home

icreinstall_itunes-11044-32-bits.exe

NO ZEBRA NETWORK LTDA

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_itunes-11044-32-bits.exe by NO ZEBRA NETWORKA has been detected as adware by 24 anti-malware scanners. The program is a setup application that uses the installCore installer. According to Microsoft Security Essentials, the software includes a bundle of the DealPly adware which is installed on a user's PC during setup using the InstallCore platform. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from dl.cdn.baixaki.com.br and multiple other hosts. While running, it connects to the Internet address os.solvefile.com on port 80 using the HTTP protocol.
Publisher:
NO ZEBRA NETWORK LTDA  (signed and verified)

MD5:
d3427bf3d2f8df01061c2d1f0dc42975

SHA-1:
027818a40fbae251cd21c1ff2ba3f02c19c06d76

SHA-256:
2a6652530067f88a3fb9d91f44538ace6fccc15aeb722e12dcea7dfb3f31f550

Scanner detections:
24 / 68

Status:
Adware

Explanation:
This software bundler installs other potentially unwanted software, including DealPly. Which includes offers in a user's web browser which state they are "Powered by DealPly".

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/26/2024 7:02:56 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.InstallCore
7.1.1

Avira AntiVirus
Adware/Installco.AB
7.11.117.42

avast!
Win32:Downloader-TPU [PUP]
2014.9-140215

Baidu Antivirus
Adware.Win32.InstallCore
4.0.3.1487

Bkav FE
W32.Clod03c.Trojan
1.3.0.4562

Comodo Security
Application.Win32.InstallCore.AB
17365

Dr.Web
Adware.InstallCore.107
9.0.1.0356

ESET NOD32
Win32/InstallCore.BY (variant)
7.9117

Fortinet FortiGate
Riskware/InstallCore
8/7/2014

F-Prot
W32/InstallCore.R2.gen
v6.4.7.1.166

IKARUS anti.virus
SoftwareBundler
t3scan.2.2.29

K7 AntiVirus
Trojan
13.1712333

Malwarebytes
PUP.Optional.InstallCore
v2013.12.22.03

McAfee
Artemis!D3427BF3D2F8
5600.7273

Microsoft Security Essentials
SoftwareBundler:Win32/DealPly
1.163.1557.0

Qihoo 360 Security
Win32/Virus.Adware.dc7
1.0.0.1015

Reason Heuristics
PUP.NOZEBRANETWORKA.a
14.8.7.21

Rising Antivirus
PE:Malware.InstallCore!6.4
23.00.65.131220

Sophos
Generic PUA EA
4.98

SUPERAntiSpyware
PUP.InstallCore/Variant
10892

Trend Micro House Call
TROJ_GEN.F47V0708
7.2.362

Trend Micro
TROJ_GEN.R0CBC0OAO14
10.465.07

Vba32 AntiVirus
Downware.InstallCore
3.12.26.0

VIPRE Antivirus
InstallCore
23900

File size:
643.9 KB (659,320 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_itunes-11044-32-bits.exe

Digital Signature
Signed by:
NO ZEBRA NETWORK LTDA

Authority:
COMODO CA Limited

Valid from:
7/31/2012 1:00:00 AM

Valid to:
8/1/2013 12:59:59 AM

Subject:
CN=NO ZEBRA NETWORK LTDA, O=NO ZEBRA NETWORK LTDA, STREET=R PASTEUR 463, L=BATEL CURITIBA, S=PARANA, PostalCode=80250080, C=BR

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
26556D2FFBCEFA88C86C73FAA9F72A54

File PE Metadata
Compilation timestamp:
6/19/1992 11:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:jR8kyMJfsoULtyefExEL52EyE6Wq45t4yXijqHYSgCWDqYJ78AV+ytTHApWN7i4E:l8kyMJfs955fVSk15SEiW4sWb8A7HAE4

Entry address:
0x98CC

Entry point:
55, 8B, EC, 83, C4, CC, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, FA, 97, FF, FF, E8, 01, AA, FF, FF, E8, 2C, CC, FF, FF, E8, 73, CC, FF, FF, E8, 0A, F3, FF, FF, E8, 71, F4, FF, FF, 33, C0, 55, 68, 76, 9F, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 2C, 9F, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, B0, 40, 00, E8, 9B, FE, FF, FF, E8, 26, FA, FF, FF, 8D, 55, F0, 33, C0, E8, E0, D0, FF, FF, 8B, 55, F0, B8, D8, BD, 40, 00, E8, AB, 98, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, D8, BD, 40, 00, B2, 01, B8...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
36 KB (36,864 bytes)

The file icreinstall_itunes-11044-32-bits.exe has been seen being distributed by the following 2 URLs.

http://dl.cdn.baixaki.com.br/programas/34357/.../itunes-11044-32-bits.exe

http://dl.cdn.baixaki.com.br/programas/34357/.../itunes-11044-32-bits.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdneu.webfilescdn.com  (65.254.40.36:80)

Remove icreinstall_itunes-11044-32-bits.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.