home

winrarsetup.exe

Sucaki

SuperSetup (New Media Holdings Ltd.)

The application winrarsetup.exe, “Sucaki Setup ” by SuperSetup (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download WinRAR archiver but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Pacipabuke   (signed by SuperSetup (New Media Holdings Ltd.))

Product:
Sucaki

Description:
Sucaki Setup

Version:
3.6.3.4

MD5:
a0ad8eda3604be712a233c26ffda1b34

SHA-1:
482d2c76b0c7fd195bc5e80c693f5311a5d60f4c

SHA-256:
928056b86a46ba4cb879101fe5c5415bfcaee7d9ba2c5a3a874ce501dbcde397

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/27/2024 10:56:45 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.3.19.14

File size:
961.6 KB (984,632 bytes)

Product version:
1.3

Copyright:
Application

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\programs\winrarsetup.exe

Digital Signature
Signed by:
SuperSetup (New Media Holdings Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 9:17:00 PM

Valid to:
3/23/2016 8:32:15 PM

Subject:
CN=SuperSetup (New Media Holdings Ltd.), O=SuperSetup (New Media Holdings Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11213F2CC18E1D1A2272A2F1AEE32C7A377E

File PE Metadata
Compilation timestamp:
6/20/1992 3:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:/tQZdnslFCvgY5bWwM25EnNcJuzTuYUMu2Wt55:/SH/0h25i+uzTRU79

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9101

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file winrarsetup.exe has been seen being distributed by the following 35 URLs.

http://www.tourstownnew.com/c?x=hgdOM6jlT1zUjo4FxK610aZOusSa/mRmbSJEXa3LDZU=&c=0uvS3tGOVlwczuZAs2Bb04SDYZyr//eppL4AzvIAX3ETqKstMMA zckAJ7uzNcHOcicExX87yeziYB44ShjVM94Mtu1/BQqcLiRRkV r1MgxOUfP1M0 ecejog9Ye0rX&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.tourstownnew.com/c?x=5kfOrrUbQyEeVgInDP8VFrbBXwUrZ/b6bZAMhqP87sY=&c=mheugq55qDad7s9QVreWhwWWQaAHYZGP0NlZXMd4yKyrLgtxJ9mNPIm 8xDaNe3s1kc0lIq676ZqwaI/jkwCgGa0Uy/fUHZvFi9C74wm3iGn zRCvEHWkJ 8/bgD7lh8&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.bundleguardbundle.com/c?x=UkZBXM8/BD3FnMAt/PfXOTPQjCj0Xs8rmprmD1ONXVQ=&c=y0HGuBo90f1V8kcInxxvHSWU2U1a6rBJ PXnIX j8rD0CVnq/gEUWy Pt48KhiH4dQbJLUzVQzYMOl E DD4goA18EWeSjtD9uxCpzAROYyV39LDVSXEvexBlR72nbwq&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.tourstownnew.com/c?x=v8v8d509RraVA0H8/LXQNmHHY9DE2eERavSzB1AJG6I=&c=lct8JgH1dfrxwLLMbyyRDmsW b9lqmf9dsCtyOXySex57rdHkEpQZDKYLVZskdNBQCwyfcPFGSufYtmCF0/UO1h50oarOdHZjkaQSNtSKR6o2kyFjKDv8 8LQVEebqXA&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.tourstownnew.com/c?x=GRKwktm40FW92/d/dgHkU764hLsZX9/PQUM6zsMKPPA=&c=y Co1cbIrYowr6TeMumqwst1ULmW UlYXGIrPYGjWSs4UB M wxqFHGlhB791t2D4lPHXj4zv5y kEupbSb067htomxxhOnSXRCKLLBOL/Sjosc4JhQswIse1oLRUUSq&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.bundleguardbundle.com/c?x=HPV/sQr70ocZGPE3v9JKLfgWxVRxyABNrcGseLU4buQ=&c=cD7CPut0h3Kbv7ZGKvcn3Lze/aMFfk8GPs9EL6oEmgiJQDgV//cCoSGlxUGQ R6blMKsTnfNoIz1u5oo3 JK6mXQUMTS TtImVOiIvgfmJ8cAJvCXgfbKJZIlcN1oV9M&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.bundleguardbundle.com/c?x=B5sShGoNg/7eJNTEASDYVYA0DaIxjRyXSDVXXhW5zXo=&c=L4mViLfDX8e3TqPItlwuEA3G23sD7VFmebKyHkI9TReBskVrtFhpUWcr6XK8pck6AnNfpUnDh6Zhtcyup70mNPqmAsG/kLmap4jrY 4P/9goc1Rc8yuzxfIH50si4gst&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.bundleguardbundle.com/c?x=2dYRGjPPD/a3XJ9gNaSgFw1LIL4nPCFZqHi6ecrx3D8=&c=TsFE2wRJzneW5R0v1yMsDqHRE/FfDhNor5ySHRHDRGrntFQRQNVCVsLS3shB2S1nfPfr7uIn3xV3bzdgIbdAH7QkxXo5skQunl4MHJe5hG1MZR8eQw3B1PK1toHnRwtM&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.tourstownnew.com/c?x=5 fgylVDctOmbkD0n2W8JMGTfFE9KIx13ZKyn17VUZ0=&c=Iuc97IIh Lg neHohNMDY5uVq044LKr2WpNgCSF7Mgcx bTM2blS19E5GXgYOwuRv3GChf o qVG05oq1bnamWrA oiigepvDIP4AoUD EVtfmrgu53YDqxuwxHy6Y6y&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.tourstownnew.com/c?x=F0i8GRB2J9Y 2cSjH9yMPfQCZJLHtRS2wfLjfM2kf/Q=&c=yJBs2mIRf5srfcJQwC Vyk8y2P/rpwUJAHFPNUD4PrCt8R/vL7UMblOo7JuLglJnWRf8DZpoyM55gGjjECqnIp//UdvJkWRX1aiWB9bRsaSqjlfS/WTRhnbqGgqbeUCw&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.tourstownnew.com/c?x=0vF3Sb/3AlUDuJAF0CZJcFgtY6mLOyJZSRMT/BavoKc=&c=am9F1rWBekmAP0MnGyMzX/2GXlxiw0qVkIuaowmvricXJbVWHzdwbuGZEpLpX C CsVjnWuT46tO8ZRbTs/B9o BiSj04Rsw5vna8dclqXIBt2KyYbkRavxGSQy7ylpQ&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.bundleguardbundle.com/c?x=ARUPSZ9ECg7nBKiDcb NaIA1FvJOE4KF1 eNFm/e5D8=&c=Ke9MmbDG NqS665zC6SIFS46CDZp0sxGaY6HKqPAazXdGbCPKt9sLiKKdR6XTN2vYr KmYdH1gphsVOWxmaa2UYfm0GIAgc//VYKdMu74RkFLpcFSub3UonKcSlkJD8&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.tourstownnew.com/c?x=nUIEm3hdAPHEU19SkOGGDNybeH2o0UbOeQW0lt99Osk=&c=89wGBAsgytKzaimNDFVTf9YJYvrBSflRH2GufRKtIwws4WN0IEK/ki8yZW16TYnTyMlPrKOYwx7 sIc1oY5Vxa9WFeY47glvFCuz6rbFZO M4m9tMiKGPWgYzZ8ETAzS&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.bundleguardbundle.com/c?x=q3eooIvmQ8zLSbCbp4DqT5tjISlxA5CFDklAz d8DIs=&c=QBb8jZ54/EyFO//tVs6ZxQ1bJDjtQOXO1mc15eagCnDSxbJrZqvcuEYzLXFpxKe/UDrtAnEbjtCr1hJu3IlCP3KmcdkkdZBKHp9mhLLUIZE6CqbpJk tvAyMToNefhSr&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.tourstownnew.com/c?x=ORBMnADiP2At1T ck2XNTfflHroDfw1Wd9y519NIFY=&c=nJt jYVRFm fiyjkzx8ViGLhBJ NA7EXRhqxraud/cBN vTBap09VgoEPTp0bff/Zv7My3IyZU 59coG8/gMi27UZE8gbgRXKSO34CgYZ6rwKTxyWW5CbSSkUBHOKU S&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.tourstownnew.com/c?x=qROWraExoaGGHU38 pZ5KANuVdmso5Ygd7Br3C8YlPc=&c=V29pPTjqiC5ZbEZg3z8rAxk5xj2GWUbXlajqaQh8JEbyep9YX1GfVgwGGbLuA6qQoa4pXoAtpiidD0ycdL2m ILLNShSKZB/plL8c4AfFUDZn5xEkuI8rHekOdXCl7Nn&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.bundleguardbundle.com/c?x=8ymLFXJX5X0EeU2J7N3nj3FRyYvmgzIc4F3X4HPTZ2s=&c=JE4Hz48GInDSc4LGVFewU8c6 daXNE3mleSjUzy8YgjnsgDwC0lZPUPzvsvkcJNO3/XLWCR2X56UM CyXiuFEecAiu1vPzvrHycvKIr81QUigOS7VG25kdDUI1Vj1qy&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.tourstownnew.com/c?x=TliTnhHSZDjWbarTUOagBEe7COdpEwwHlzc7Jdmw8OY=&c=hAZpJJi5Z1kG3mWtmlezrzJeWfVMXHCZFK6vNsP/7K7LKW f5AzMsKRtrnp/kuVrQeFQm0GrIUzey21IgYOzUSJs0m1OjxIePa3qpG89meU/D8zK2dYDjUoQNFvvhqSs&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.bundleguardbundle.com/c?x=KUpcR IqB2Ev7HxXZ/k8PCqPHpaQLTXL08AYutlDtjk=&c=G65r8pXpTqz29sCW29eKPztLQd1 01MQDKuyf1pc2xkDs0GxRmMduE7L1QjRz5cnOvVBMEzsdBYkh3ocdBY/9aLNcZRQlAbp/Gk7m1sD6pskAXN9QcVTJh9FveWPlUdQ&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.tourstownnew.com/c?x=d4gZ8uCitZSiaFKbtdsa98Of7fv59tcQET5luS7sGWk=&c=HGcXtabuuUlHu IecAZc GXTb5mJmLXty1nOc1bVh0/C4eznsvtl4EcpQ6pSwUKkgf3hL/9UZ6y3upAWJgsKIMoFlrtOy9LTEKQS/eN1yAoEsPuB413a5TplKUOkV5Z1&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.tourstownnew.com/c?x=14Wi1n0TlhUiaCQbNsCEY7XWzGRy7z7oHOMxNWuv/Xs=&c=XIlSlBMI2X0Z0ncmR g9EFDSzh9GSVeB0Dre97Ea vr/h3ulQPQGVBYU91ti3AxdHcho/M7UePCXMJ3DKEL9sE/G DH 4i7bfVNG4euxZY/CyVcow5Yarq oYT7I7xLd&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.tourstownnew.com/c?x=u2a3q5mLvXajItbGtz 5Y7JW VbQ2SAIOCa2cbsxplM=&c=7JU5s piDywxPMZ1XitweU9i76G2dGLieeqKa2VHO75Zgn9eQj5F6PkvuB/6JGJ/sx61m1VZlTIBNoFa/ibaReId6DQjwufV0j7t83W7fu08hTzO Oo8BeXxRBZot2ho&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.tourstownnew.com/c?x=zgq4S67rVTwmLfrcdTkfVRaU6nBGdKOj2Ie25cQbU0o=&c=XJyP3TE80pfv9xQmLlkao3dhmJpAuj7PeeFRCdRVVQNifvyGrwJzIx2ubveJdR1t7 Nv2hlmaFJk33o/5QB1eh9nIb9m65PP1Vw1Tq3giceeKjP/vbrlijzALpmQskui&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.tourstownnew.com/c?x=vp6dLUT7pxwifG8qtSGrshGyI20ICXeY5xTk8a3DbOM=&c=PwPtixCr9q5HQi BHTbdhqERaeCzMJLwgYObR04audQI0wxbpDmjcFEBFR3GN95Qv19S3csXxZeDJkisRlqKRUx1CpOURPPkU uuOs3fnKKLYXvqHVY39tTqO48aiGkQ&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.tourstownnew.com/c?x=W25oxuLEYsGqgPGUv3EjOSuS9y/WS3szmxXRGvTxKsc=&c=veUXaB2Q0T aQVDB85Xrq5vuO0POtuWebGnkzH3DD75Hb4CAibdwuPUCSf89A4/hxcbpXwOoUFDFE3iCwKQrO/yJa781tQzabJafQ/e1G33g0xwU4yA7Xbfyb9iKu26u&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.tourstownnew.com/c?x=YdrV5w KpQ9qi2SE3sdpWtSz3H39 WXjsFoQYdH6m7o=&c=BZLuxuMPdD4yj1tYgsxA2uc6Cm3Zsp4/yl7NlaAwPT0 1jLPWXjL7nMpVcN2dZBWbIma7 47E9Me3vgCka7rgM xQhUVy7yd u5R2a3ZtuIQuZFH/Z357fszILDpAocl&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.tourstownnew.com/c?x=wKVg/v3pMSqcMSKj3M028rh008WulGHDBxh4c7kCvXo=&c=ZWQzanawXNJG2VHVrLvIrIOgL0sB6PS8OquyG1DlYwyUkoqcdQWeUGhJfATYw6iRfdb3kzm/nj68MHi80ZXAMNzjDN/ZALEvcx5bqWzjYc4biBItGUbMpGt4HLSUB8fb&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.tourstownnew.com/c?x=BFkpePf9e7x2dr7ABHq3RtFIyGxtN8AmwjM73BdZ12Y=&c=667BI goqAuey5BM7oA AGPkHxwXPbVk82ufHXFfiWQ9Pk3mUCJbbJwbus8Np tKZ19aDC0nwnji6UdT19CrlQijwHCzb/UA1s3mk9mz yYQEx4cAmGY irziismfe0b&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.tourstownnew.com/c?x=cOsygic14ZMy8uJESQabGzRzgAEWIMSGNPXXoxIKjQA=&c=7EwRt3PVEMknLzC/VoVHHfvFWWeTiboFkLRnUQsBLU3Say4YxTZxHicn4C/a/hzONKKqnoTR9/XMQbslwIF7HiSkB7XoZ/WNH6onVv yoTci3iIfNZmrjVTMx2KLOzlN&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.tourstownnew.com/c?x=6PdiVu8pRzkigKyuGfvxdLAZo2i8M8f0jGoVA6sVo0M=&c=RPGDOuZPMC8Y518680MiOQa524hsjT92FHgZW2aZ plIVlTM6t6Hu5kVUy/Rg47PoF4zsd8MEzOHp/a/rk5wD0WUnj7IUMQLI9zFAH5cggraJFWTLKuKS5S/W iPiwOt&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

Latest 30 of 35 download URLs

Remove winrarsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.