarlab.com/.../winrar-x64-531pl.exe&downloadAs=WinRAR-12398-dp.exe

http://www.laboratorysenddl.com/c?x=Sq4msRpijl5GreacknqJOLJh3JAxP61fEIpdRhHVxdM=&c=CWHfD Vv4tfDcMAdoSWKJKMbHZ7VbJ2GQscG7sJctLMQ8ZFDoZNDgK8gJRY2d0G EFGfzdBWAx138pC93xhBYXPVUPjUT3 1vR93r2OwRUH k3JNbRReSGh3t44CDVPR&fallback_url=http://www.rarlab.com/.../winrar-x64-531pl.exe&downloadAs=WinRAR-12398-dp.exe

http://www.appranchsoftware.com/c?x=t3umiEZtsGFjA9xVy4WXyBkwtevv O9/x8kYt2RhaC8=&c=dO6xVooOFOCH6pjYZhBGUQBCT0dWZ4ZEaXa cQ7HV RzFrtpu/RmyPulBJ/U jBqKyLm8DxEFnySAGwLi06qXsUr1dGFHDSzxdzWJebUHh81RDqqfP9lbdn2eKAPWYCQ&fallback_url=http://www.rarlab.com/.../winrar-x64-531pl.exe&downloadAs=WinRAR-12398-dp.exe

http://www.contentdlapplication.com/c?x=vrkQzqDVLxTWOlj6s/TpYVA5i8Za84j4f0ndBcyMlIA=&c=Jkpz8R8ILGlcec5vHVqSP4J5qY0W8X4f/N1pKpe4lIs1GH UsRi4bspISoOyAGeuI93F7u4GVZMEA2RjPDfCFn5tjO 8XOVjm2LnSyUNlChSnVyi8kPA4ppsoP4BjYTZ&fallback_url=http://www.rarlab.com/.../winrar-x64-531pl.exe&downloadAs=WinRAR-12398-dp.exe

http://www.contentheadtowers.com/c?x=s777S0cZtFAwuip7KWhPTmt9JgZwkp8oQk7Gt0Su65I=&c=PFf5iimvLScGcqYWbmqWF56YHcBAFtQxPAjOxS2TmiaCRpmSdDGDTH7c1eW8HmRYi/W22/1eeCMjnQcSVaTw9S6/HCvIU2AvK/3MiXKez06kSAb uDF444khbhoeMrzV&fallback_url=http://www.rarlab.com/.../winrar-x64-531pl.exe&downloadAs=WinRAR-12398-dp.exe

http://www.contentdlapplication.com/c?x=TvXWqh56WQNDkuPEK/kHJUZDmuykfjmG1wNcw svjBU=&c=Q5j0sCwG6qk0nXhNENMLqt1T3Z07uC7 tr392fr98Xpl cP5 Y28ob9QUDCAovHkMUU9kc6nl6SjElXtv0uf4s02yihNTgvLbASB yfjWAjgXOQhLIzukfPzU9NQ6goS&fallback_url=http://www.rarlab.com/.../winrar-x64-531pl.exe&downloadAs=WinRAR-12398-dp.exe

http://www.contentdlapplication.com/c?x=fHyNY8Xf/O3nnoMembXEmglpZRGpw06MBVXI7VZAJtY=&c=csdP8MI joIWVRAZzz41uLxEmtoxUcc ksF6TF8mS0wkQgd1/HDDx1wzMMV0aRk99JfoBRj4FMFG i11t5NMZnLppCBEQCXlNlFegzW lGpK51MncUGd9vfRC2xytky7&fallback_url=http://www.rarlab.com/.../winrar-x64-531pl.exe&downloadAs=WinRAR-12398-dp.exe

Remove winrar-12398-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.