home

adobe_reader.exe

Cedadana

Quality Install (Alpha Criteria Ltd.)

The application adobe_reader.exe, “Cedadana Setup ” by Quality Install (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.downloadclearbest.com and multiple other hosts.
Publisher:
Kirep   (signed by Quality Install (Alpha Criteria Ltd.))

Product:
Cedadana

Description:
Cedadana Setup

Version:
5.3.4.6

MD5:
5dede93b3b522124abe33587a51e91ec

SHA-1:
879308b2efb5272a16b923f5ee2cc4ba94383fb4

SHA-256:
e8ab0edcb0d77467ef1c969bc2812d7d5c23f58d1250ef91ec3d02c603ec3f07

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
5/13/2024 5:45:31 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC.Installer (M)
16.6.23.20

File size:
1009.8 KB (1,033,992 bytes)

Product version:
3.5

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\adobe_reader.exe

Digital Signature
Signed by:
Quality Install (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
1/6/2016 5:14:15 AM

Valid to:
8/4/2016 7:59:05 AM

Subject:
CN=Quality Install (Alpha Criteria Ltd.), O=Quality Install (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121BA484E4C31175E4A844ED055428DEC42

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:nU9PeHzajLx+GdYiUnX+z4yq7eNY78f+Ij+rlVBFy6VajjeWfYFzUP:nimyxdFUXLycBHIjKlJyU+PfMC

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9300

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file adobe_reader.exe has been seen being distributed by the following 8 URLs.

http://www.downloadclearbest.com/c?x=g9eSQyxyRIUWFEKY1NugwuoX3GFXANwGIYYKTuEs3eI=&c=h7BglBRPsQSlHUSfCc7iHQ9auBPC4k4V7dRTH/nlyiIq5Ni9hub2Htck6Hf9wHDUslfzqnG4qiwk1FRWLznm6aRKg7jHLY0X0A/tJfKjq19w3c5BYle15aWHOWTNPWGwF6JQkE4tX0Ipsb6Oel7G4UN5Qpp9YUBE2fK5K MyPds=&e=0&downloadAs=Adobe_Reader.exe&fallback_url=http://softdownload3.com/s4m/.../AdobeReader.exe

http://www.downloadclearbest.com/c?x=5JPDualWal9nf7iFsckhwN2RS7EpNYEcuG Ku59fx1E=&c= 1BaHxHI0j4erCBDTSA5DU1zFVgVOsSQoUt5KDEm5BYLHwFtkAHxoFCS 4YCIGzh9WMwxVaZQ3ts34tYDMtIxUFGz/KCbaY3BLm0mEec w9JwJA9npqNJxKz5w2Hucz0uT gYEbls yUoFbFYHxZTHLezmtYHdEI0RTRfp3tLhg=&e=0&downloadAs=Adobe_Reader.exe&fallback_url=http://softdownload3.com/s4m/.../AdobeReader.exe

http://www.downloadclearbest.com/c?x=rO/NOKqgiBOPQDrMPiTe9eEDM00LcyXfiZ1qwKEacBg=&c=XLUcGniBfkZd tSUykGDwG5nPxNU6RBA k0LvmqHTJf9MwU2QZ/ODobrwtfSK1agfF53qgBbhqu7fiZgB9ZjwnVfk344wU8nX3IGeyB0vLLnyBVJK PnHw 3XqiZXaz1PLlPpAxPQR57Dm6ZZJ GDwjqxPy5YqBw4sPgjNIjIdw=&e=0&downloadAs=Adobe_Reader.exe&fallback_url=http://softdownload3.com/s4m/.../AdobeReader.exe

http://www.downloadclearbest.com/c?x=Ch5U0R9NGVHv6oRFv5ZoU1UnvMHnFue66jCtAk9fJwo=&c=UBPaQ2ZIazUAgEpoKGbZeJqZKiQU2Ki/GxdFxO956Llu dfwxc4n8RDxekWhekFPxsuyK3ovMJpl GEq y8ojVZjXjIBr/ e6vZ5eRBeYULZ58kJZyKzqRYTghbUE1/1tbuiN3wH3mOGDhWxH/CGHCZ6iJ6hGl efmD1mT04EI=&e=0&downloadAs=Adobe_Reader.exe&fallback_url=http://softdownload3.com/s4m/.../AdobeReader.exe

http://www.downloadclearbest.com/c?x=0u7fx1J2juzwFoxh4CgAFW63exKe5tgWh/lVS4RiRMk=&c=wUzgZ2Uc7SaAQvbRHOEBIh6WMyDL0Cx1dlsV2QeHFPXPpteG sl1EKyp05fNdrq6ZQPM AE3RVrLHbcqbxAgEAS8lmdyurBJeKzZkoq9IKScDx81hYVnhY0ig6MtBdcry2eNQ2o1HN8givI4 0tHEIMpPgvxAVmEQWZ8sWc/DG4=&e=0&downloadAs=Adobe_Reader.exe&fallback_url=http://softdownload3.com/s4m/.../AdobeReader.exe

http://www.downloadclearbest.com/c?x=aI HWljL8S//YzW0qOkhO7yG5Ezi2GU37mte8ef/n7k=&c=5yupvO8inwQhyDoquvJ R h4NR5PAgfzrd/929ggwE7cj5zTH39cAPcmvI71Ylrur0aPozPdw4JvJIHlrYDo4lEDhG9oSO2KWkB5xl5rFP5ff9aKTcigyLcPpcMgVa8YbvvOe4qo257KfNEskpHpGqmXX2FKjcjxTgTgirzc0Gg=&e=0&downloadAs=Adobe_Reader.exe&fallback_url=http://softdownload3.com/s4m/.../AdobeReader.exe

http://www.downloadclearbest.com/WVl6OTRQVFpsUTJwRlpHZ2xNa0pUUTJwemRVWmlVMDlKY201bVVGb3hNVWxFWnpodE5XYzBlV2RxTjNGSFV6QlFUU1V6UkNaalBUQktSbTlRYVhKaFlTVXlRamxZWkZGS2NEVXdUREZEU2t3NE5XSm1jelJNYVhKeFowOXNjallsTWtKTVRITTNWMDl1UjNNd2NWTXlWSGRWTWlVeVJrbDJlSEZzVkhaVFpuYzFZMjV6YVRCNVRHdGpVekowVDJSUVIwNWtSME0zY25sSGMybDNZazR5VG5seloxUk5aeVV5Um1aSmNVZEhlbGtsTWtKaFdWbGtlRWhoWjFwRlFYcHlhVGRhVTFGaGNuQm1UVTlrY0VaQ1YxTlhVRUZFYW5jbE0wUWxNMFFtWlQwd0ptUnZkMjVzYjJGa1FYTTlRV1J2WW1WZlVtVmhaR1Z5TG1WNFpTWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpRU1V5UmlVeVJuTnZablJrYjNkdWJHOWhaRE11WTI5dEpUSkdjelJ0SlRKR2MyOW1kQ1V5UmtGa2IySmxVbVZoWkdWeUxtVjRaUT09

http://www.downloadclearbest.com/c?x=4YPdNLGSJPbQvy5BalRrMEmRVWtKx8fNIkUHXAuTQHw=&c=FE5LmB6GDlZWdFukbyGZJkU rsjXxWHZLdudg437F1oNcNizXZhOl0MFMzRTISAO3MxrBBtu52vJ0LCcNz6P/BNg JvE TslFnYaIbtYTMgCB5PjUZLRhnzO3iW7KO5M5CK3HDDJlP2ybCaeumUZXIokj /0NlHoarL9yazbprY=&e=0&downloadAs=Adobe_Reader.exe&fallback_url=http://softdownload3.com/s4m/.../AdobeReader.exe

Remove adobe_reader.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.