» libreoffice-4-3-2-32-bits.exe
Overview
Analysis
File Details
Downloads (1)

libreoffice-4-3-2-32-bits.exe

B Install (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application libreoffice-4-3-2-32-bits.exe by B Install (Fried Cookie) has been detected as adware by 10 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from d.baixakifiles2.com.

File name:

Publisher:

B Install (Fried Cookie Ltd) (signed and verified)

MD5:

fb4bb0511bc337ada854fd814c9514bf

SHA-1:

09494057db9b64527f717e764ab38911c0e38b5f

SHA-256:

1934b3bba34724dfd5212956adbf1cab8a804609c0fd6afeed3611345fb85672

Scanner detections:

10 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

4/25/2024 11:18:15 AM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

ADWARE/InstallCore.Gen7

7.11.179.8

AVG

Generic

2015.0.3304

Baidu Antivirus

Adware.Win32.InstallCore

4.0.3.14111

Dr.Web

Trojan.InstallCore.7

9.0.1.0305

ESET NOD32

Win32/InstallCore.PY (variant)

8.10575

F-Prot

W32/InstallCore.AC.gen

v6.4.7.1.166

Malwarebytes

PUP.Optional.FriedCookie

v2014.11.01.08

Reason Heuristics

PUP.BInstallFriedCookie.Z

14.11.21.23

Sophos

Generic PUA AJ

4.98

Vba32 AntiVirus

Malware-Cryptor.InstallCore.gen

3.12.26.3

File size:

668.5 KB (684,568 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\libreoffice-4-3-2-32-bits.exe

Digital Signature

Signed by:

B Install (Fried Cookie Ltd)

Authority:

GlobalSign nv-sa

Valid from:

8/28/2014 6:11:53 AM

Valid to:

8/29/2015 6:11:53 AM

Subject:

CN=B Install (Fried Cookie Ltd), O=B Install (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112134BF438D1A8B88F0576F56DF36EEFC3B

File PE Metadata

Compilation timestamp:

6/19/1992 7:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

12288:/eXFaCMpDWHb13opDFr4kPf5+gOr6r96Q2qnDrUE:/eXFr/3opxrFPf5Qr6r9yq8E

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file libreoffice-4-3-2-32-bits.exe has been seen being distributed by the following URL.

http://d.baixakifiles2.com/?ic_user_id=254&data=nSNcaIsBb4PApZTmB4nTcWE/M0eRhkwzE TfDROyJsvZbRYN1OdglhkFHvbyJiCnJe2vCN6YwqMthmOaudc3gOXjAgcAZZSABJfdSWGvdkBGvQYCusWA8wIHh7DMP br3hoBJVY08c4A0iYIJR5vIkKw9hJaWbEf5bMQjhQrBdAV0lFHh23BZ7IH4PL3ydhxsrklSkwprBGqpN qc1k31e7NwdWW/Y9otguprZdRcMMB/SnVHPhl8E xwndctO3oy1g3qc6rV2wxNHR9oTR7A8vKXQ7r/rdxfkroLZe1fKvnGnepApD/AvyLssuVKC6fvGZWqF1HX7DfNSeeK8O97HZAXktIN jlbHboUAx8xbPcDFCyaPo09LfKp3gGTkKTeKeZleJMC6/SL2LMm1X8ibRjWxDxPqAO8SSn53TXOGQnQ4EaauMIr3Odpu1Oqe2FU5skOYFijKfnNVSKnLJw7R0pkpAIcHY1BODPlhfnMmzbXQxh6aWxW7hy7bWiLdPhXzHreHvA2ltG6Zwb QfMhEPTcAgh0rvIJbW6n1a6xkd5wQbX732gblDLxzea2SKiHj6UubgEw/2rV9s8PJAiKxmDq4iwLkKZCeVT0UvX9ilxH4M6SnFV8lvSMFgI74lJ58HHm8mKCo POf42afFjxO/A9Ffkz9sQLLk7LY4Oh94vJtKeEEYOBhJapsO0Cuyf376Zn0GtcyB1LMiUIQrwTRjv8ZRiKzsa510XSfi/ sAYHEVm7nYJitI=&key=UbrE3RrENKyJ/hoP3wpGu5Fnj4zDSHMFolFcDhHv1Y24k5Ayp62d7xZE424as1IaOP0Vx4Ca2z9GRgOiS87God6dvcghL0HtXt7r/.../mdD2Vb8Xo6pkOR1VCspMhhJ9qq6O0I8yO5eoNhHT 8O52D4HO3UflR

Remove libreoffice-4-3-2-32-bits.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.