{"id":7904,"date":"2015-10-28T12:31:58","date_gmt":"2015-10-28T12:31:58","guid":{"rendered":"http:\/\/www.freefixer.com\/b\/?p=7904"},"modified":"2018-05-29T11:55:41","modified_gmt":"2018-05-29T11:55:41","slug":"safemode-install-fried-cookie-ltd-18-detection-rate-installcore","status":"publish","type":"post","link":"https:\/\/www.freefixer.com\/b\/safemode-install-fried-cookie-ltd-18-detection-rate-installcore\/","title":{"rendered":"Safemode Install (Fried Cookie Ltd) – 18% Detection Rate – InstallCore"},"content":{"rendered":"

Hi there! Just a short post on a publisher called Safemode Install (Fried Cookie Ltd)<\/strong>. I just found a download named chrome-download.exe that was digitally by this publisher, and it turns out that it is detected by some anti-virus programs.<\/p>\n

\"Safemode<\/a><\/p>\n

By looking at the certificate we can see that Safemode Install (Fried Cookie Ltd) appears to be located in Israel. GlobalSign has issued the certificate.<\/p>\n

The issue here is that if chrome-download.exe really was a setup file for Google Chrome, it would be digitally signed by Google Inc.<\/strong> and not by some unknown company. I think this looks suspicious. Here’s how the authentic Google Chrome<\/strong> looks like when you double click on it. Notice that the “Verified publisher” says “Google Inc”.
\n\"Chrome<\/a><\/p>\n

So, why did I put up this blog post? Well, the thing is that the Safemode Install (Fried Cookie Ltd) file is detected by many of the scanners, according to VirusTotal<\/a>. ESET-NOD32 detects it as a variant of Win32\/InstallCore.ADE potentially unwanted<\/strong>, Malwarebytes detects it as PUP.Optional.InstallCore<\/strong>, AVG names chrome-download.exe as InstallCore.F22<\/strong> and Sophos detects it as Install Core Click run software (PUA).<\/strong><\/p>\n

\"Safemode<\/a><\/p>\n

Did you also find a file digitally signed by Safemode Install (Fried Cookie Ltd)? What kind of download was it and where did you find it?<\/p>\n

Thanks for reading.<\/p>\n","protected":false},"excerpt":{"rendered":"

Hi there! Just a short post on a publisher called Safemode Install (Fried Cookie Ltd). I just found a download named chrome-download.exe that was digitally by this publisher, and it turns out that it is detected by some anti-virus programs. By looking at the certificate we can see that Safemode Install (Fried Cookie Ltd) appears … Continue reading Safemode Install (Fried Cookie Ltd) – 18% Detection Rate – InstallCore<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[54],"tags":[774,104,252,251],"_links":{"self":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/7904"}],"collection":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/comments?post=7904"}],"version-history":[{"count":2,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/7904\/revisions"}],"predecessor-version":[{"id":7908,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/7904\/revisions\/7908"}],"wp:attachment":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/media?parent=7904"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/categories?post=7904"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/tags?post=7904"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}