icreinstall_freeware-pdf-unlocker-104-32-bits.exe

ISBRInstaller

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_freeware-pdf-unlocker-104-32-bits.exe by ISBRInstaller has been detected as adware by 18 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. While running, it connects to the Internet address os.solvefile.com on port 80 using the HTTP protocol.
Publisher:
ISBRInstaller  (signed and verified)

MD5:
8d429b27a771fa19209513e3c066022c

SHA-1:
2396ce48f9e70953620c05f4fc7e3e643299ded3

Scanner detections:
18 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/10/2016 6:11:27 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Trojan.Kryptik
7.1.1

Avira AntiVirus
7.11.134.188

Antiy Labs AVL
Trojan/Win32.SGeneric
0.1.0.1

AVG
Generic_c
2015.0.3447

Comodo Security
ApplicUnwnt
17886

Dr.Web
Trojan.Packed.25266
9.0.1.0161

Emsisoft Anti-Malware
Win32.Madanf
8.14.08.07.08

ESET NOD32
Win32/Kryptik.BWAM (variant)
8.9501

Fortinet FortiGate
W32/Kryptik.BWAM!tr
6/10/2014

K7 AntiVirus
Unwanted-Program
13.176.11436

K7 Gateway Antivirus
Unwanted-Program
13.176.11436

McAfee
Artemis!2795D39F642A
5600.7045

McAfee Web Gateway
Artemis!2795D39F642A
7.7045

Qihoo 360 Security
Win32/Trojan.1df
1.0.0.1015

Reason Heuristics
PUP.ISBRInstaller.n
14.8.7.20

Sophos
Generic PUA BK
4.98

Trend Micro House Call
TROJ_GEN.F47V0228
7.2.161

VIPRE Antivirus
InstallCore.b
27084

File size:
601.6 KB (616,056 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\Documents and Settings\{user}\Local settings\temp\icreinstall_freeware-pdf-unlocker-104-32-bits.exe

Digital Signature
Signed by:

Authority:
COMODO CA Limited

Valid from:
7/16/2013 9:00:00 PM

Valid to:
7/17/2014 8:59:59 PM

Subject:
CN=ISBRInstaller, O=ISBRInstaller, STREET=Ronthschilde 63, L=Tel Aviv, S=Tel Aviv, PostalCode=6527319, C=IL

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
158EF632B1D9C77CF5AAB6A9367E7FCE

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:9QFagKpV3iSymsjNMKDnBAzYtm9n6qads1BOYmrKC1y1ZrC2U:9QFNKfSKsjyWAzYs9ids1wYeKCA1ZrC7

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)