home

winrar setup.exe

Baludamane

Max Criteria (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application winrar setup.exe, “Baludamane Setup ” by Max Criteria (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The installer is marketed through download protals and search ads as WinRAR archiver but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Max Criteria (Fried Cookie Ltd.)  (signed and verified)

Product:
Baludamane

Description:
Baludamane Setup

MD5:
e73455488f38faa5021d790db1507de1

SHA-1:
14fdae67d186cb219af8949f1f176f5b6653a1c1

SHA-256:
f310c24179659e75a91229408ab2238f482c2eedc37776df52142ecd0abbbf5d

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/27/2024 4:35:52 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.3.18.5

File size:
1016.5 KB (1,040,904 bytes)

Product version:
3.8.1

Copyright:
Internet Lite

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\winrar setup.exe

Digital Signature
Signed by:
Max Criteria (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 8:30:28 AM

Valid to:
7/24/2016 11:37:50 AM

Subject:
CN=Max Criteria (Fried Cookie Ltd.), O=Max Criteria (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121F0C6B8EDBABE266B325280BC664A1402

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:9tUN881agIRk6fvFEdxg9XUudWz9vzOVrj7OKzA:9tg84ag63SdxoEP9vzOVzO2

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9115

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file winrar setup.exe has been seen being distributed by the following 6 URLs.

http://www.bestconceptssoftware.com/c?x=rYZ1zk9sPxtChCqaw 1bew9gRG61k26zZU9YMY7nNt4=&c=FPwaWlHImQL9ZNXyji5EMpWmcu/i2kmlIDuBimHoaf5O6 IP5Z VYD04i1qvoOSBAAceti57Q10s0i1cFqlggvHGmpPvi3xjHBm api/U8DYsJizOxcBdp4qhES2kbLqfNBsmcuLqH 8pwpE53GsV2daB0M73QvDuwXv688NXvs=&e=0&downloadAs=WinRAR Setup.exe&fallback_url=http://www.downloadfree9.com/landers/.../download.php

http://www.towerbundlesmeta.com/c?x=3hOXzM NrpfhLd7h0m3varlAbIy5HVHQ7m7LvVFw IA=&c=xTpfHI8eFNHzrwBRtMivgMl f75LTY0Mq50GajfKsgQ6vr5ia0pa4Yx7S5bWmEuQnmMBmZOUoQtNUaJpiCNyQ3Zp7wq7ctc4odjzRXAgpXQPt2XSo61rj1zqFQvDpAKuBShXgUOZdibfKrC92oHc84ftF5cPKScfq0Hp87wHa7Q=&e=0&downloadAs=WinRAR Setup.exe&fallback_url=http://www.downloadfree9.com/landers/.../download.php

http://www.towerbundlesmeta.com/c?x=FMDx7aQGl4jFWbI2B9KBBmIcSYOcudEUZgzpZFCg2RU=&c=jnSYDZ0QAC3sZu58ydd1INOrOmZPXxK2wq0hneKShtUFtw9xCH3seRJiROeGo3iJjTfHJzhtWuk5T4oj8r6RO 2GroemleSziow3pwjl/axTcJWaPyKWnE6fPt6NLzEe8KTRqF/kBnGSkNwNk05CPVbDqg gD9aJtB9aZGAXI6I=&e=0&downloadAs=WinRAR Setup.exe&fallback_url=http://www.downloadfree9.com/landers/.../download.php

http://www.packagequicksafe.com/c?x=xwYohmOEKmw2fLkbEy /OYQySKfr4M0h5D6RaVq zfY=&c=axefXt96x8uNCA3Wm8HW48I1c8kca2nKuKydOOcY c9OfFDkeuta33DOPD7aLb S9bYG0 ld4P0Xo7CEMR29BfvD9wSCbDYUy1axFKu6IMDt3PeELStAkb7gRGQcWGC5yIGqi3uZKk 5ruIXMgTi7CobfHGt9yzuTT7mfXIus50=&e=0&downloadAs=WinRAR Setup.exe&fallback_url=http://www.downloadfree9.com/landers/.../download.php

http://www.bestconceptssoftware.com/c?x=2QSW7MS4K9FcNR5QQa3zzQJA81KsHCFokyL0J6 s5Rk=&c=uL51jMxq00cfbvKYDPWw/w5r9BzMw1UawsvHcDHo92yCQ5gI4ZfbOIsuTqlPv 3GKVqHW8AJX 3JkpeUa8dZRyZagCJd7AwPJZJnP6RAYSamA85bk8SZpN RkRF/JvS4qZkpvL5x6unX9PlxW4QHTcPLp833 agozMD QdUe lA=&e=0&downloadAs=WinRAR Setup.exe&fallback_url=http://www.downloadfree9.com/landers/.../download.php

http://www.currentbinariestoday.com/c?x=F6bWSZ1fYkwbb4f8hiItHJcmSW pv37gM39tHH/VR8M=&c=e5C0e3tzU59yg OhBYLGxvDkpLYCcqT7MKgF8UKkAwXmCQ6dvDnjOg8mXcTI42AnXkewDQns14wlFJmmRyP4Ef4Ob/KvnIVbq yruCoHAykH6Qv1pnJBmsJ eSakHAUSWkz68hqgB6kgduvkElRhB3UFcvmOO3mobuS 0SYyAzU=&e=0&downloadAs=WinRAR Setup.exe&fallback_url=http://www.downloadfree9.com/landers/.../download.php

Remove winrar setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.