home

minecraft.exe

Fonebemut

HALOMOT ITZHAK LTD

The application minecraft.exe, “Fonebemut Setup ” by HALOMOT ITZHAK has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from www.newclearchuckle.com and multiple other hosts.
Publisher:
HALOMOT ITZHAK LTD  (signed and verified)

Product:
Fonebemut

Description:
Fonebemut Setup

MD5:
48304f48f1f067ade8de95be0221e714

SHA-1:
588071fdfabeeb355ca88bec8bf47b5f4b510dad

SHA-256:
1886595209ca6b51b440147bbca15e6265e1f2a7b1ad4b04349e71cdf1197985

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
4/25/2024 6:43:22 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.HALOMOTI.Installer (M)
16.7.2.13

File size:
1 MB (1,049,408 bytes)

Product version:
1.3

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\downloads\minecraft.exe

Digital Signature
Signed by:
HALOMOT ITZHAK LTD

Authority:
GlobalSign nv-sa

Valid from:
5/19/2016 9:04:59 AM

Valid to:
5/20/2017 9:04:59 AM

Subject:
CN=HALOMOT ITZHAK LTD, O=HALOMOT ITZHAK LTD, L=Modi'in-Maccabim-Re'ut, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11211AB677B9B3A619202DCB1133AC8F5CFE

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:weizrMuX6TEyXMXSxRjwso5SqNcQXlpYGofHTY:wfM5TEyXcSxRjrsGZlHTY

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file minecraft.exe has been seen being distributed by the following 19 URLs.

http://www.newclearchuckle.com/cRLxCLBOgZWG4Od1Pnqy3xBlJqbzRqY_Kc71og4aTXMxtN14Sn7usZwxmAja88tHo871TVEYuP15rR7GEI7VL5Q5pfCyl1iJi017kUv0niygpfvBLJ1mIKsctOELmUclIf2r5vH397aVKn3UGMR sE T 7xTwHTA sNKnuS_7aCDJJpAgLJPNXkP3kB_SV6vLkwatgG3-G3AAAORte69pY0lrioiJwwJVpxyw18ra55F_B BD7ZAf9ujEaWtI2xgubUm DVrQ9XyQz ngwI_TeJ_poPqToujJK7wl6ATyQpLWn9VNGoQA

https://s3.amazonaws.com/Minecraft.Download/.../Minecraft.exe

http://www.newclearchuckle.com/AXcofxauqTtdws1F7YOzVId4BApMrUYZc8GyPhDH0SykRfxP3v_DymTJZVkJ2v969sQI63mL9hD29vAanszsPhSrdbw3nPtKl3vs2nrq1Kts 28TGaA327PYVXObEmw lbD_5xqN3RvkZctuibEiPJ1l05vYrLHxRymC71bk4cPQozrOhfBfaNd8ETtz4r6p2c65yvK_fiQI4uBKvDWyFciBNExTPBbdUj8hax3fuE67bKkiomIfuHY gf_Z4jcSZoJ6dtj1f5eryW0 bofkDn1rYaffTFRO0f9RAw CaMtmPBcuFzIoo8eySWhSgWg610qWTenhPkiphypJ2sN8xOOecloKmB MREpgQnt6vVh4bzGcsV2qUgn3bbeEVZlJMuawnJsvvTSKe4YhLPfRsneOKC9m HAN9iMhu9pCN4_ETAFokwqt3zuAXhKSEc gZP5HgCSnA4RnEg_AX86CfGnoMMJF2n9_Dt9PblTjGOFeaQix5U=-G3AAAORte69pY0lrioiJwwJVpxyw18ra55F_B BD7ZAf9ujEaWtI2xgubUm DVrQ9XyQz ngwI_TeJ_poPqToujJK7wl6ATyQpLWn9VNGoQA-e

http://www.newclearchuckle.com/rpRUathEkVGXQGqE3VNqBkbjDxqnLzAuI09BoCr0 vvMWnaYVJ7h GN S81BJjO2RpX8O0F18A3Y1mWJWQr 3UYdcZLs0IFX55i67Rt3cQgw4bnsi XzoiEbZ1NoOCo9iGLu39PN1FVIMghbjA5Lk1d4jM2vDcHuPTT FUOrmt_6WDyW hBSqFuPHztAsDfXS0sXBZxr-G3AAAORte69pY0lrioiJwwJVpxyw18ra55F_B BD7ZAf9ujEaWtI2xgubUm DVrQ9XyQz ngwI_TeJ_poPqToujJK7wl6ATyQpLWn9VNGoQA

http://www.newclearchuckle.com/Y3r2RuyuiNlIpVfObTOOdVC_YB2WoAvkjlyfr2eAy4ZCIdhEOTaIiIh UPnskXkl3LADvR6nkov5r9uIsY3CmiQGx51zVS0TF05CxK_Gvz7drV9ELZXFKAv7v091UQL 5t67IEcsXs55Q9rpaw6LbSXqcYjr5 0rbHU_xxrjoLasz4zkup6wrGOdMcYcS3WmI6uDqIhw-G3AAAORte69pY0lrioiJwwJVpxyw18ra55F_B BD7ZAf9ujEaWtI2xgubUm DVrQ9XyQz ngwI_TeJ_poPqToujJK7wl6ATyQpLWn9VNGoQA

http://www.newclearchuckle.com/rVGWwpz4s4R3UoUhgC3ilgHZmZHj4EWZwc7fIDSHR17wOJkSwJfHnVX82WQN8JPCE0x_hRYa_O2hxR4lSB5x0gpIv5KSFjJ9QoFCeWlEop2PoecDDn7VyZQdjG3WpWZ3 2ClGl91ATJiW898agubNxHrFssTgUKUAR7y7xma9R9DdobD6QGrf3OBu7pzwCJZU EwFMYU-G3AAAORte69pY0lrioiJwwJVpxyw18ra55F_B BD7ZAf9ujEaWtI2xgubUm DVrQ9XyQz ngwI_TeJ_poPqToujJK7wl6ATyQpLWn9VNGoQA

http://www.2016delivery31.com/c?x=i3bfA2Ia4W3KjAZbmcwh56LSFcJFNt4ipyRdHLlwmfc=&c=O1csQhqDiP1BFUjyISv 76627plE cwlzhW1rrIDkT/9136gwdv8y7feS40i2RN3MJCGR4WPcQ2N9/9we6yiX7LL OBShz17JR2ZMwEqzeYlgoh1/JQJnAnLC6E2AE/Fkho7EFN7uDpROvyGSJKqVvzrrqCWf4n8q7J21zE7vWs=&e=0&downloadAs=minecraft.exe&fallback_url=http://minecraft.es.downloadastro.com/.../?utm_source=ira&utm_medium=error_generating&utm_campaign=minecraft

http://www.newclearchuckle.com/Cl_TEYEwRDfvGAX1AIw6XAOi896gdVAjElXgf16Lk2gJ801yP3b5dffum6DxWlDAGNQIds0PWduYO5TfUqP4F64DiX1bVzmMV ZM Y31y3BPbaINJbil4SwKPNLUZKGxZzKHbWn1wJPSALTkETlhPPDSbCjIep4fCYMKpgcytMuWlaMEEdjmshNvy6S6ee5rrB42134s-G3AAAORte69pY0lrioiJwwJVpxyw18ra55F_B BD7ZAf9ujEaWtI2xgubUm DVrQ9XyQz ngwI_TeJ_poPqToujJK7wl6ATyQpLWn9VNGoQA

http://www.newclearchuckle.com/JYTEVHSkUWMo2Zhw_x1Z8BXF8bTqeF574hLGdFe_xYZ1ylantwtnCj_V65XV97iQZoMVaAhWQHmj25KfHECNujfULWBWa2toE8ZDczGlGapLmHmvP99LwxoWoDyFvOrPq7tL8VwdLT9adDJITDQ1tvLjT9h19UKH0ZPvzoVvrLselDqC_ot_w6vsP2BtIf47 wwrdHGN-G3AAAORte69pY0lrioiJwwJVpxyw18ra55F_B BD7ZAf9ujEaWtI2xgubUm DVrQ9XyQz ngwI_TeJ_poPqToujJK7wl6ATyQpLWn9VNGoQA

http://www.newclearchuckle.com/N778piFrCSSDrfVDoDNkQ3 Izwq1t5oZzFW8trJINHi0_4S4lWFn2ZOapbpfUQKgp_ VDzi3m3oxGC o_dXqAS43aGYOuA4hX5828zDn19mrdE4EHqIruar KPBj3L78mK12yWEsIpqjfhp14AWLAWLRVLdYoonzTHUrLaKkVkJ5Rq0XgP7QLI3 78Z0Q3txUyTdnkzl-G3AAAORte69pY0lrioiJwwJVpxyw18ra55F_B BD7ZAf9ujEaWtI2xgubUm DVrQ9XyQz ngwI_TeJ_poPqToujJK7wl6ATyQpLWn9VNGoQA

http://www.newclearchuckle.com/KC_1yOcGoaTe_Lqkgi528rzedHlUi p54lQzhBhE Z4qTdfRcR8TOEHpA6gKnC5OKdQ7PJnTMa8uzEohE6_HSLWmAXX31_QRq0BNmxqKfYKxUMJPDuYkX9_YKgoP0CTFf1H7HyK7xiy4fgx8W8uB4d9FVLd4loTp7eM0Q7wrJrb NUX9D7ZVh4xDNrUYZXGWtQ4M3_mq-G3AAAORte69pY0lrioiJwwJVpxyw18ra55F_B BD7ZAf9ujEaWtI2xgubUm DVrQ9XyQz ngwI_TeJ_poPqToujJK7wl6ATyQpLWn9VNGoQA

http://www.newclearchuckle.com/pE8jiwTFrrfS5Ff4YxT3vacNpuHScu78ZVRG3E3fxg44ps84F8QLlB0cDMV FZBBta6Mts_2vzY3SycGXXaZH YK5nh58PaGJ1_O6iJNGxXwYIkuIqoT9r9yigyQ_U iE9EZvRYbRXtKXOpf8Q9ZiiNcHi8vqAVqkQXBoqab19R_iaRC1_WqSlFIpupvIwLeTI1g1H_2mRxBJffMn9j5EMapCt dWYfn27dHG5Efab1ReHA91Pr0Ho_ZI10_qXoqTMJLTF5vv_RyE64MO_uD6W rEiVN097xGsixf8sWgKvNBo6rDxY3bnW HJQo1VLtx7Co1UWA PKuVRI0cVQ3q58uEa4y0ocd8XxQAYaonrHN7CX94Sbfod_StP68W S4iMp65fW2Rl ShyDkMTsOBn30MygVIJrky98xKXgd7o7B4tf2ufefTx34zqHbsoX4YAAaxMq02IwGBR9v5mUkURGOYHERuTE9pqKqOMPYytMxZl9GOuI=-G3AAAORte69pY0lrioiJwwJVpxyw18ra55F_B BD7ZAf9ujEaWtI2xgubUm DVrQ9XyQz ngwI_TeJ_poPqToujJK7wl6ATyQpLWn9VNGoQA-e

http://www.newclearchuckle.com/yEfi3sAKqFtveqR66K1gGGOTDs6JaN zSxVepMC5bthVhFMVtVKYqL5rVTjhOzhbaX0xu7jQKyO5oCYZjnlhTl7tQaPLri69VZPtE_dgmqnZuphZPdvFt 7zu3q3Sl4wOPgTGENQ7_Yh2P_y88F1lNcLabnCRut2 LKkdwnXb0E1nXGqaerDC7l5J_SymBPNMdOfcD o-G3AAAORte69pY0lrioiJwwJVpxyw18ra55F_B BD7ZAf9ujEaWtI2xgubUm DVrQ9XyQz ngwI_TeJ_poPqToujJK7wl6ATyQpLWn9VNGoQA

http://adf.ly/N=DUNGoedlH5RCwdOmiF8mvcZjGV9m3bbpm1x0vLYyW4RSzMLumIRjhMcvmItXsZYonNAmtbc1HFJGvbajm1V2jLd0HVMmub

http://www.newclearchuckle.com/xn5JKe QRAugYY4YNZBoln3354lK2jRrFumSnBQdsdxdPtHzTQDj75x0vJJ36hSSiqJZP0WaLBq7Xo8NnpWdEiLyXxReaBWNhdJWyzwrbMttC9UMlzJRjJc9yZwdfSGmNHd9MjG9dKIt4mOvAdnur2q2spnGE5KbqfeLF8HElSih6CiArM2pwF2re4HpzBZ03RB3pjAq01lwL6VyZbO71 Kw0XFuyc1KEBZr0o363bw3VOxiUz5VoV2ZGBwGN7qcgUEX 9Wno_vZXfRatApnRdsGx ByxpXi2Ygvlqd07RV5b VopiEpS0n8TlCFGlIXHe7nj3iJbeJ1Nt0dPb7HRiAWGmRt6rvycaQB_EurlmtIQ0SLkfHHRE2RKPVbxP3F8Lc94i SwXhGZZ 6o01MXWGEBzEB9TlbzHouV2AY79eLJt6KyQaQG7tZZnhq8midWlH8Im1BGZYykXzu 0LhJ2Ieyne8sb4BOiWN93EBZJTdZrxfoOE=-G3AAAORte69pY0lrioiJwwJVpxyw18ra55F_B BD7ZAf9ujEaWtI2xgubUm DVrQ9XyQz ngwI_TeJ_poPqToujJK7wl6ATyQpLWn9VNGoQA-e

http://www.newclearchuckle.com/T1us0SCr_FVqFDRNIoG4_y3pOFXSJO1iXuRjXWTQ1t4aRiq3fHxHfXWJnl2HiqgCEGyAr0biX8atkG8 RTCFA9d2Qsp YECd6XlY5eevcSw6AfQu6kLlEWMN11yXpuMBElmXUME 2jqhW_Py_6JF2PxGrxUu4BTxvj5mtmLTXMMYSXN5TeX4iBIvHdITIxyMAu mzOYm-G3AAAORte69pY0lrioiJwwJVpxyw18ra55F_B BD7ZAf9ujEaWtI2xgubUm DVrQ9XyQz ngwI_TeJ_poPqToujJK7wl6ATyQpLWn9VNGoQA

http://www.newclearchuckle.com/v1uAuyK0tmxZYPR8cg1rH3Iyn4 W2WTlHGo2tq1a35vq0ytveoAjSBLCY5fdZWoIquE6qr7WKQkZsXeH0Zsukw1EcbswZtihXqA79eLID3Ek8r8 2iQ7okOjF672J0d2HPIpVylBcRYsEBq nCviVX8 UNb373sN9Ai1myXmhwl24Yljp5dloTFpIlQTdvbKcnNGURzZhtTRizIg3eZrC4MiMGv6shjTkW3gdGMPR4uYe0SOZS3r48m8FMnUzLbNvifhezl88ZZALOG s0P_9TpQxvYn2QRlm8Ro my8eRdh4YV0na5B7OfRy3q6MzBKTKDLtkdAohkXnwuEm5ZaFYtlwR6lxXYp3AQnT6Z8Zey Homxl X1kaRHvIwkIZ0TebsA0xPMeKKFRTJmDQJflk8pDqJDgxvjV2VcBXWEa6Xtf PMd69M5FVPI95Tr7ldNAIf4e0j4b9 6ehQ9fj9lhFdvqzm7MkfD73lh8B24MVrd5_NiTk=-G3AAAORte69pY0lrioiJwwJVpxyw18ra55F_B BD7ZAf9ujEaWtI2xgubUm DVrQ9XyQz ngwI_TeJ_poPqToujJK7wl6ATyQpLWn9VNGoQA-e

http://www.newclearchuckle.com/AIzOd4357X7m Hru24Qk76c8rz8w_w1SPS14XbGqhXSeNa72kEcowQ5ezAf1slc5pLj AQKbX17dtAzMdtFfxAsR2JNvlsbflQtzyvq4J_EA4IXRZ0_Q5RlxytlfUepN2lhnpAP3G1rW6U4o2nkc4jJyRkLNr36w1HFNtqY186RHwyCIdApeiwz8gwC2mdlnwnTrUCb42E9LVuyyDSTJZfk0YO9aSzplck9mviWMKig2pm4f Duv1L hwbvatzFlOI05amuUvmq4qAsJv9dwKUklrZ2EDB7GHBqggnp54y63koW2T C7gelTJTdvJRAx55jIWSTHAri0M 0uss_ZoTEICD2pXR9I6kD4MlHc2r35CEyVFLgfhZI6duzdAIjJd7cpyGWSXjUxrJX8uogz8qNuZA2peUw5MeVypX9_lRGqPXblZjEl3SSvZo YOzFJnHb0CIfcLe1ndU8pZgyZtpaPuJ7Uge871mm iB1U0iQnClJZtQ=-G3AAAORte69pY0lrioiJwwJVpxyw18ra55F_B BD7ZAf9ujEaWtI2xgubUm DVrQ9XyQz ngwI_TeJ_poPqToujJK7wl6ATyQpLWn9VNGoQA-e

http://minecraft.softonic.com/download-tracker?th=8yS3 KGEYLiw7GKMHzA/trmsvRChbxdrflJq3ZIylWvTH4EHzP0daucGfNi4 hWQ10G63 WtaA/WXUEVOrWyG5i oNPVnOFqYJOqXSn6IRuqWp/.../kllADjxFdzCIj1wJBw92V4=

Remove minecraft.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.