home

icreinstall_freefileviewersetup.exe

Bitberry Software

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_freefileviewersetup.exe by Bitberry Software has been detected as a potentially unwanted program by 13 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from file.org and multiple other hosts. While running, it connects to the Internet address os.solvefile.com on port 80 using the HTTP protocol.
Publisher:
Bitberry Software  (signed and verified)

MD5:
5467cfad56e5f7b9932f789e9e485da5

SHA-1:
e0b4ab7a4e75c90bac967ebea0ac5dd7ff433a44

SHA-256:
105eb9b5eb854c2c25c981fac33933910b5bc0022c7a0b9adc53aeb2d09ac5af

Scanner detections:
13 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/19/2024 6:18:58 PM UTC  (today)

Scan engine
Detection
Engine version

Bkav FE
W32.Clodda7.Trojan
1.3.0.4613

Dr.Web
Adware.InstallCore.133
9.0.1.0360

ESET NOD32
Win32/InstallCore.CU (variant)
7.9256

F-Prot
W32/InstallCore.R2.gen
v6.4.7.1.166

K7 AntiVirus
Unwanted-Program
13.175.10750

Malwarebytes
PUP.Optional.InstallCore
v2013.12.26.06

McAfee
Artemis!370EA922FC3E
5600.7269

Reason Heuristics
PUP.Installer.BitberrySoftware.FF
14.2.16.9

Rising Antivirus
PE:Malware.XPACK-LNR/Heur!1.5594
23.00.65.131224

Sophos
Install Core
4.96

Trend Micro House Call
TROJ_GEN.F47V1122
7.2.5

Vba32 AntiVirus
Signed-Adware.InstallCore
3.12.24.3

VIPRE Antivirus
InstallCore.b
27650

File size:
618.9 KB (633,744 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_freefileviewersetup.exe

Digital Signature
Signed by:
Bitberry Software

Authority:
The USERTRUST Network

Valid from:
11/1/2010 2:00:00 AM

Valid to:
11/1/2013 1:59:59 AM

Subject:
CN=Bitberry Software, O=Bitberry Software, STREET=Blomsterhaven 42, L=Holbaek, S=n/a, PostalCode=4300, C=DK

Issuer:
CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US

Serial number:
00BFCE655DC312403F105230416ACDF5B3

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:8OyMJfsGKe/bDOst3o3GasU/6f/9U8HohttGD+KwkF9Jmbx8mPhBTczJbfe:8OyMJfsU/bDOI3o3GrFU8HoTkY2aum3f

Entry address:
0x98CC

Entry point:
55, 8B, EC, 83, C4, CC, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, FA, 97, FF, FF, E8, 01, AA, FF, FF, E8, 2C, CC, FF, FF, E8, 73, CC, FF, FF, E8, 0A, F3, FF, FF, E8, 71, F4, FF, FF, 33, C0, 55, 68, 76, 9F, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 2C, 9F, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, B0, 40, 00, E8, 9B, FE, FF, FF, E8, 26, FA, FF, FF, 8D, 55, F0, 33, C0, E8, E0, D0, FF, FF, 8B, 55, F0, B8, D8, BD, 40, 00, E8, AB, 98, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, D8, BD, 40, 00, B2, 01, B8...
 
[+]

Entropy:
7.8812

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
36 KB (36,864 bytes)

The file icreinstall_freefileviewersetup.exe has been seen being distributed by the following 7 URLs.

http://file.org/.../dl.php?fid=3513943&p=None&a=upd

http://www.freefileviewer.com/.../FreeFileViewerUpdateSetup.exe

http://www.bitberryupdates.com/ffv_redir.html?r=ffvdl

http://www.freefileviewer.com/start_download.html

http://www.freefileviewer.com/.../FreeFileViewer2012Setup.exe

http://cdn1.bitberrydownload1.com/icdlm/.../FreeFileViewerSetup.exe

http://cdn1.freefileviewer.com/icdlm/.../FreeFileViewerSetup.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

Remove icreinstall_freefileviewersetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.