» microsoft powerpoint 2016.exe
Overview
Analysis
File Details
Downloads (15)

microsoft powerpoint 2016.exe

Lositog

Platform Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application microsoft powerpoint 2016.exe, “Lositog Setup ” by Platform Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.

File name:

Publisher:

Sofog (signed by Platform Beta (Fried Cookie Ltd))

Product:

Lositog

Description:

Lositog Setup

MD5:

22517bad60854a87f36d6c84cc5927bb

SHA-1:

d05ab611b8b5bfa21d087d33d89a7192371e690e

SHA-256:

be01e95f464a0ada7c649ec36f85cac4cf67970c16f7f6cd1da564348f5f87ec

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

12/28/2025 4:24:48 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.Installer.Installer (M)

16.2.23.15

File size:

1.1 MB (1,122,456 bytes)

Product version:

5.5

Software Web

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\downloads\microsoft powerpoint 2016.exe

Digital Signature

Signed by:

Platform Beta (Fried Cookie Ltd)

Authority:

GlobalSign nv-sa

Valid from:

12/16/2015 2:41:12 PM

Valid to:

7/7/2016 5:55:56 PM

Subject:

CN=Platform Beta (Fried Cookie Ltd), O=Platform Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121C446C50C8915C47DFD619121C2806B7E

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:QlLbhUIbi9g4RbjQ8uPkr7mQ9CbTicrjANztXn+U0MCY01Vii4GoZ0tt:QR7bb4RbjQ8H39Cb1ANzd+gCV1Viie

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file microsoft powerpoint 2016.exe has been seen being distributed by the following 15 URLs.

http://www.signtowntoday.com/c?x=zqRKlwYlD0FVQsTW8HhFAFyCT8A5 wP4qIXp8JDJCt4=&c=JIo5tjMSO44 BEYhEbWIB92xm3WhZMFaYS4Fif5N67BwALaeybt27RstE8OxM0L0oH9xUbZ/pGcfCt1cC1QgsiocfG Ro S3L13IT2BY1U0X rT6QuNaHRX5QlnplCQX&fallback_url=http://download.komputerswiat.pl/biuro-i-praca/.../microsoft-powerpoint-2016?altTemplate=dlUrlWithKsPlusGiftHtmlFile

http://www.signingidomain.com/c?x=489u/dWPs2 tSIbPgNcQ5IHY5ckOkDxOjaa1XbD4DOM=&c=9of3j5ZhENuxB4mTpFO5lNOMa1REjOJfFs7sjnvsBVhsmb4cn/0Xyd3t1K TDA6tJmqZYP3wI59bH0B4ypJZOrTssyu05IIr7IZhRxgraLrD7TCL9d7 YOm 8KwgYVum&fallback_url=http://download.komputerswiat.pl/biuro-i-praca/.../microsoft-powerpoint-2016?altTemplate=dlUrlWithKsPlusGiftHtmlFile

http://www.signingidomain.com/c?x=s76FzRes016r9JLVofhiYNGYvi J7oSIUzSS78b1xSw=&c=umzm4iux328A/hLUDdowSlScA0h/AJcHzKxfglngyqMlFdTZu9Gzlj0zeY u6grXbTnpH2lZLrKbe6aCsm4g3bETl 1eiLPU0vJOAKQAAYZ2/aEOTEHnTt65iKwzMoQp0BsmzCjzIGlVTt7 khDdwabzyWRpcLlP11amCsqBU6P35GXJ99O2JWPEAv2VSrjc&fallback_url=http://download.komputerswiat.pl/biuro-i-praca/.../microsoft-powerpoint-2016?altTemplate=dlUrlWithKsPlusGiftHtmlFile

http://www.signtowntoday.com/c?x=qz4IGKGnQyl3mjACEQewd8cCG3Ej2xy3RrDeP9Vml1E=&c=KMaj9ka05QC5yIweMArPBWjh8GlIntjzugGjY08PbFTcRZYbODkjCGZ2/XTApiCtanY5Vd6EH/6tQhfMAPUFwl50OLznEn4ePcFolzdW/ d6MlrV8hKt0s8bqcSPIC2Z&fallback_url=http://download.komputerswiat.pl/biuro-i-praca/.../microsoft-powerpoint-2016?altTemplate=dlUrlWithKsPlusGiftHtmlFile

http://www.signingidomain.com/c?x=/UDQV3AOA36qKPcGrLlEt/WB02qpNP9W6uSSyUX 8Ew=&c=HbGZ1dAYZZFQzvGEcJKCX0f3FIfHVxe8KpPb//74YkfY9iN1ozkLEMRs4j/7eq8hujlakPJpmKitJVzNr61imSgJ7tX4U8OvFns6duidxIZCA38cKSoW/bF7raECH2Rph0r6z/IMko0oCs03AEbJgAIcb3aD7U7ywXji2AbPvLGQYyxWFuKn2YSbqd0WYq/Q&fallback_url=http://download.komputerswiat.pl/biuro-i-praca/.../microsoft-powerpoint-2016?altTemplate=dlUrlWithKsPlusGiftHtmlFile

http://www.signingidomain.com/c?x=ze6hgyeILWGGGQA30ikMp/eQolhuEvWdVYPFJ9DAIIw=&c=b2M TiUaOB0iifkD4wm5V7/5GNmnh0loxErynuMg31vjILA1UMbP4no3t/ O4j7owxxsSs91vLJW3ntE2CgQWEiRppzsH0Sgg8QxnpkAj8pscZrKjPlnYoPJNtiI1TQD&fallback_url=http://download.komputerswiat.pl/biuro-i-praca/.../microsoft-powerpoint-2016?altTemplate=dlUrlWithKsPlusGiftHtmlFile

http://www.signingidomain.com/c?x=mPV0mqNEvjfDwUVv85kw 6113qLo1b91vMLht2Yk Ww=&c=rrVktCSN6U7Ps3q63KOXRa6 AFjE4kvJmHYqzPm5HC6gcfDaE2uT303cvohxpIYn6mVSRl7vvh44jI3Iy7OaE0J 2IVm7jL6bH7NqznRZcON1WNfT05xEnwvy9ISiIREJ8xKJGw5twGsN5bv0sRTSjqKEFfQjCrZNQUdWzHSyM/81kp57qJaJxsnE99SH0JJ&fallback_url=http://download.komputerswiat.pl/biuro-i-praca/.../microsoft-powerpoint-2016?altTemplate=dlUrlWithKsPlusGiftHtmlFile

http://www.signtowntoday.com/c?x=eCE0zkGjr85/zXrSp/R93aNlT3Q 3kYk /97kvM/3rY=&c=V5TXfD//G9bBEyCCTQhsbnhe31UuDVXF4Kj1YzFaUZP6DwzxX5YoawkI IAGr/wtzlEp84GsuW1XEPe/jjebZXradFuzmsfcIXAt2uhDcLOs5W/3QgyZwIRi0Vpo2Rk8&fallback_url=http://download.komputerswiat.pl/biuro-i-praca/.../microsoft-powerpoint-2016?altTemplate=dlUrlWithKsPlusGiftHtmlFile

http://www.signtowntoday.com/c?x=wsCIQ84N7KVNu49sW8yWSTzPWJ7/L731pXXccPMrXt4=&c=9TeA5fQbzjgonZu131/d/ICZaq08bwPOMfYpLV9BciskkoCEgnVjTYfkGoYmd7Olco5vSCiAulW 11uaQS/JslwoJD0aq4EhzdrnpkLGvfc4buz1RNqRajkkiBfpNaga&fallback_url=http://download.komputerswiat.pl/biuro-i-praca/.../microsoft-powerpoint-2016?altTemplate=dlUrlWithKsPlusGiftHtmlFile

http://www.signingidomain.com/c?x=qcJnNeFKuSyqPND5YiogT 3EjOjufc3uJO42YJUVPRE=&c=sjksvQPew/ls0l5zb5uft6FS VAeps44mk7AE7HsT6630cjRrTYyWmku6SzOVHapx5tCCflwVVWB5uUN9GVEm9kK2P gtQ2yDtvKrLB6x9AoVwD2WahnDGZHyfJO cBl9zE28BeALxacAEoPA51TYdhQWYqDKkrUv8iRtJyZzrjHkPbl5Om9Y1VdNPy9CxLs&fallback_url=http://download.komputerswiat.pl/biuro-i-praca/.../microsoft-powerpoint-2016?altTemplate=dlUrlWithKsPlusGiftHtmlFile

http://www.signingidomain.com/c?x=3CSll0Q/cLSGenImxP5abvz3VuvfPbVc6nibkUJK5eY=&c=hJ5AXYfIHEZ0Is4cMiMdWcC9BEYHqorCetN5vVhUUW/ShOcZdDEWAZjKCoKJ/37i qRodXhhmZt63Ki0Y1JhcW1NICBQzsSvxe/kGNcoOaHSzMWgc9vvP6dEbHJwJJyAqfvllFex3/xPAOVciPmOo6KTrZUrzbFI28W0mj5s1ICifLTVrCn4MMnyN72OBtMe&fallback_url=http://download.komputerswiat.pl/biuro-i-praca/.../microsoft-powerpoint-2016?altTemplate=dlUrlWithKsPlusGiftHtmlFile

http://www.signingidomain.com/c?x=3KxJIrIPV KZ1KHCmBi7XVVgHnHP1bxgZjZCD Rt5Lk=&c=3gjjH7wKp9h3VLM9sq/Eq9HGB1QCH3AHncp7Mw5lyjUzonWwfN54a718JjnO7/WrFR4 SGL13qq0Dq2qKE95FAsZiDSTTARxCH2hmweCpyBby yWjAJGqdP3dzBfnXn&fallback_url=http://download.komputerswiat.pl/biuro-i-praca/.../microsoft-powerpoint-2016?altTemplate=dlUrlWithKsPlusGiftHtmlFile

http://www.signingidomain.com/c?x=zlLUMwbPUjzX4mkxbu0j9tYw1Tfb4u7JDfKznkRt3CY=&c=gyBxdvofhW13xuya24qfFJcH3UXXeeKJiieYx2zNc B3ngx9ZxZDIQTMqevEl5VElFcd/GOw4/2EAHUva6GiC96Qa/wniHb8/hePe7lCcoToS eOmqfLkgoGaZzGKMZj&fallback_url=http://download.komputerswiat.pl/biuro-i-praca/.../microsoft-powerpoint-2016?altTemplate=dlUrlWithKsPlusGiftHtmlFile

http://www.signingidomain.com/c?x=N7Gth26FqBftocFOXbtFWtD09XkrNVGzgoIAfS1B/fw=&c=zBxRNe835RaNaTA2YYVBwi4faTLdMxIf iqTjbQk4ulMJN2XM5s4sL/7nz7godnrEm3KeV4fTZKVxh71bZubapw4e4znQv81CUkiQsxwH7AfSkkRUGgnknrZtDw3D2sC&fallback_url=http://download.komputerswiat.pl/biuro-i-praca/.../microsoft-powerpoint-2016?altTemplate=dlUrlWithKsPlusGiftHtmlFile

http://www.signingidomain.com/c?x=bZbZthaLJOLdNZict16HjCBYuHzcRNs203nAPX7n8X0=&c=S7BaA13rpGL4SSEoB4t219qv/sXXKNEh6NpovIc q9x8yY9i9J1TSD3/iQ44e2ZGIa9MZZigNa286LNekttzAEFKuKsF0CIqeCm0IvhXN28SP7O4n5hdLRL5JUYsR5PZ&fallback_url=http://download.komputerswiat.pl/biuro-i-praca/.../microsoft-powerpoint-2016?altTemplate=dlUrlWithKsPlusGiftHtmlFile

Remove microsoft powerpoint 2016.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.