home

winrar setup.exe

Lacuf

InstallFlash (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application winrar setup.exe, “Lacuf Setup ” by InstallFlash (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. With this installer, users are expecting to download WinRAR archiver but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Robu   (signed by InstallFlash (Fried Cookie Ltd))

Product:
Lacuf

Description:
Lacuf Setup

Version:
3.8.4.3

MD5:
abab91c8ca65b314898dc9506129970f

SHA-1:
6a580b726636e42c5a311268cf915743d2bba13e

SHA-256:
2a5a4f5e7cc3ee2c1faf4da9753efe03672596439301e66a780e5578b38dd5b7

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/1/2024 8:23:59 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.3.2.7

File size:
1.1 MB (1,120,352 bytes)

Product version:
2.4.5

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\winrar setup.exe

Digital Signature
Signed by:
InstallFlash (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 11:18:16 AM

Valid to:
6/2/2016 12:24:43 PM

Subject:
CN=InstallFlash (Fried Cookie Ltd), O=InstallFlash (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121ACE394F39EFB26D753579A412465CB79

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:95pydzYpRU332AMsh7+m+JeFxOAgJFiG4C3/YuFA8TPu5RY5:9DazYmmEA+xOtFiG4C3DFyRY5

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file winrar setup.exe has been seen being distributed by the following 13 URLs.

http://www.presentfuncity.com/c?x=tTLSHdMbspM33O/RgFC/6pP6VqPcVDa3pIIf9RaSviI=&c=R0NOw1CCkO5K v8WUpgeBngKGB0QcI1Bk6b3PwaHXrR4EWKpyk5gCoXpqIJG2Lm4znG4WnPYHDLBC86Nq4VykY6z4rH3uuFd//D6ha8Yviz1ZHMqF7OljPqrSOfkEkcd&downloadAs=WinRAR Setup.exe

http://www.bundlerepositorybundle.com/c?x=D2PuAsiyHhF/K/mrfG6bpCtvn4Acf4NoQf1ob3jFPq8=&c=guZRCsUIzsoUVc3lYX3NMtVDywo0pbOt1SSuUEvb2knAI9X3kyOVsT8T/.../MZhqKLs4uL6sszDKUh8P8dn49XA1TdpJ5Vc hqa0w4lL0IgGWIkNvAftfwqANfyzS8a&downloadAs=WinRAR Setup.exe

http://www.bundleworlddl.com/c?x=qx7mJjHuDiFRJPUnzN6QhgjECuEF1ZPgKFuf Yl XTs=&c=s3/.../aDjkA7u6G4lPITGWbdaLZFDNLA&downloadAs=WinRAR Setup.exe

http://www.packageflashcurrent.com/c?x=tenhF0qVwDJ53wSRAHoQXemIwR54WMuWyxnxU0kcUtM=&c=eNHMXJ83M4IJWEXDr3SW98uqbfF8Zqx13DNGPioChPJ0pwXXtgRmv39lQO15GdGQ/zhOAG HWf4NukovXRIouwU/.../SSB2NCywOjb&downloadAs=WinRAR Setup.exe

http://www.downloadsbestbundles.com/c?x=usoKMFxh66TJ70FV3B2Rx5qxMfjrRm9eZnBwJpknsoQ=&c=XKh6rwbXEq2o6pPDLOXC76j8GXdXcaByAGsl yezRXJL9wx /.../R1kLJG YBOPmcg6izQigoqc5JlreYmQDRdqv4yu3nJAsd3rnhG8 PGhOLTskddSTtO584&downloadAs=WinRAR Setup.exe

http://www.packageflashcurrent.com/c?x=bdDgp/bSGYNr9EgNPoQW7GHs31j3nCh56pTH8YUfvr4=&c=rzKChohvt8pvAZlFMLDMGOD4M yHVLvO2kG7ea yGt38i1yi1vuuDJx/.../A9qmWEus1BOkf3&downloadAs=WinRAR Setup.exe

http://www.sharetownworld.com/c?x=ltvpjeezJDn/.../KIPo itSwB hLVacFc7DV &downloadAs=WinRAR Setup.exe

http://www.bundleworlddl.com/c?x=aLPQg9RrPtM66pfa5MopsvYxIEBIIQSeCYkxNkVS4M4=&c=kC8J7lIfEK/sx7FfFGYeticj/pt2N5hWJGdzP3Cxjqrc1MGr0 LWtR2IVdHxoHytGDIX0NcWGT5FpFAzqhuC2wZn8D5 /upE2fVOiSsVu/.../TqP1KR&downloadAs=WinRAR Setup.exe

http://www.presentfuncity.com/c?x=pZ/Gl NhFVcf9A5928DRjfP9 504xjm6X7DDdBC/8L0=&c=UnIzSHyyNHeZisiFGOTclzR9TXaRAJ3artaGo0kD8FtZqI9LNEM1kochiQOzvSL2GAZ0xphjUgYT4H1D7axS54M0/.../b0AS&downloadAs=WinRAR Setup.exe

http://www.bundleworlddl.com/c?x=tErY01SC 572gJdbOgSgi6zWKsogTSjx7C0RKRRmSfc=&c=o2mbPVD5HRhduqbICmBWgU54 J8VTFL22x2UZ/eJlMdYGcbtmPzUHYq7jw/LGQIuX/.../Sm2pa8yYVZEJFsbfpiOUCODDd2lpHPhYjRCQvwNZTVr&downloadAs=WinRAR Setup.exe

http://www.bundlerepositorybundle.com/.../kjJI&downloadAs=WinRAR Setup.exe

http://www.tagfilescity.com/c?x=7wtcDyqKx aTAOOs7JrC7R7YaMNwPeBRwc0PiSwnnZI=&c=DXGeUiRxEtsEd HamGQgs /oQx5/.../5BYKOyR1LG2rSwb gPCI 7EZI5ukPuokB4a Gkh5RCiDIjtL2knLo4yqXleLX6GRVL&downloadAs=WinRAR Setup.exe

http://www.sharetownworld.com/c?x=6BDm2QVb72iZlnN 1kpy48Kil35Tdku/3oPP0/.../2TbdEv7o5nm337yXw&downloadAs=WinRAR Setup.exe

Remove winrar setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.