home

fyd_setup.exe

Kidokopa

FlashDelivery (New Media Holdings Ltd)

The application fyd_setup.exe, “Kidokopa Setup ” by FlashDelivery (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.cycletagcurrent.com and multiple other hosts.
Publisher:
Cagifirop   (signed by FlashDelivery (New Media Holdings Ltd))

Product:
Kidokopa

Description:
Kidokopa Setup

Version:
4.6.5.2

MD5:
3118bb956a77c57c7c0130445b6937bb

SHA-1:
7353e1713aaffe130a2ff6e9df8415b4991150c6

SHA-256:
ddafa2c7bf4e7ff6d1069c91ae92ef59bde87c67f1839fd1c0ecf48e2025f0b2

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
5/21/2024 1:40:07 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.6.21.13

File size:
965.2 KB (988,360 bytes)

Product version:
4.4.8

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Valodu neitrals

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\fyd_setup.exe

Digital Signature
Signed by:
FlashDelivery (New Media Holdings Ltd)

Authority:
GlobalSign nv-sa

Valid from:
3/15/2016 6:14:48 PM

Valid to:
6/26/2017 5:47:33 PM

Subject:
CN=FlashDelivery (New Media Holdings Ltd), O=FlashDelivery (New Media Holdings Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112107BDB832CA5BF7FCACBF752B12BBB5B7

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:9yiphBkrapsTp+6XDgwpIjU30BoYS8I8aTiLq3KuR2:97pDTQY6XnpO6iI8aTiLqauR2

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file fyd_setup.exe has been seen being distributed by the following 13 URLs.

http://www.cycletagcurrent.com/GK4lf1COfOheoGCKq_oOmeTNyFk66R8WsvQIXIe2c9Sz3HjQfFBOJbVdrQt4ntp3S JTckIMIzsRNEGyaLG9mMbLi9Pw_7VL2TIeqPGWh0t22Ecmvnj XvtBsDF5osfGXTPQIIoL6yDQNLukWltLT9Mtb7EFLQ==-GycAAAScYzmJqQvDes4PEzlwCijse2MceKLGlfsk_gEp zXMI7k=

http://www.cycletagcurrent.com/Kl8ycwDpYCP2T0g8r66P1aAq pgmnDw6NkjHIOENZHFKLlkGU77OiZXNOQmm69Y7UQ5unmiLci0cRQlSA7jNvLQBaYLrVqn2EJthsfXhdjwY3tHqN9iScB0ZITRzC6K9ZMpPX4qmVx7u3JHR6pJYqCdCNj5Sfw==-GycAAAScYzmJqQvDes4PEzlwCijse2MceKLGlfsk_gEp zXMI7k=

http://www.cycletagcurrent.com/WIbKTYRqiDMCdVAbo_AkWWJ9NuDthpJ46irVS69VhG_QwdrsJ4kqpnm8B7MIa2M0QNzq4kZvqEC2wHR0OuD9nfSth01RSPsPR9tlfg0PGD8dFEMEFT1TJaIJIFPXmX9tQOnuxguaiiwi2shaNukUbfdzkFsPnA==-GycAAAScYzmJqQvDes4PEzlwCijse2MceKLGlfsk_gEp zXMI7k=

http://www.cycletagcurrent.com/w Swmy3 qlH7NNiZOMhj7dFC73UJfqiOruMh9gETWO41izTj4V2X8mdPQFyd0cMBs_DahlfrOpekFgQ7BKO1aQsdbyLWr2CU8iRMkqnEWVQ4GL9_kCSjUJA1a9FxTNSsREAkO976vZLTn_ Ppqf9wAyRYAtF7Q==-GycAAAScYzmJqQvDes4PEzlwCijse2MceKLGlfsk_gEp zXMI7k=

http://www.cycletagcurrent.com/mC1eu1zxpfkX5SBWOQFrJerLIrX5eSaMO0KWfJlYf8YPyC3qfaOuLYO_ujAouGW1v4viuw73R4_IXCtLKfly9dKdnIg3DJcSfXeJPK1n41NkwnD07ukolL6YAdj3qH8IpuGPn4b1sTpKcHprDllnO9NtfK9ulw==-GycAAAScYzmJqQvDes4PEzlwCijse2MceKLGlfsk_gEp zXMI7k=

http://www.cycletagcurrent.com/x92Y6SsmMgGCBXwWAW63MOtpjeCwArhTr80EJu 80bd3gs_dBxokEgTcWc7u73Y2AA2nNjX6Wiw LJMn51sAP_FGgQZCEaU0wK0Pid ezUWm8FEqEtkL_nQV1mW6IuERIRbfeQHtLOqyzQINb8qym7fXpIYu6erT5NA44mi1KtCALt261p4=-GycAAAScYzmJqQvDes4PEzlwCijse2MceKLGlfsk_gEp zXMI7k=

http://www.cycletagcurrent.com/t5oUBNVCLxWdNSYRDepZh Mv9eU3dLgrjNmJakpItenp6ED0UwjGnExtMgz__IX8honuIhZmyv6wpnrSzduXAiItirHY ont5JXpePhD5u8sLdNSE6fnXDd2ep7PX g_1AhYWjwDQVfCEeNA5qSG0MLw4RjrOA==-GycAAAScYzmJqQvDes4PEzlwCijse2MceKLGlfsk_gEp zXMI7k=

http://www.cycletagcurrent.com/wq n90uD Ki4UxatpDbh8aVWr69mppad_aYPxsEAuStSILKvQwi8a6DLBi99 tM9GUktyNbech6BMJBpn37hjyNdVAwS_gFPnO9levvH3DKBhW41SMhYnHhCVRmNWOgf0VQ7rlhNEoZnsfP3WMlF3DIXZwpEJg==-GycAAAScYzmJqQvDes4PEzlwCijse2MceKLGlfsk_gEp zXMI7k=

http://www.cycletagcurrent.com/MGpUk_PmqYVivjkVwHfsHr4GdnqathQjL16gKNg5Y PUB4lB6E6mx71DIgNd1BJ3at55f 6op28Z1CN7fG 2cIbZndkffuH dxCZsH3GqIwjNntjhswxn6K01DIjpMg33GCHKZCIAKuxj9VjBX 52PTFxYhpIw==-GycAAAScYzmJqQvDes4PEzlwCijse2MceKLGlfsk_gEp zXMI7k=

http://www.cycletagcurrent.com/nOslnnUw9FMcs0EwG6filpRKIJ_PuKpFZ9KpJIrpXGwoW7oAjtgAtb4EzWEk0L0VvidIF4_FbwkB_Im4JmP_TLVdYmJ2kISSN3GUKnhfR0EYaMATRJfQE71TIRpePWKH16f tdCRQL5dmbZLOj_wpa8 RsGaIg==-GycAAAScYzmJqQvDes4PEzlwCijse2MceKLGlfsk_gEp zXMI7k=

http://www.cycletagcurrent.com/P76L_SpSQq6s0rKJEk72nqkr67C68I2axVhG2 hrscrF4xkJNFwsqXoPBvFdZ8d m8FGtH kIsfY5D2_wVMVxG6bjWsH0x8ISTw H5PgdsikXablmohCH3I7TY9Mxa4j4Oc1D7kYhUHng4X3G5ZOPYbzKhw6WA==-GycAAAScYzmJqQvDes4PEzlwCijse2MceKLGlfsk_gEp zXMI7k=

http://www.cycletagcurrent.com/vR9v_amce2 okvUnpvgDDmg6t3Hz_tQsQwik2kUektBDVEogBzHvX9GwOdjDReca1XWxh2wy1QnoTxZfFdpuZiur_8Q32aMmaQ7BZji 7rS5D9TJHAPPzXBOrb8j3lqZnrNqwSCac09nZMOB4rL8Cvk_pOIznw==-GycAAAScYzmJqQvDes4PEzlwCijse2MceKLGlfsk_gEp zXMI7k=

http://www.cycletagcurrent.com/0Z3VMwXUv9cFqR1LtEisLNYVMqelX6W5iRuyptsV0YUTwPaNgTusZKjWAOwomMC2i9pQrMmTvPsZXHmCgWUTW0XREeIKll2QrfExi02NgtaxGPSqqYTDV6Yz6O1lL4skxEzGSgLOggCcKQe_AUcyUX aPI5b1g==-GycAAAScYzmJqQvDes4PEzlwCijse2MceKLGlfsk_gEp zXMI7k=

Remove fyd_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.