home

photoscape-3-7-32-bits.exe

Installer

Bumpy Apps (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application photoscape-3-7-32-bits.exe, “Installer Setup ” by Bumpy Apps (Fried Cookie) has been detected as adware by 12 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Baixaki  (signed by Bumpy Apps (Fried Cookie Ltd.))

Product:
Installer

Description:
Installer Setup

Version:
1.0.13.30550

MD5:
46a685a31498306ed0655b8fd0514fea

SHA-1:
e446b7639b8aca34392bc2c4319458e2592a2220

SHA-256:
747f0255ee263a244b5c008ccd2085dbeb056f318296672ec4b02edd42b7bac7

Scanner detections:
12 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
5/8/2024 4:34:13 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
Adware/InstallCore.695904
7.11.204.32

Baidu Antivirus
Adware.Win32.InstallCore
4.0.3.15122

Comodo Security
Application.Win32.InstallCore.DL
20797

ESET NOD32
Win32/InstallCore.UQ (variant)
9.11053

Fortinet FortiGate
Riskware/InstallCore
1/22/2015

G Data
Win32.Application.InstallCore.DI
15.1.24

K7 AntiVirus
Trojan
13.191.14711

McAfee
Artemis!46A685A31498
5600.6877

Reason Heuristics
PUP.Installer.installCore
15.3.1.12

Sophos
Generic PUA OE
4.98

Trend Micro House Call
Suspicious_GEN.F47V0101
7.2.22

VIPRE Antivirus
InstallCore
36864

File size:
679.6 KB (695,904 bytes)

Product version:
1.5

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\photoscape-3-7-32-bits.exe

Digital Signature
Signed by:
Bumpy Apps (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/10/2014 4:14:20 PM

Valid to:
12/11/2015 4:14:20 PM

Subject:
CN=Bumpy Apps (Fried Cookie Ltd.), O=Bumpy Apps (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121B000FF2DA5043B97A16823C79402FCDC

File PE Metadata
Compilation timestamp:
6/19/1992 11:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:waopbhpAM3XI6da76QikQ7TE5gflVCo5jOptDbBY5IIAwfMC7DCgj/5BsqBDryK1:waoNhn3XNa7HCYgLbItDdYu8MjgL5Bpb

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file photoscape-3-7-32-bits.exe has been seen being distributed by the following 5 URLs.

http://d.baixakifiles2.com/?ic_user_id=9289&data=VQlJdSSBlNvB0NQBJPsWkjfdRsSRvq3L5loR70mKkFejc3AaYTKe9yXmIT8qqLaXDVu1EOPOu92n1 JWysu18X0aWZrHR0LqEb9imQkerHIdPvTZwrjXugncYLFLcv0IfharKeTXyHr/mOP4exOkNUcDMGlnSzfqfCavRisOPGmlfnVLxxL V0dv 5C0By4mz5sCmwRn1Eoo9 qZLdgVvT4pKlKW8lvbPaquJOY1PoKChGgeMQeTi180/opdvCG38EGU/4wn6dD4UdQJWQ/yMh Y0F5VJ6tMDEJg2bHYmXDdNz bJdZ4E LSnAKfOUw7dXyGdZuk6kPML007kkRnz33GAUBIDqsffhrTiY6lWMpVNokenTOHEO/kCc3R1GPTINLXwvdxnTzK5NXBWz97 l8vV26fWtcLqKJNQn17OR neGQpii3jc7MPfBfTBGyX2T5hQIud46gF3yU532udUVv3A7YA8UabbNUf9C 9ZtXSsL1ER /hRhCmiLqo65XUwPBucm9Q4ju4Yb0KEu5dZ3J4wghWsjQwZep01yKtlL2IxZ8vdr4IKQh7/Q7zz8cAhp2CTaM8ossKLX3Z8H09NBkjggyjy47yv0iOYL7nCSAlJBZCQ5il4q9rqrm1VbA9E7uenw7LfUViACtKRPZEHOdGaooirzCaYNugi6pG3NL1QvHavCM0HqJBN8HpyBRYQrniyJH7Fm9aw0zptX5bf7gTvLLG2g2Q2Mtn0wLMaAQ w2gKmX jjuA2Jx2B8w==&key=JMKonLvPVjQRhf50t/IObt1K2P9EB8Y6oHcv/FyFT7Jbt5 3RWSuL6nItyv7xdRrAqGdl19MlyH5EJyFWuDyIUUo1TU2 lw7VI/xID/.../zJWorfX3pK9nGfKvhnFs2Ut

http://d.likelyaa.com/?ic_user_id=9289&data=1y3EAmPWRy3cjPMJ0UT3booqZW hAVBNClEnCSo3V 82KUxc Y0O6/AnzFzki9OBiqOZYYOeSuUMGYsdJ4o1WgzKPQs8MG85ZDHhjCbfQ8vXF8YIK z6e2l4VudPs4kDzB6Kf0mQ8i6Q5t1hyKDdNJvHvqlyQaAwEMC0YGeuTFyqc/ofPVAan1i6pXOx7hO YMDzdkT/3HVPzqis0xc2WOfkgvbaeYqHhYQNPoxClo7Pf6RQxg3Z09K5atZxJEkHC953aiwTPIAqpauhkYao0eMroV/l5pcgayG5JI/494VHNsHLYFNcSAAAbosleabRhZxbxciIkTLpdu4Gn5IqBpnwssDzKs8PTlvsnJOUTowinp3IoUpLfLp/f4ibq3qVwzpqdYtSn96/sZhjPKRkSY S5wVlQmf/WlQgI0Su9q1NescFz4SzLBvWmsMykkrSEHf9PtuyMv7Y8NDk8KYd4hqHY63hfE5CU1omwi5tXryHAga4Vy7WAPGZT/tYdP2vspKKsGF37fnUYUlQnIDiLwCqppZQSnoemjXXSyxcGq6zF4bNEpBqo72j7BDD4EalNGHCMx3sJmH0ZoDfAtbrvRRmI3IWaRWAhxlve9z/ycW50eoaqYOAXZ1y4CuqXQwYfHAq5xuFqpcK2NrfcdBbLkvrDsH/zWLqnOygTffJwHO/0Qw2ahaGQPiGKsEOpxHLwACNxcZex9 o6ZL8v6lEAAe/7qItd7LiQpVdM7fk9janJLg7CTwkBCK3wLQ1yg==&key=l0qTtU7rW60J441inZo/.../ltr2Abf7OJxPpy

http://d.likelyaa.com/?ic_user_id=9289&data=0LtAar1ZJd1OTYfOzfE7n qZeICurbUvQE6Rw77SuYwK2sHbYQSuKDkua hwPdN8AspdreRKmUWVSWUGfQlFM9GKAjdKcfVoVuSAFspx1patSTpR8RNC4 IxVllYu0b7wdd0R7gPmLFniSw4oUyt6x//DVdkHXOlFH2cNsN6uqnLjlcBb6CS6p9BZ59fhgrIuXPYKAcf/3W1zf 89o2XGNvLOZ81pI40xukO3sT1IBJe92vfLb6YdbSqqUYVqUwRG5ze2EBrPs0oD2kNylXba6y2Yc7JUFi0bYBPmnE86cS8vHBZv4ijlmntl0sjtS YT7jroAIKEdIEzaxMUWRBqsMV dMjH 3Jl3Ex4dP3OvZybjmUuYO0Wv7FyMFQYg3TVGCy16EaagL2EH w8aSqrB8jXRhsiE88FF2xeqzPwFdgM PilfSk9vI7NpQILjPtfCHrN6AjKpGoS6cnIzwxuzhGAgiWU8FrMTYG01Kpv2noHrRRL0f8IDFRedURpRB8Ibn9Zqo3B FVTxESlsCTpq1gDiDe8h7Ryp0cXJU4itnhOcNZaZo7RHKsfzfzRflW KnsKe54iI/1z/S5NzKq0L1FbTWdi39gl DZQdks5vVTWP4NKlWurfgAcicC7qdw7X35s4vzQPoz9 Y 5HT9IRmf1s1qpCT8jwRQA8qwTZw7Bv2BCwL5maShaOuNn7e7mlzr9v8H Qq9mascvRddfOP5MZgZbKeyxhxR344/vQlOqgeWg1XoWw5D3/.../Lqx5LvcTAdivOuBQdJ6z3rXXlxvV4rPr0wcO8qruKbSsFXVT4AQOtfugWoqBbiy1MTkqfhqcoV9QC7PpoxRz5R6xTsGgm8zwt rOb6hQCCZs20hB1DzvG0H1z2XB9L6ivdv9xB9S

http://d.likelyaa.com/?ic_user_id=9289&data=5cwoUXlohws/QcCsCIxoRnUUCpcIuo9Z0WHQKa2OA2oRB1r6TCbEna7Sj/13Db74CyquQ0CdsdJdrv7laAKWHLhxIfkvYinuoY1ZlfLYSQC1t4ggccrWheUpR92iNpFyGfXuVGdlEUZh3piOqUs5 mzP2MHxoU xqfKwEWHKAafM6eZqpcc/XRFZ QJQL1u2q6HFy9dpx8F0Lc/dYF1EMuXSlW6nIPZrkUkA0HRkAvU3ZVC3uBeK/jRer xGj5b6usoPS3znYwAeFdCSH3ec20ZxDj77Uw1Y9fBL9KmrpRIlWlr8EMMSfSz4 LSEznA9jdeFjsxQgNigIYN6NLxI9d7ACEJIVf1FhacDD9zAXtcnO8jXakdgG3mTUMFfYPFgWLZPFYx64ONQTDOQZotEjh0O5uc9Ai4zpzCArwRR48bGF39UonQEuWDR npQ/IJphZQhrIixeHULNTwK9xflOm8EDEepuXWQqItI8U4/rbg7TyfNcCQGIEfNsw2B4BKPKU/1RJrpgDxcaOpyoibDHXugJ0pf0oXa3EPIZZ8uT7ahC/UFmZw1hzbdNx3YJEVhmBYIxkF5KHgDA8EgJ77G/vTtHsyDCfajp0pVLWY9YSTcQ9TIi48bWBrZvTw5bnHNxt0GFKTpf5/e/yGAAl1RoQ8knk9G42Xep2r4hgvoMAOmHqGceQMMDy2 gYhvkKfEZS5cga/VrKTEhLqi1USEIvPV669QS8J q7GYYxEIsHTecYQ7pKYn5wj7rEk7Nw==&key=o0sBG4WqG5Vi/yYeuqkWkHvQB/CjaH3BFO8mIr1dL3UC FjDUxofSFv/.../

http://d.baixakifiles2.com/?ic_user_id=9289&data=ZFUmuOkbSnBPVKDFxV7HtZ10ICbPZX0H9T54qHYWCVG2/mAqMIRuRAc6Ltd K4MUy evpwGxpOIVSdYQFF TstreTN43N7jTYIp0VRR2/bEACW6tVfysfdoEfkvbD2exfi1A/p85bm/G3ECZKuwoShhLMc6TslOGkoz0x5 uqg2hOQssPk0RQJk0ZX03ohoVeiEkP4OpaVy0LQEOSKylgikiCzJnUKjy/e0VFUTVU5jg0IOvx2U2mT3W6LA/YYqhWEFnEQ2PbqPdGk8FBR3vXyPQ95DEAKeANFF6DGjT4y49EkEVENN16W6s5WWU k8EBcdsKEF7fKaSaJL59Xvhs6zdjNwRVKgOQ4GeCvOkkrFf87fhYuaxFODrNR3uYWJLFufddmyf kAHTcJqqUYSSZQBX5XFcAtq9qn1bXvBr3GNs1 Z5g rRdzlR ujia0EH3RYEjzpbaurfFn77wFGl38JWA94L7FKe1iFU/QKrTMJ5bQUGTmeugaYUZYNnLfAhelVuZg9p34O0i6tOsZzGu5T L2dXH acqespSW2ZRKeIl2Fe2w0K/9ugPhPKrpQVUidFmqWGQszcRplir8G43QEdz0nCTWh1xYHrA6oHourJiZtUD3DShtg4j/sKlcZOKX3ygizeM8PLGGXx8r7g4AsBQd/Kq1Oh76Ki4nP0fZI7XQhFlLUEVxW6uYa yDGNjHENdHhx9q0Tcy5wDECM5AjVlZ B3zmqSp2awTZ2M60XE2U54j1R4GRF3M3FQ==&key=Ihm/ul/P6iQobzp6uEBQvX0hzxx8lZhfLSvAstoF883ddWIvfl5NVpukohEd3uQAPFc7q/.../enXBL 8dUPU RQ0Y

Remove photoscape-3-7-32-bits.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.