home

winrar-12398-dp.exe

Bab

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application winrar-12398-dp.exe, “Bab Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The installer is marketed through download protals and search ads as WinRAR archiver but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Mode Beta (Fried Cookie Ltd)  (signed and verified)

Product:
Bab

Description:
Bab Setup

Version:
1.6.2.1

MD5:
a6ee6e87aac13aa629daf58c05f0e6d7

SHA-1:
8eac627dd0a9a9e5976ce7a9f41421e36384a1eb

SHA-256:
2423347250cc4d385b8ce11eec3ecd9d8fbccdc2c88222ac707d3bf98d75d47d

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
5/21/2024 6:03:54 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.5.6.19

File size:
951.2 KB (974,072 bytes)

Product version:
1.5.2

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\winrar-12398-dp.exe

Digital Signature
Signed by:
Mode Beta (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 1:37:06 PM

Valid to:
7/7/2016 5:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/19/1992 11:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Xvp7y5I5PpEla6JVWwIar2hfWz21GkqfQT7L7/bpoQOGZ/u:fx8culbVzIaKhc2gkqfQTz99Z/u

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file winrar-12398-dp.exe has been seen being distributed by the following 6 URLs.

http://www.packagesoftwaretowers.com/c?x=cb5LeS8EaP72hMTBW2i4G7J75KEf 3M WXjee/Mnu30=&c=sNMpYZ3ulXjC8OPe0l3FtP71cEfQAt1sr2m2PFawnzgqcqqle0Rp L5AEJ2Z2fWlv7erYpmpON3eVSvarQZ8ExPX2OFTIwHJke1anTky96/X 86WcoTNzAwwE/zDRXSr&fallback_url=http://www.rarlab.com/.../winrar-x64-531pl.exe&downloadAs=WinRAR-12398-dp.exe

http://www.presentbundlesnew.com/c?x=8bb81jy7mfwa3c1Mxz9M7X6HnREQJdqiZTYuyKQ01uM=&c=pcBqXO nJFJjf02SEHn6kDmu9s9euD BeEOqkDTQAW8QYc/dm5MBpwN8sTXeGC/ki7l5S3lC1iAEYEFXW2Dy2 u8R48eEM9c1CaakwQfLPcLWZXTuOJDKMJsJV34Jmlv&fallback_url=http://www.rarlab.com/.../winrar-x64-531pl.exe&downloadAs=WinRAR-12398-dp.exe

http://www.quicknewbinaries.com/c?x=CPldll 6RWHvD5dqsmSpICF0c7LgjQMPP y7hrw/PZo=&c=V3n9VjvdGaI9UQ9y2MPfhP c2qb/RNHu4qVR/OB2Be7AAIvrAzu L8 DrH o7nBRgcu/s8SaH7yF2/WGUNRu0tOVGHqKqAmfuR3zm rRMH2MrOvtqftXAZ23muuBbuXx&fallback_url=http://www.rarlab.com/.../winrar-x64-531pl.exe&downloadAs=WinRAR-12398-dp.exe

http://www.sendtodaychuckle.com/c?x=9fzc8Fn5DLfNH5ZBAiOM/pCDHlSEUqche1bkaNfyT1k=&c=uomkcVt7ts3wyVGVDezMOol F4pp4dkZIXTWuXjeMJ3e bqnP9c192Zj5NwZ4K2kNHHJuDF29pg5J33JxPA70XZ9BdFWk38pzjj8QkinmmaJY1cs9jlmYt/u4rIKsNrT&fallback_url=http://www.rarlab.com/.../winrar-x64-531pl.exe&downloadAs=WinRAR-12398-dp.exe

http://www.applicationtourdownload.com/c?x=J7g5eS6yJcBblUaSDCW4806xoayT4vDbhoDGS6SL7sE=&c=dD6dFMuph/Nl3PVfAW7qCiGlI4uQ104Ay8NYToUXe6WbV//R7BCfUV7152GZOC5uHvbEVxNplnx1ehR/LvcU4ksHeXsNjpN0V0jsKF1XT5fn8cYfPRcX2hOzfkoTuaOh&fallback_url=http://www.rarlab.com/.../winrar-x64-531pl.exe&downloadAs=WinRAR-12398-dp.exe

http://www.chucklebestapp.com/c?x=83NDgjJWEcPJjUHIJFJC4kcL d2moazJEQkc1M5zGj4=&c=Wpp3NgiKvgdVun1306ujpToTbZLpWq1OH1nBHvU9qPpowsQ7iaz/3V4xW65JYOwAl3xxB8u5ZNDCnnbGVnGRqL5DM dLL6vRiozD8Di4g2bm49KN/qqVFOWPWyG59Q8c&fallback_url=http://www.rarlab.com/.../winrar-x64-531pl.exe&downloadAs=WinRAR-12398-dp.exe

Remove winrar-12398-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.