home

icreinstall_five-nights-at-freddys.exe

Rubira

Quality Install (Alpha Criteria Ltd.)

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_five-nights-at-freddys.exe, “Rubira Setup ” by Quality Install (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Quality Install (Alpha Criteria Ltd.)  (signed and verified)

Product:
Rubira

Description:
Rubira Setup

Version:
3.6.4.5

MD5:
15102b32eb5711d0071126efac417bd0

SHA-1:
8ce8d2a2aa14775f85686fb9e2ef54f7e7150d78

SHA-256:
09ff0b8ad0c6236d3fd2ce8a50dc3242cdbed3e607d321d23676dd64de769351

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
8/6/2025 12:43:25 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC.Installer (M)
16.7.8.2

File size:
1011 KB (1,035,280 bytes)

Product version:
1.6

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_five-nights-at-freddys.exe

Digital Signature
Signed by:
Quality Install (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
1/6/2016 7:14:15 AM

Valid to:
8/4/2016 9:59:05 AM

Subject:
CN=Quality Install (Alpha Criteria Ltd.), O=Quality Install (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121BA484E4C31175E4A844ED055428DEC42

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:hifk0su4mZWcj82/3pYRA0FRfXVOs8OMBTlP0QjcpMXVJo:wpZWcjz/90UWGpf

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9246

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file icreinstall_five-nights-at-freddys.exe has been seen being distributed by the following 15 URLs.

http://www.appsworlddelivery.com/c?x=jo6K0aeiOs8IoSlPI0vVhTUIqN387hZEuWZVLSuu5Xw=&e=0&c=eALKE3Hi9vKHRydsNcq3969/nDb3Qp9RUoG95flFc9mxT6gwxKqP2zwLunk/9wy4KSWC2Wm7ca4BE8PSEGWTdmhhcthBclTGNj7RzSG1Cg2iOET3AgHfU23 0LpX5Co5matTcMPfYpGD5LPSb btHfgxFJSiGvv9gNhuGAmg8r0=&downloadAs=Five-Nights-at-Freddys.exe&fallback_url=http://softdownload4.com/s4m/.../five-nights-at-freddys.exe

http://www.appsworlddelivery.com/c?x=gpB672vZeKNVyYmtjOuiT30qsbld/4oNQqp725jysi8=&e=0&c=2XK7Ixj1/ueoGRkbKw6HnpmbgYLPuITS0zzNuftTd02f6Kl/ZZ4O0R82eTpV1sQYkz4vCOJu0lBPNDtL4ZBX RNs3dk3S nFRRHxBM2E3L4krzLk2r4rpoi /WJkm NIWB0sz7EFieM07biuNTFUIdX/7Ku7Ts9boVDB4/01/dY=&downloadAs=Five-Nights-at-Freddys.exe&fallback_url=http://softdownload4.com/s4m/.../five-nights-at-freddys.exe

http://www.appsworlddelivery.com/c?x=doa JJ9oaX0pRzo/gPOiVFzxq9TVM4mpq XMppUQHTQ=&e=0&c=3TaCkwR37AYyZcuscH j4lwMBuCnJenynBBgZYAlQEiduXYJxP6XqiWewSsB2BgSz6yl3W4rvk5eBU3cPsyUFqal1KqiekoMQPygByb96vPRgVelHal4 tQVR5X3w5E6eBNRqzGLtCc 9znqlMCboG1354sNCx5SMSZhlMN//No=&downloadAs=Five-Nights-at-Freddys.exe&fallback_url=http://softdownload4.com/s4m/.../five-nights-at-freddys.exe

http://www.appsworlddelivery.com/c?x=lWoI6OgQcoobVCgMdYEIvHgf9Qib3g4SKCHFEOm6C6A=&c=EiyjqJUoRBtH8AOTR5Ad3Y7dV9xACG5tbnQ/pgrP3ee rRy2hX0EvEcPmLENYQWo3EeBBR3ujiplSFvNbNNsVfYRtJf8OnS/XO0wnr8HIBa/hf1L/J/Wyuc/yHJoR1kwJvLeXcrOZaZtURWcBvIvbYnOcaiz1OD1T/L0buoJLu8=&e=0&downloadAs=Five-Nights-at-Freddys.exe&fallback_url=http://softdownload4.com/s4m/.../five-nights-at-freddys.exe

http://www.appsworlddelivery.com/c?x=bzOd0nsHuyqFxkE8UtMEas3orFbgj05pimlXlSUi2RY=&c=l1i6FeHrCYEXdnHgeTRNWKTKB2WRg7qhIAL294VFE4hJDh1wgQEEjsONAjnwG 1zeKJ 27nOYgF56HiLRFqPnNQ9qRw8qbIifbkLsV B2WdqzM9cZ9 FgbwEfniaZTFSkzpKQLeEPtVFMBTzHjjuxlnzmZHnnuwyzrbLsuTaIgM=&e=0&downloadAs=Five-Nights-at-Freddys.exe&fallback_url=http://softdownload4.com/s4m/.../five-nights-at-freddys.exe

http://www.appsworlddelivery.com/c?x=lLZCHIRx1e3N7uQ7DoGkigtHJ435hE2siwNDNStccHs=&c=ZgNETwbUdujhZlhRpsdzBuCebvK RzArpvcJp5vNm0KrJYHOXC/AmhFp8SuvAWanxyE54VAVIi xBVb06OszGReYzM1zGdcIdUO/M7Qii8VE9d2pjfnfLudCDPKSLSEQBs2zbm8mjLw7cd9DMZ3TsyiV ZabFrNpAai10iIxRWY=&e=0&downloadAs=Five-Nights-at-Freddys.exe&fallback_url=http://softdownload4.com/s4m/.../five-nights-at-freddys.exe

http://www.appsworlddelivery.com/c?x=jKfsxM6pEmQHJbpGBda0dOFazP8RSmCR8j82hpdAEPU=&c=vOrk9KllZy1UJhE0El075vDZEkS42ga0qKRH27 Jfz3XXD89ismx J8gHrtO3Bou92vwkq7qrpBIe5uExXopwGB2Br9HsqC7KFAqzkam40dfiDquHvY RBcif2k1nFyQQsSBmLT0 2KbRmhgA1hCLm/vnTVIBqruVuqSzeF34tY=&e=0&downloadAs=Five-Nights-at-Freddys.exe&fallback_url=http://softdownload4.com/s4m/.../five-nights-at-freddys.exe

http://www.appsworlddelivery.com/c?x=i/KGEDJfhwV2W0fKHbCL1Fh7lFrHRDgoTwKS/NAkxuw=&c=CRPEwh/0wNZNE7uBqYe1P hJSscHqOwAjxXMQbdhwfieusJrsWyrUyZ6fFMKkHMsj a09JrJPdAg4nDMX/d5g9wkP7ZmzuOUTWOYADJYSDFeJF/xI/6L5ejq5ui8mfCnqknYkYbMtBJgVXHUPWIATit1TU9rQdDnNjE8BuDjH6k=&e=0&downloadAs=Five-Nights-at-Freddys.exe&fallback_url=http://softdownload4.com/s4m/.../five-nights-at-freddys.exe

http://www.appsworlddelivery.com/c?x=sY0Lp3qJpc4qhqP8QipY6tJBvLKmbkOg3J4HDf2kEkk=&e=0&c=M6y7ksvI3Wi5xxsnvQJBSG8m ZA4Om4WJFT1G77lcrwfdjN9 sRBb8UA1MIHsOIGYtGR5P2Wy0F1ELmRnJ4/jabf5SVNEfx7PqC4Z09Evv231Til84X/Mqf2VyksIwFxwDDqXql/iCLIrntq7wBkCG1Ai3Dpc4GsVTSi9ka4oZQ=&downloadAs=Five-Nights-at-Freddys.exe&fallback_url=http://softdownload4.com/s4m/.../five-nights-at-freddys.exe

http://www.appsworlddelivery.com/c?x=vJSdi5Ys7k5FRccvvXCZkob9oNNFjlsQGZZCBquliJM=&c=qj5RUCgysil1n8HDE6UoVuz/CEvdf1X8Bs/EQ1NrlKd4p6donlZi7Kb0Cvz9 NWavTDT4My4WAgL MHWVQhVWfSe8bgpii5x0XqrWfzPdp0gBdtGv1CYfQvQMCwldwuMkzYDEtDhe01Kw4PtWYs5n88LpCML3xUiY//UHgs6h9I=&e=0&downloadAs=Five-Nights-at-Freddys.exe&fallback_url=http://softdownload4.com/s4m/.../five-nights-at-freddys.exe

http://www.appsworlddelivery.com/c?x=pQBk0wzez qKsTndp1Jd4/e1Q8ibBewC/XCDDkXnpdo=&e=0&c=ylBUL7LeU2SyQjp/5rY0sdaJP/CsbczlqC5LwAwInb2oaiSjTVBgCyDERZn/8wZoloLFPdRx/F77FoyXTgowuMo9SHRpqr553V8LNR35DJ0QUX/wQN5ruS0XGAQtkCgb25DPnByF3LckVT0oTUQ4Njt5kLSPuuaTrX8Ry6VViFY=&downloadAs=Five-Nights-at-Freddys.exe&fallback_url=http://softdownload4.com/s4m/.../five-nights-at-freddys.exe

http://www.appsworlddelivery.com/c?x=SnMfLvNO6HOzx4uoSKJmNou/eCdp4JYfxN8CD5VKc9M=&e=0&c=7mUp3lwTOIgRajtLYkAZYegCuv6zNm5oWagXZownMaSDeB93mfpAAMS NpUjb1mvlFn0e2/qEmiUPUUqJA4KX6nAzmkRwugC5RIAPbso64ThOUbl8Ugq8YI8zntn1PJ65cM/IBmfIyeImFwafTMPoHKeSnen42MgCFjGek4oiOc=&downloadAs=Five-Nights-at-Freddys.exe&fallback_url=http://softdownload4.com/s4m/.../five-nights-at-freddys.exe

http://www.appsworlddelivery.com/c?x=x6J4YsS7L7wny8ClldECfTBI56SCg7fzvawKaBcayno=&e=0&c=BkyS8nDFMQKcLI8QI1rV0zjFRAZklor3BxgjiIQhwZLQaEXv/2xCHN8S7tAWOX7OdVtYC/xzehW vlg2eoV8sSgeTdgBrmzq1rcC70wxjEzm2RfAZgotJqY7oWcFNDN7kTonRy yz3vZSeAuEVxGnt2oZr1DyzM64VTlThLsf2k=&downloadAs=Five-Nights-at-Freddys.exe&fallback_url=http://softdownload4.com/s4m/.../five-nights-at-freddys.exe

http://www.appsworlddelivery.com/c?x=Pb68e8EUZ8D3zv pJkwGj/JQWUllIu/tHknioGmRHc8=&c=l9E6w70Mpep5OSzb3OVhAbFbEvnsaD2l1bJv3CYWQBFSkofQLoSPH tHh3du66fc03woFBY/fP3pusybu9a6gibemZk7uv9YxavTA7Fu2Fv6uZkwYHICc a2iECofmeneHngrdQA qS8rEgmecIYhEK5eYbhtd6jl2d 6fi/YtE=&e=0&downloadAs=Five-Nights-at-Freddys.exe&fallback_url=http://softdownload4.com/s4m/.../five-nights-at-freddys.exe

http://www.appsworlddelivery.com/c?x=KUMqFMQuAD5WFqSaCZtJEpUKPTzw2ITNJSMQKydEJz4=&c=Xax5PaTi7Ir2VZ5YUbx91Vwu9kZZK7VP9wu6bnFp5RitLDLXAil67uYAUsubSELRI9JZpu8O/jAv2ETy3acfbnJDwh0lAAkSnhd2PSdC/p2V65zSjWiP2wcuj1boBXw5iF4KGH106smpv9h2ch6IA3XJzVdrHHftZzkZ7ecDJCQ=&e=0&downloadAs=Five-Nights-at-Freddys.exe&fallback_url=http://softdownload4.com/s4m/.../five-nights-at-freddys.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdneu.webfilescdn.com  (65.254.40.36:80)

Remove icreinstall_five-nights-at-freddys.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.