home

winrar setup.exe

Application Installer

Criteria Quality (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application winrar setup.exe, “Application Installer Setup ” by Criteria Quality (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. With this installer, users are expecting to download WinRAR archiver but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Installer   (signed by Criteria Quality (Fried Cookie Ltd.))

Product:
Application Installer

Description:
Application Installer Setup

MD5:
74dfc4a3cc99355bf813437a6d2cbc76

SHA-1:
160ea894b8391786fc4a832ce977a6580779bee9

SHA-256:
57ddbec9a6e61aafd844b6d0104b785c4ca33ba1f909d98aa94c22ebce37a746

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/29/2024 4:44:43 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.1.25.13

File size:
969.4 KB (992,656 bytes)

Product version:
1.2.7

Copyright:
Internet

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\winrar setup.exe

Digital Signature
Signed by:
Criteria Quality (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 12:21:34 PM

Valid to:
6/29/2016 11:39:55 AM

Subject:
CN=Criteria Quality (Fried Cookie Ltd.), O=Criteria Quality (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11216ABCF20419312093F809F0E003C850D7

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:ON7LKXirSl5g5MYuHz9GNh6zCaWM4UEIBtot+k2G:OR2XirSXXYuT9GrMDE6Rk2G

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file winrar setup.exe has been seen being distributed by the following 19 URLs.

http://www.vaultranchbyte.com/c?x=cNWiYkqHDPJpjg8HMnipNv4yFxEf1O/cj6voWV9vm8o=&c=wEu9K9siZdmmMhSC3L5fd3k6T7QrPkzcSUptbLKYh93szp1lenCtC0deJYNvTqo06zDnPCxuwjCbipOq6/.../7TCcFxg06U4e39mFcm YX&downloadAs=WinRAR Setup.exe

http://www.vaultranchbyte.com/c?x=DzB2bnaOL9/ZbGxmYOG6Q3RC2UnXeXaBPlkxqesORtU=&c=eiN40VBigFKXPcWg2n0w/.../F1mKG6jT3jTtxvVp LXVj6Uksa66hp5Bt9i2Q&downloadAs=WinRAR Setup.exe

http://www.tourworldmeta.com/c?x=SfDWLKG qXcVmyBZu2tIgo/f7pyH44Cmndj gGdO3YE=&c=X0uKP3903U/.../nyEShd l9Tz8Umcr8dR62beIXa3MYBdUVpVxIUJIaugPxABpB&downloadAs=WinRAR Setup.exe

http://www.vaultranchbyte.com/c?x=uApCv1S7Db1WMkbmUJw/necPrdTW5nSAeRKwvJ3057g=&c=p96qZ1TYMxLCI/.../45oiValbwxdz6HVGhj8HxcQAjcjIpmDppIEP0ulZrU7Q23JSm2PRdqC&downloadAs=WinRAR Setup.exe

http://www.filestomes.com/c?x=KZFY4XeQdRd3C0OHkbRHCZUBVfYtaKxRzQLlbmnShR8=&c=SLApxJy3ISK9afT2ApIdCPY DpoyBnFhilXTKQViJRCZYBem8Qk2/fjuZKLnIPYS0XRtZgxnwUEr5N SkMFCNgNQu9U65ZaApwA2n9hYzb//qYEf1fFYRilqe1EsVDl3&downloadAs=WinRAR Setup.exe

http://www.vaultranchbyte.com/c?x=4mc7rDRxytzxROayp VtVft7ci qIJeoqsandbTrOhY=&c=GeYPKPS5ehwPmBqn6PpNXoVbR8a1WXrhhLfIRAlUw019DzPbnBk3DUj6NkX//LTxJP 6vWUDl m9Kp/.../tvK5OC 6G4S43B0cGOHWEuW5B31G9&downloadAs=WinRAR Setup.exe

http://www.filestomes.com/.../gVxIXW8 KVLZNzg8 v0EBMLxCsmUly&downloadAs=WinRAR Setup.exe

http://www.vaultranchbyte.com/c?x=K7FLtylkHZHgZ8Y6hvys8vIhhVXKCzptU/vo3mvzhDI=&c=SWSc2JvvVR0Mwgj3AF46iKh/60DhzwPrFOR/Jt3FL8E/lP65jegkrWdIZZbQdRL1NKzCHoIqo7dww3xFvnt35nwSPmHmokL/.../VXbjE&downloadAs=WinRAR Setup.exe

http://www.tourworldmeta.com/c?x=Uow9fnRMZl5j5uGsV2piHTB9sVXoDhYxaJ/TIYzqdTQ=&c=x1be5hFPGnKaNwwPRmqzC3Odlnx3kt2u3MUxFEgu6TZctBHnl1BBl49Wqzkv6hzwHe/HQd0aoazGgNeofw/.../5pSWA9aa480 2W&downloadAs=WinRAR Setup.exe

http://www.vaultranchbyte.com/c?x=itXNG7pfaz Jgv 925e3WFDHB5nmgLXDEgnUq8//uZ8=&c=sqADmZk1oVXe8zyAmO08wk 1B01D6W39Nzn1ZSnJfJiuojAx8brY7eYUnjep0104IbGl3RGrOjSzxw46hHDtpodQCKeH2nLDmf GhHqLDGoM67YOuFpm2mfBknSjFcfA&downloadAs=WinRAR Setup.exe

http://www.vaultranchbyte.com/c?x=iHlUu3fIOCEheO5daVu2ESJnJl0QofXNKeYrYLAUI/s=&c=qK6uWG5ydIDyXEHY/3ycb UPD/.../lC5j4ZTeXxEuoVXC53uYJOR7CdEV1bOMLlsdf4WNVJrwDaw8MSvSmwQek9ZSrGPmo 6uRKb0LpAH4nPH4ajIh&downloadAs=WinRAR Setup.exe

http://www.filestomes.com/.../byA3G1xJN8bewiYF0YW&downloadAs=WinRAR Setup.exe

http://www.filestomes.com/c?x=mr3MQ/S9Q9/GMjm70rhQbKAvVv9jE3Lwnx /.../eMgPvcmZ8Om nRyQed8MfYWeP4XGxeMetfbsHntJCq1DJ9NtEq&downloadAs=WinRAR Setup.exe

http://www.vaultranchbyte.com/c?x=Dw5Fda6FPDx0469WAHPUP1IkBNoI 68BQ71N 4rWG6w=&c=299hwThtT1jObr5RdxVfn6glceGxCuM5X3He04AlJ7u8LNhXw3KjZAcvYYaXLIYQ6IYaox1hsG7ePI2AjheIUH4n6cIfcnxhq0e3IyFlYPLFQsSdqzIUsLWQ4nj6TFrB&downloadAs=WinRAR Setup.exe

http://www.updatevaultsshare.com/c?x=JF/B2O7fH0N8kh4vvhhrJUd35rJvCbqRDJjvzTN FEI=&c=gOxaGDISnBzDPa1tSk3OENmULuBz6JM9 On/.../8dAGjVT4CxLEffgqlGUyCPMgurEg9idemVeiEraQkPwsz1X4xkTXdy3Rffe4tQ3&downloadAs=WinRAR Setup.exe

http://www.vaultranchbyte.com/c?x=lnlPp/IGCWmqPlyB6c5DL9WEaU9RGCka8tYZUOjujfg=&c=Bu pWlZUIgYdwbcyAHQkD3dThD1jVr0sc/PRfvtxc6ulcNao89JLEka c2EjOXXKP/.../3F2d2po4SBqQYTTEj7YZDE462cWVZtjYyl95&downloadAs=WinRAR Setup.exe

http://www.filestomes.com/c?x=Uw/Dez/VTc4HK5w4lGRLq12KW/ForAgILemlXBUAqfI=&c=sGimTgOF5rRsUUbmxOSCOZfhQEZZN7uyIyzVsgN/RsQERKuZNa64jB1 x/.../ A1BXMf50whBnLUgch0vpGj4&downloadAs=WinRAR Setup.exe

http://www.vaultranchbyte.com/c?x=4t5JPThUssuCe5J7rKFTM0cH4yk9z5W5lWIKWQyOMQs=&c=qfijK168MAGHEcnv8O7qLRxYFL7hTeIq7W SVtVB9WEdTRrT WYPTsz/.../0wvSYuygtcliN9wRqLKqPq6cuzxPaoFjqsYQBLaMh&downloadAs=WinRAR Setup.exe

http://www.nowappclear.com/c?x=AixLhuZ0TvYcwJdrYXR8y2B3PUHNi4UfHOU oDoW/T4=&c=rKHwYS0BOtiAt9IwpQ9uEWW/NQLHNo/M4IxCbpXASFsPxipT/.../5j5yXdU2xRtHGxR kUgPJi8pLEFFBWbsnHLbFsucdQBMXDEqcBGzHba&downloadAs=WinRAR Setup.exe

Remove winrar setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.