home

winrarsetup.exe

Doh

Agile Install (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application winrarsetup.exe, “Doh Setup ” by Agile Install (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The installer is marketed through download protals and search ads as WinRAR archiver but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Agile Install (Fried Cookie Ltd)  (signed and verified)

Product:
Doh

Description:
Doh Setup

Version:
1.6.5.3

MD5:
e65fbb0da47ff1286dc744e2aa7aa09f

SHA-1:
08825c8195b9b038ab45fcbd109c6f23f283c9fc

SHA-256:
131775b80793b1ffb2c120dfdd840c242b20640bad3e8e7bf7af3580d7c4ec19

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/28/2024 8:08:18 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.4.21.6

File size:
898.7 KB (920,280 bytes)

Product version:
1.8.4

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\winrarsetup.exe

Digital Signature
Signed by:
Agile Install (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 10:06:44 AM

Valid to:
5/4/2016 8:41:37 AM

Subject:
CN=Agile Install (Fried Cookie Ltd), O=Agile Install (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121833A91D38B769B990852C63E6BAD6723

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:yhS6FEeV5eUt+vXd9ZTUGR3L2pC+jSo1fKq4WieIUnL9y:yceEeXe/JYK+NxKq5Zy

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9338

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file winrarsetup.exe has been seen being distributed by the following 16 URLs.

http://cdn.mediafhcontent.com/c?x=VNX6 i7OpvTWT78u5I cr HouuQ08k1rPCNkuKhDGhk=&c=B8DCfxaAGoumwLr053gGJdg/knXyq5yjycsyhR7LaJBXWEBoweY4vKX62xQ4zGPbKNbRsfISOXi usKByZ5NkeEdwMQYcG3t6YLyy8dtFe rmHIPhRmDlJCzXmttE7dM&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=0VLua5U/Anpb1J6U bTq/HtTG5OHGqv58X1JYFASk7c=&c=SM0dzYR9lx221gaP4JhdZHQVEBrQik5kV/y3/akJfoC79THTHBquae/EZEHBUhItj9s8tpq37EXJ8g7x7Lw5W8Lh614HAosSszgKmDOvFKmPTPFEQDU4ACJWGciu0ehg&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=nY1jHYbR0pR 8 XFias7R05Bp uAy/tH6rXvxAAI1uU=&c=24IghWpdWdoK2CappCyD06uimECobVfGMw1gnQ/Lljc tI3E8aupnJCKIEjkFaZpj/AlCX 1hIfadzBzYAcPcpL7up PYCCYQd6V3n367NrqO4s5XMMoT6KotmgOl7tz&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=ebXuJ bBYUs2MKhF3I1x513eNCTick8355ExyWzFGVk=&c=1s3XMr91xX1a1W exYhKTihjc0TOnqSEwx0Spy0nV/kMiPa2vnHXFXKFTELKfVv7p60ZTzU/NMhONMY6pS6uBWFl2OQ0Za6TPEFc6H N0OdHCPH3ZuLv3Zs3jwPTuiEK&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=9TyuUmqsdx2ZNLGFM/SKGtlnvrhjXLUr165OuGATXMY=&c=51ENDpCc/8T1lT9faitxXnvwjJAXIUjzCbBOO7h19zHhOdL4WkVUavIdf1IUW54xc7 CYicu Se76 Z BflyGuQe7ScoUW7BwHJ AQtURkTxjNiD5YRvMiyA9GiDjfna&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=zrol771RFEtWdocOg0yuq5Fue 3oxbHpo8gOaECezgY=&c=auPLGVt9lfaWFwMYLIaRasBXTxrcqxpW1nJUyGms0smg7OmzuKVZ6hxMzUhtS0sfD5n4TAGGalFG9XuO3vOH0Z0c1c1LzN/Cz9frtyxf/q0H1DkknXUD h/ sApu5pCU&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=fFmJSPi0bXvYNNbcDLpMeJprHW7v1tNYi3YagLpM/JY=&c=oYmWfKLo5CeN0lK9dSmxSr04vyfTibTUgcqk/GLOQ6brj1CBArIw02NvGJnDGe9owJPyd/ej9dr02y2jJ4dZtqtUQ76XF6VPSGpeB5VL0vABXoyvvhJ6S1ODMYMBQRVV&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=VZGLJn33JoOlcdS5wrv3iz7UGypcY1g6MB oaWkOxUw=&c=O6y9ij21X7jChdgtAMXrhUH0h8GFrsk yJJm3BHFrfdfLut9lcTVPAkQ8nIrvcXgg7GA0032TGykK8UgHLeOGBVW2gHHHvZmH8NXItK2FTPHUW998UpGx0KeRtVR4/ZA&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=YWLH ui9WjR4QxknYQFmRy3wA4e8hYg/5HJYPoQVRqo=&c=A8FV2YpNV/7T9tfugnUoEZQt//gyM zf5fWlSU 4n5V2S0swyMHfAcVJiZQyukRXCVNKbYTR92Ix4yFxyqZjcRdNDXkXmZvuft1OEehMxxZ5nsMEYwkq7voPHZ2buFGK&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=P2F43FAxlBMo18LHmaWWlMC92dGKqM/NWTwHEP8glyU=&c= g/zj3a8Kx/zOsMzdJ6s653g1h jsEeMAAuePEh7b4me5 UEXiCztfFlCSEMT3M8 X5qHGs9xNzbcs8SxR//exjGeFG5y izCmiXo1fJCeW uZbgPf6YUgY ZHxkQxVG&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=L58aJVJZfW94Vu 1Ayib XVAW2g4mBv0reAGLHqJ1HE=&c=NwJAD0tYtSrqprKErQ9as/U7NnwK0g12c5xA0/OGQ IZTrsbOmbDdDnNt49YNDsc9qSPArU// woTrlKsW88PtErwgkxpgoXQ 9DggIWreQsRHMP89apETwD/oy3hsHm&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=d8CS9TnJp4BlBhN59 KNlPASfDaZ G3zfkpPaZM94jk=&c=5H5hePD4hSDdoxNKsYw0/LDl64n5yeIRoRvlDGhlo6mbbT0tALKBcQmZ ee0pv4rDzQxwF3Jb3vWVl/Ks6RbVGnF9BXvJDi5CCzKBBOZmwTrGW4N9XlBmGywaMA4NHh0&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.bundleguardbundle.com/c?x=LO07M1pXZ42QT9mG B8WZ3OM1t79uVMwyEpkRaMYUfM=&c=2MbMbOC0zEjcEYFWFoSs92YItkqLSs7d2lnYELa216tZG4fOHMOZVT5holpLQ3lh4dALIMljLLZOFfF8U1pvZH1AXbRujKbx76rJn0t1X1O4WsoCXxOe0K0j30DD/7hX&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.bundleguardbundle.com/c?x=CBoQYXJ9LEY0kQ06fgUhpelV I5Le3EXWnUJEywpUlU=&c=38zlMfuBvjHaWejNFyV/oXfoakUxyUw bJkq8OT32mB6MBuaNpbu4tYbOGMri wPgZuzCOhIMzyChM2OtIextSDSzveU37fiSCMNas56HjGpcy1pA9GW8arXLppu9nJH&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.bundleguardbundle.com/c?x=VBZ c/wZTQ0Bdg43ZFGOX30MgMahqwKxp9SBH2LfRVc=&c=n73Pg9erVRye6N1teCBJuyzFxfl5D2RFdruv5xi7ghOKXvBGFlM/nsiLMq6Pof4zahkIphMABsAGE Se9ALSyBz1cCrXbDstiTsVYulw2Thqn7ckRwxZlZOtENA9p8lJ&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.bundleguardbundle.com/c?x=Oao/IIBeATdHHi2IHVoaa5kAdMscFKPC1fLDxYLSWWw=&c=Zn7KUScuxFZgIInQElzW/wV17ssKpDbhrVjP1EWmC2HcwvFsVxtIuRvlClhwNE/BXm3IoS0ym38 ynoqwrC9tcjW5D8jsu2fivprMqtp0oIbUsaOchEig0LoRzwjUueY&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

Remove winrarsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.