home

icreinstall_google chrome downloader - jalantikus.exe

Software

PT MP Games

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_google chrome downloader - jalantikus.exe, “Software Setup ” by PT MP Games has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as Google's Chrome web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Application   (signed by PT MP Games)

Product:
Software

Description:
Software Setup

Version:
5.7.2.2

MD5:
6986619c030b14a41dd8f3ac6f423e3f

SHA-1:
22875647f07d452cbd9ad172b2f91082899b2adc

SHA-256:
42db1ba90a1fa07e66fadb5555e942a68a8b70e7a2679518767aeeac83ceecea

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Utilizes the InstallCore download manager that may bundle various adware-type offers.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
5/9/2024 10:57:44 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.PTMPGames.Installer (M)
16.2.15.2

File size:
1.1 MB (1,157,272 bytes)

Product version:
2.4.9

Copyright:
Installer Software

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_google chrome downloader - jalantikus.exe

Digital Signature
Signed by:
PT MP Games

Authority:
GlobalSign nv-sa

Valid from:
1/20/2016 5:49:25 PM

Valid to:
1/20/2017 5:49:25 PM

Subject:
CN=PT MP Games, O=PT MP Games, S=Jakarta, C=ID

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112196D38C2D01B48C24B0EE5080C33055F9

File PE Metadata
Compilation timestamp:
6/20/1992 5:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:F1ja2Rlfe/BjxIE/hLl3M2/Ax6Nxf4jLEpBm7k4zq:FBa2RapxIE/h58tLzk

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.6798

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file icreinstall_google chrome downloader - jalantikus.exe has been seen being distributed by the following URL.

http://www.hostingsoftwaredelivery.com/c?x=qHG1/oYFaBtUuzeSavrzHwTaEJMF9Dw 9BkPXTFbXp4=&c=nvSl9rIdF90dzRhl/7qDUDjty6rT8krSbhXUTLA7 cCfkR3ENZag Zu i7EWDCRJylJnH Izso1m wo99R9biJOzjrzjY3odXepV3CWMVa75yZ0hyZcCxdWCHuP1nNZC&downloadAs=Google Chrome Downloader - JalanTikus.exe&fallback_url=http://files.jalantikus.com/dde/24/.../ChromeStandaloneSetup.49.0.2623.39.Beta.JalanTikus.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.