home

opera-12614-dp.exe

Program

Setup Alpha (Alpha Criteria Ltd.)

The application opera-12614-dp.exe, “Program Setup ” by Setup Alpha (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.presentbytecontent.com and multiple other hosts.
Publisher:
App Web   (signed by Setup Alpha (Alpha Criteria Ltd.))

Product:
Program

Description:
Program Setup

Version:
3.6.3.6

MD5:
f8575839d770f2f9c8ba64b46db5cf16

SHA-1:
04afa72f50923a3e76690ff641fb57f01a37e04c

SHA-256:
fd2890360231fe392a85c0c5c21d0c6ea1c3c6c48a26ec4a9753a0f474d7e4fc

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
5/19/2024 7:42:47 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.1.19.21

File size:
934.9 KB (957,360 bytes)

Product version:
4.2

Copyright:
Installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\opera-12614-dp.exe

Digital Signature
Signed by:
Setup Alpha (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 1:45:15 PM

Valid to:
8/26/2016 5:19:30 PM

Subject:
CN=Setup Alpha (Alpha Criteria Ltd.), O=Setup Alpha (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11219B5C9AAA1BB2894A8F5BBBA84E94A0E8

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:sTtftJCzKgXvzcszH4bUgkH+4rS92XbN9:sR2zICYvz4rS92rN9

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file opera-12614-dp.exe has been seen being distributed by the following 6 URLs.

http://www.presentbytecontent.com/c?x=WiLsAn7RPiGKEF7eGOI2VZlXGAXR/t8hD7nZk70 UUk=&c=ltgYmsj7/Tkee0nmNXdAJRzBgrIdllNza7QfshoxhhpHzHNdmAZuf n djFSCWvMQ4NkF/Win6DWZZBnbB3M1VP0CYC4WAVYgAM15JtpOmRtj8weXwI/yBLCPsGlBdtfSGz2LSoTgTMsNp76rDAw7A==&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.25/.../Opera_34.0.2036.25_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.sendupdatedownloads.com/c?x=Ns6NzDsdxE65VOWR02/0Un7GhaC499KIrmXE h0XnY8=&c=kLc6Fs2S2p/vXtFN36A3Zoqt NY2nbf073R kiJ2j1qtXwklOqTB/bP8OZd0Fit UATFiyffydXJsyiAkcP1qcXX j/zdAF/tBY1TZj S1putBlxVWPj3dHN3RSCUM4q8RKZ8ZNtMI1mGac3EjuPWg==&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.25/.../Opera_34.0.2036.25_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.presentbytecontent.com/c?x=UVmG1d YUCQ8Zx Tgb5dxJJSSqus4OKsBw0P7A9UlpQ=&c=yhV4 N82//mHrtUAmGKK7QtfOQqwv5v3Y6Ua3 nt2aczOjU66aoJDDFYDs wbjxkpxZ9QbmE CV 4K s3rafp5KgsJiKmphpNxw56G5cNq9 OIdUpfSetKqwHgDnNFWda1tsa3jf3QxRxflzz/sLmw==&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.25/.../Opera_34.0.2036.25_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.presentbytecontent.com/c?x=i9dv6dBczwYb3foic/xqt1haPz4P9xK8rMcE UBmNVI=&c=pIY7q/pRUojfncBOUBzzT5nnoOdEwNMfFkvR5xDdclcYbrRHxPTqNMP6HfrmhCmzHwbjOyZmT3s0sPMVZIf3vwczrGxSR2RzyJ jT310IvW0vydpt2DVpZlMG1VFSfaFeuTip7VocsSDS8cRxG4cbw==&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.25/.../Opera_34.0.2036.25_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.presentbytecontent.com/c?x=5Ktr 4KmOqopPfRzysz2nGwyOWJZOneOdSOsnZVISds=&c=ie 11KQ/YtkLIVH kELESMeJdHcPzGdq2xnd4e4EK2hi4 Bdu42tvSP Vc3FVUQlKpcLDHSmnwb9s7WEXdH4p8/PT8/4IrkeH5653lN0cYdp/ZZhQUFSEgsmp4/TvmRa5bVvDgYlFriWL2vFcEF5jg==&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.25/.../Opera_34.0.2036.25_Setup.exe&downloadAs=Opera-12614-dp.exe

http://www.heartbodytours.com/c?x=aiQqQL7DEEhaq63b4RMGob4e5Uq6uei0guixGHtHNks=&c=tQcL3pzar0CdDk/MNJk64V7yLfE6Wf2XLIB87E/6HvjmzQA8 olwNVDvcpLU70dy0WSnHYyTVFgE7nANuc4E7G1sfwmOUdqlck cq2rfgGfJj 2LBt6hpo7O5AXaM/tiXl5Kki2TA0xI0yxuyxm4Gw==&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.25/.../Opera_34.0.2036.25_Setup.exe&downloadAs=Opera-12614-dp.exe

Remove opera-12614-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.